@code-yeongyu/senpi-ai 2026.11.4-2 → 2026.11.6-1

package/dist/api/anthropic-messages.js

@@ -14,7 +14,7 @@ import { withGzipRequestBodies } from "../utils/gzip-request-body.js";
 import { headersToRecord, providerHeadersToRecord } from "../utils/headers.js";
 import { parseJsonWithRepair, parseStreamingJson } from "../utils/json-parse.js";
 import { getPiUserAgent } from "../utils/pi-user-agent.js";
-import { getAnthropicCompat, isAnthropicApiBaseUrl } from "../utils/prompt-cache-ttl.js";
+import { allowsAnthropicLongCacheRetention, getAnthropicCompat } from "../utils/prompt-cache-ttl.js";
 import { attachProviderDiagnostic } from "../utils/provider-diagnostic-carrier.js";
 import { anthropicProviderDiagnosticFromError, anthropicProviderDiagnosticFromSseData, awaitProviderTransport, } from "../utils/provider-diagnostic-sources.js";
 import { getProviderEnvValue } from "../utils/provider-env.js";
@@ -63,11 +63,7 @@ function getCacheControl(model, cacheRetention, env) {
     if (retention === "none") {
         return { retention };
     }
-    const ttl = retention === "long" &&
-        isAnthropicApiBaseUrl(model.baseUrl) &&
-        getAnthropicCompat(model).supportsLongCacheRetention
-        ? "1h"
-        : undefined;
+    const ttl = retention === "long" && allowsAnthropicLongCacheRetention(model) ? "1h" : undefined;
     return {
         retention,
         cacheControl: { type: "ephemeral", ...(ttl && { ttl }) },

package/dist/api/openai-images-params.d.ts

@@ -6,6 +6,8 @@ export type OpenAIImageSize = "auto" | "1024x1024" | "1536x1024" | "1024x1536" |
 export type OpenAIImageBackground = "auto" | "transparent" | "opaque";
 export type OpenAIImageOutputFormat = "png" | "jpeg" | "webp";
 export type OpenAIImageModeration = "auto" | "low";
+/** GPT Image 2.6 planning effort before rendering; the API defaults to `high`. */
+export type OpenAIImageComplexity = "low" | "medium" | "high";
 export interface OpenAIImagesOptions extends ImagesOptions {
     size?: OpenAIImageSize;
     quality?: OpenAIImageQuality;
@@ -17,12 +19,15 @@ export interface OpenAIImagesOptions extends ImagesOptions {
     /** 0-100 compression for jpeg/webp output only. */
     outputCompression?: number;
     moderation?: OpenAIImageModeration;
+    /** GPT Image 2.6 only; older models reject the field, so omit it for them. */
+    complexity?: OpenAIImageComplexity;
     /** Inpainting mask applied to the first input image; requires at least one image input. */
     mask?: ImageContent;
 }
 export type OpenAIImageParams = Omit<ImageGenerateParamsNonStreaming, "size" | "quality"> & {
     size?: OpenAIImageSize;
     quality?: OpenAIImageQuality;
+    complexity?: OpenAIImageComplexity;
     image?: Uploadable[];
     mask?: Uploadable;
 };

package/dist/api/openai-images-params.js

@@ -85,6 +85,7 @@ export function buildParams(model, context, options) {
         ...(options?.background === undefined ? {} : { background: options.background }),
         ...(options?.outputCompression === undefined ? {} : { output_compression: options.outputCompression }),
         ...(options?.moderation === undefined ? {} : { moderation: options.moderation }),
+        ...(options?.complexity === undefined ? {} : { complexity: options.complexity }),
     };
 }
 export function isImageParams(value) {

package/dist/api/openai-responses-prompt-cache.d.ts

@@ -9,6 +9,8 @@ export interface OpenAIPromptCacheOptionsPayload {
     prewarm?: boolean;
     comparison_response_id?: string;
 }
+/** SIWC plan usage cannot opt into explicit prompt caching through inherited catalog compat. */
+export declare function supportsOpenAIResponsesExplicitPromptCacheMode(model: Model<"openai-responses">): boolean;
 /** Explicit prompt-cache models (GPT-5.6+) on the first-party api.openai.com endpoint. */
 export declare function isOpenAIResponsesPromptCacheModel(model: Model<any>): boolean;
 /**

package/dist/api/openai-responses-prompt-cache.js

@@ -1,9 +1,11 @@
+/** SIWC plan usage cannot opt into explicit prompt caching through inherited catalog compat. */
+export function supportsOpenAIResponsesExplicitPromptCacheMode(model) {
+    const compat = model.compat;
+    return !compat?.siwc && compat?.supportsExplicitPromptCacheMode === true;
+}
 /** Explicit prompt-cache models (GPT-5.6+) on the first-party api.openai.com endpoint. */
 export function isOpenAIResponsesPromptCacheModel(model) {
-    if (model.api !== "openai-responses")
-        return false;
-    const compat = model.compat;
-    if (compat?.supportsExplicitPromptCacheMode !== true)
+    if (model.api !== "openai-responses" || !supportsOpenAIResponsesExplicitPromptCacheMode(model))
         return false;
     try {
         return new URL(model.baseUrl || "https://api.openai.com/v1").hostname === "api.openai.com";

package/dist/api/openai-responses-shared.d.ts

@@ -41,6 +41,7 @@ export type ResponsesDeferredToolsMode = "additional-tools" | "tool-search";
 export declare function resolveResponsesDeferredToolsMode(compat: {
     supportsAdditionalTools?: boolean;
     supportsToolSearch?: boolean;
+    siwc?: boolean;
 } | undefined): ResponsesDeferredToolsMode | undefined;
 export interface ResponsesToolPlacement {
     /** Tools sent in the top-level `tools` field. */

package/dist/api/openai-responses-shared.js

@@ -122,6 +122,8 @@ function withContextProvenance(item, message, seal) {
 export function resolveResponsesDeferredToolsMode(compat) {
     if (compat?.supportsAdditionalTools)
         return "additional-tools";
+    if (compat?.siwc)
+        return undefined;
     return compat?.supportsToolSearch ? "tool-search" : undefined;
 }
 /**
@@ -217,7 +219,10 @@ export function convertResponsesMessages(model, context, allowedToolCallProvider
     };
     const includeInitialSystemMessage = options?.includeSystemPrompt ?? true;
     const compat = model.compat;
-    const instructionRole = model.reasoning && compat?.supportsDeveloperRole !== false ? "developer" : "system";
+    const instructionRole = model.compat?.siwc ||
+        (model.reasoning && compat?.supportsDeveloperRole !== false)
+        ? "developer"
+        : "system";
     let msgIndex = 0;
     let sourceIndex = 0;
     for (const msg of transformedMessages) {

package/dist/api/openai-responses.js

@@ -19,7 +19,7 @@ import { buildCopilotDynamicHeaders, hasCopilotVisionInput } from "./github-copi
 import { resolveOpenAIClientAuth } from "./openai-client-auth.js";
 import { deriveOpenAIPromptCacheKey } from "./openai-prompt-cache.js";
 import { applyAllowedToolsChoice, hasRefusedAllowedToolsChoice, isAllowedToolsChoiceRefusal, rememberAllowedToolsChoiceRefusal, restrictToAllowedTools, } from "./openai-responses-allowed-tools.js";
-import { findPromptCacheComparisonResponseId, withPromptCacheComparison, } from "./openai-responses-prompt-cache.js";
+import { findPromptCacheComparisonResponseId, supportsOpenAIResponsesExplicitPromptCacheMode, withPromptCacheComparison, } from "./openai-responses-prompt-cache.js";
 import { convertResponsesMessages, convertResponsesTools, processResponsesStream, resolveResponsesDeferredToolsMode, resolveResponsesToolPlacement, } from "./openai-responses-shared.js";
 import { buildBaseOptions, clampMaxForOpenAI, OPENAI_RESPONSES_RESERVED_BODY_KEYS } from "./simple-options.js";
 import { startWebSocketLiveness } from "./websocket-liveness.js";
@@ -69,8 +69,8 @@ function getCompat(model, env) {
         supportsStrictMode: model.compat?.supportsStrictMode ?? false,
         supportsOpenAIGrammarTools: model.compat?.supportsOpenAIGrammarTools ?? false,
         supportsAdditionalTools: model.compat?.supportsAdditionalTools ?? false,
-        supportsToolSearch: model.compat?.supportsToolSearch ?? false,
-        supportsExplicitPromptCacheMode: model.compat?.supportsExplicitPromptCacheMode ?? false,
+        supportsToolSearch: !model.compat?.siwc && (model.compat?.supportsToolSearch ?? false),
+        supportsExplicitPromptCacheMode: supportsOpenAIResponsesExplicitPromptCacheMode(model),
         supportsConfigurationUpdate: model.compat?.supportsConfigurationUpdate ?? false,
         supportsMaxOutputTokens: model.compat?.supportsMaxOutputTokens ?? true,
         supportsForcedToolChoice: model.compat?.supportsForcedToolChoice ?? true,
@@ -160,6 +160,73 @@ function formatOpenAIResponsesError(error, provider, siwc = false) {
         ? `${errorMessage}\nCheck your ChatGPT usage: ${CHATGPT_USAGE_URL}`
         : errorMessage;
 }
+/**
+ * SIWC preview restrictions apply after hooks and sampling overrides too.
+ * https://developers.openai.com/siwc/token-sharing-open-source/preview-limitations
+ */
+function shapeSiwcRequest(params) {
+    const body = { ...params, store: false, stream: true };
+    for (const key of [
+        "background",
+        "conversation",
+        "max_output_tokens",
+        "max_tool_calls",
+        "metadata",
+        "moderation",
+        "multi_agent",
+        "prompt",
+        "prompt_cache_retention",
+        "safety_identifier",
+        "temperature",
+        "top_logprobs",
+        "top_p",
+        "truncation",
+        "user",
+        "previous_response_id",
+        "prompt_cache_options",
+    ])
+        delete body[key];
+    body.input =
+        typeof body.input === "string"
+            ? [{ role: "user", content: body.input }]
+            : body.input?.map((item) => "role" in item && item.role === "system" ? { ...item, role: "developer" } : item);
+    const tools = body.tools
+        ?.filter((tool) => tool.type === "function" ||
+        tool.type === "custom" ||
+        tool.type === "namespace" ||
+        tool.type === "web_search")
+        .map((tool) => tool.type === "namespace"
+        ? {
+            ...tool,
+            tools: tool.tools.filter((nested) => nested.type === "function" || nested.type === "custom"),
+        }
+        : tool);
+    // SIWC accepts local tools in namespaces or additional_tools, not flat top-level definitions.
+    const eagerTools = tools?.filter((tool) => tool.type === "function" || tool.type === "custom") ?? [];
+    body.tools = tools?.filter((tool) => tool.type !== "function" && tool.type !== "custom");
+    if (eagerTools.length > 0) {
+        Reflect.set(body, "input", [
+            { type: "additional_tools", role: "developer", tools: eagerTools },
+            ...(body.input ?? []),
+        ]);
+    }
+    const choice = body.tool_choice;
+    if (isRecord(choice)) {
+        if (choice.type === "allowed_tools" && Array.isArray(choice.tools)) {
+            const tools = choice.tools.filter((tool) => isRecord(tool) && (tool.type === "function" || tool.type === "custom" || tool.type === "web_search"));
+            Reflect.set(body, "tool_choice", tools.length > 0
+                ? {
+                    ...choice,
+                    tools,
+                }
+                : "none");
+        }
+        else if (choice.type !== "function" && choice.type !== "custom" && choice.type !== "web_search") {
+            delete body.tool_choice;
+        }
+    }
+    return body;
+}
 /**
  * Generate function for OpenAI Responses API
  */
@@ -206,7 +273,9 @@ export const stream = (model, context, options) => {
                 params = { ...params, tools: limitedTools.tools };
                 recordGitHubCopilotToolLimit(output, limitedTools.omittedCount);
             }
-            const transport = options?.transport ?? "sse";
+            if (compat.siwc)
+                params = shapeSiwcRequest(params);
+            const transport = compat.siwc ? "sse" : (options?.transport ?? "sse");
             let refusedAllowedToolsOverWebSocket = false;
             if (transport !== "sse" && compat.supportsWebSocket) {
                 let websocketStarted = false;
@@ -346,6 +415,8 @@ function resolveSimpleOptions(model, context, options) {
  * prefix matches the reasoning effort, service tier, and cache options that turn sends.
  */
 export async function warmOpenAIResponsesPromptCache(model, context, options) {
+    if (model.compat?.siwc)
+        throw new Error("SIWC requires streaming inference; prompt-cache prewarm is unsupported");
     const prefix = normalizeContext({ ...context, messages: [] });
     const resolved = resolveSimpleOptions(model, prefix, options);
     const clientAuth = resolveOpenAIClientAuth(model.provider, resolved.apiKey, resolved.headers);

package/dist/api/warm-prompt-cache.js

@@ -1,6 +1,6 @@
 import { withGzipRequestBodies } from "../utils/gzip-request-body.js";
 import { providerHeadersToRecord } from "../utils/headers.js";
-import { getAnthropicCompat, isAnthropicApiBaseUrl } from "../utils/prompt-cache-ttl.js";
+import { getAnthropicCompat, supportsAnthropicCacheWarming } from "../utils/prompt-cache-ttl.js";
 import { isOpenAIResponsesPromptCacheModel } from "./openai-responses-prompt-cache.js";
 import { getPromptCacheWarmer } from "./prompt-cache-warmers.js";
 export async function warmPromptCache(model, context, options = {}) {
@@ -24,10 +24,11 @@ export async function warmPromptCache(model, context, options = {}) {
             usageRaw,
         };
     }
-    if (model.api !== "anthropic-messages" || !isAnthropicApiBaseUrl(model.baseUrl)) {
+    if (model.api !== "anthropic-messages")
         return { supported: false };
-    }
     const anthropicModel = model;
+    if (!supportsAnthropicCacheWarming(anthropicModel))
+        return { supported: false };
     // Loaded lazily: a static import would pull the Anthropic SDK into the root
     // barrel and break the lazy provider-loading contract (lazy-module-load.test.ts).
     const [{ default: Anthropic }, { buildAnthropicWarmPromptCacheParams }] = await Promise.all([

package/dist/auth/pool/slots.d.ts

@@ -1,9 +1,9 @@
 import type { ProviderEnv } from "../../types.ts";
-import type { Credential } from "../types.ts";
+import type { Credential, OAuthCredentials } from "../types.ts";
 export type { Credential };
 export declare const DEFAULT_SLOT_NAME = "default";
 export type CredentialSlotSource = "login" | "import" | "env";
-export type CredentialSlot = {
+export type CredentialSlot = Partial<OAuthCredentials> & {
     /** Immutable operational identity. */
     name: string;
     /** Optional presentation metadata; never used for credential selection. */
@@ -77,6 +77,15 @@ export declare class EmptyApiKeyError extends Error {
     readonly name = "EmptyApiKeyError";
     constructor();
 }
+/**
+ * A reauthorization signed in a different ChatGPT account than the saved one it was started for (#5003). Nothing
+ * is written: the selected account keeps its registration and the other sign-in is not silently swapped in.
+ */
+export declare class ReauthorizeAccountMismatchError extends Error {
+    readonly name = "ReauthorizeAccountMismatchError";
+    readonly slotName: string;
+    constructor(slotName: string);
+}
 /** Drops a blank or missing `key` from an API-key credential; used only for providers that declare `keyOptional`. */
 export declare function withoutBlankKey(credential: Credential): Credential;
 /**
@@ -111,6 +120,8 @@ export type AppendLoginSlotOptions = {
     accountIdentity?: (credential: {
         access: string;
     }) => string | undefined;
+    /** `LoginOptions.reauthorizeSlot`: the saved account this login reauthorizes. */
+    reauthorizeSlot?: string;
 };
 /**
  * Material a provider writes into the flat credential when the real token lives

package/dist/auth/pool/slots.js

@@ -1,5 +1,27 @@
 import { LEGACY_PROVIDER_IDS } from "../../legacy-provider-ids.js";
 export const DEFAULT_SLOT_NAME = "default";
+const OAUTH_ACCOUNT_FIELDS = [
+    "route",
+    "issuer",
+    "subject",
+    "clientId",
+    "email",
+    "idToken",
+    "scopes",
+    "planUsageEnabled",
+    "signedOut",
+];
+/** Replace account metadata as a unit; an absent field must not inherit a sibling's identity. */
+function withOAuthAccountFields(target, source) {
+    const next = { ...target };
+    for (const field of OAUTH_ACCOUNT_FIELDS) {
+        if (source[field] === undefined)
+            Reflect.deleteProperty(next, field);
+        else
+            Reflect.set(next, field, source[field]);
+    }
+    return next;
+}
 const SLOT_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
 export function assertValidSlotName(name) {
     if (!SLOT_NAME_PATTERN.test(name)) {
@@ -178,7 +200,7 @@ function projectFlatFields(credential, slot) {
     if (credential.type === "oauth") {
         if (slot.access === undefined || slot.refresh === undefined || slot.expires === undefined)
             return credential;
-        return { ...credential, access: slot.access, refresh: slot.refresh, expires: slot.expires, ...env };
+        return withOAuthAccountFields({ ...credential, access: slot.access, refresh: slot.refresh, expires: slot.expires, ...env }, slot);
     }
     return { ...credential, key: slot.key, ...env };
 }
@@ -228,20 +250,20 @@ export function projectSlot(credential, name) {
     if (flat.type === "oauth") {
         if (slot.access === undefined || slot.refresh === undefined || slot.expires === undefined)
             return undefined;
-        return { ...flat, access: slot.access, refresh: slot.refresh, expires: slot.expires, ...env };
+        return withOAuthAccountFields({ ...flat, access: slot.access, refresh: slot.refresh, expires: slot.expires, ...env }, slot);
     }
     return { ...flat, key: slot.key, ...env };
 }
 function slotFromFlatCredentialNamed(credential, name) {
     if (credential.type === "oauth") {
-        return {
+        return withOAuthAccountFields({
             name,
             source: "login",
             access: credential.access,
             refresh: credential.refresh,
             expires: credential.expires,
             ...credentialSlotEnv(credential),
-        };
+        }, credential);
     }
     return { name, source: "login", key: credential.key, ...credentialSlotEnv(credential) };
 }
@@ -296,6 +318,17 @@ export class EmptyApiKeyError extends Error {
         this.name = "EmptyApiKeyError";
     }
 }
+/**
+ * A reauthorization signed in a different ChatGPT account than the saved one it was started for (#5003). Nothing
+ * is written: the selected account keeps its registration and the other sign-in is not silently swapped in.
+ */
+export class ReauthorizeAccountMismatchError extends Error {
+    constructor(slotName) {
+        super(`Signed in to a different ChatGPT account than '${slotName}'; nothing was changed. Sign in as that account, or add the other one as a new account.`);
+        this.name = "ReauthorizeAccountMismatchError";
+        this.slotName = slotName;
+    }
+}
 /** True when an API-key credential names a `key` that is blank, whitespace or not a string. */
 function hasBlankKey(credential) {
     if (credential.type !== "api_key" || !Object.hasOwn(credential, "key"))
@@ -358,6 +391,11 @@ export function appendLoginSlot(stored, flat, onAllocated, options) {
             onAllocated?.(DEFAULT_SLOT_NAME, "generated");
         return flat;
     }
+    const target = provided || options?.reauthorizeSlot === undefined ? undefined : findSlot(current, options.reauthorizeSlot);
+    if (target) {
+        assertSameReauthorizedAccount(target, flat, options?.accountIdentity);
+        return restoreReauthorizedSlot(current, target, flat, onAllocated);
+    }
     const storedAccounts = Array.isArray(current.accounts) ? current.accounts : undefined;
     if (!provided && "signedOut" in current && current.signedOut === true) {
         // Sign-out keeps only the registration for a later sign-in (senpi#5003 W7). That sign-in takes over
@@ -374,7 +412,31 @@ export function appendLoginSlot(stored, flat, onAllocated, options) {
         // shape because the provider's accounts already carry this login.
         return storedAccounts ? mergeProvidedPool(current, storedAccounts, provided) : flat;
     }
-    const replaced = replaceSameAccount(current, flat, options?.accountIdentity, onAllocated);
+    if (flat.type === "oauth" && flat.route === "siwc") {
+        const existing = listSlots(current);
+        const matched = existing.find((slot) => slot.route === "siwc" &&
+            ["issuer", "subject", "clientId"].every((field) => typeof flat[field] === "string" && flat[field].trim() !== "" && flat[field] === slot[field]));
+        if (matched) {
+            const replacement = {
+                ...slotFromFlatCredentialNamed(flat, matched.name),
+                ...(matched.displayName === undefined ? {} : { displayName: matched.displayName }),
+            };
+            const next = slotMirrorsFlat(current, matched) ? projectFlatFields(current, replacement) : current;
+            onAllocated?.(matched.name, "generated");
+            if (!storedAccounts)
+                return next;
+            const pooled = {
+                ...next,
+                accounts: existing.map((slot) => (slot === matched ? replacement : slot)),
+            };
+            return pooled;
+        }
+    }
+    // Sign in with ChatGPT names an account by its issuer, subject and issued client ID (matched above). Without
+    // that tuple, a shared ChatGPT token identity is not the same SIWC sign-in, so the login is appended.
+    const replaced = flat.type === "oauth" && flat.route === "siwc"
+        ? undefined
+        : replaceSameAccount(current, flat, options?.accountIdentity, onAllocated);
     if (replaced)
         return replaced;
     const name = nextLoginSlotName(current);
@@ -382,6 +444,62 @@ export function appendLoginSlot(stored, flat, onAllocated, options) {
     onAllocated?.(name, "generated");
     return next;
 }
+/**
+ * A reauthorization of a named saved account rewrites that account and nothing else (#5003). A signed-out account
+ * holds blank tokens, so neither the token-identity match nor the sign-in takeover can find it, and both used to
+ * append a duplicate `login-N`. The account keeps its name, label and source and drops `signedOut`; the flat
+ * projection moves to it when it carried that account or when the whole credential was signed out.
+ */
+/**
+ * The identity a reauthorization must keep. SIWC names an account by issuer, subject and issued client ID, which a
+ * sign-out keeps. A legacy Codex account is named by its token identity, or, once signed out and without a token,
+ * by its workspace (`accountId`). A field the saved account never recorded cannot be compared and is not checked.
+ */
+function assertSameReauthorizedAccount(target, flat, accountIdentity) {
+    if (flat.type !== "oauth")
+        return;
+    const saved = target;
+    const fresh = flat;
+    const differs = (field) => typeof saved[field] === "string" &&
+        saved[field] !== "" &&
+        typeof fresh[field] === "string" &&
+        saved[field] !== fresh[field];
+    if ((saved.route ?? "codex") !== (flat.route ?? "codex"))
+        throw new ReauthorizeAccountMismatchError(target.name);
+    if (flat.route === "siwc") {
+        if (["issuer", "subject", "clientId"].some(differs))
+            throw new ReauthorizeAccountMismatchError(target.name);
+        return;
+    }
+    const savedIdentity = accountIdentity && typeof target.access === "string" && target.access !== ""
+        ? accountIdentity({ access: target.access })
+        : undefined;
+    const freshIdentity = accountIdentity?.(flat);
+    if (savedIdentity !== undefined && freshIdentity !== undefined) {
+        if (savedIdentity !== freshIdentity)
+            throw new ReauthorizeAccountMismatchError(target.name);
+        return;
+    }
+    if (differs("accountId"))
+        throw new ReauthorizeAccountMismatchError(target.name);
+}
+function restoreReauthorizedSlot(current, target, flat, onAllocated) {
+    onAllocated?.(target.name, "generated");
+    if (!Array.isArray(current.accounts) || current.accounts.length === 0)
+        return flat;
+    const fresh = {
+        ...slotFromFlatCredentialNamed(flat, target.name),
+        ...(target.displayName === undefined ? {} : { displayName: target.displayName }),
+        ...(target.source === undefined ? {} : { source: target.source }),
+    };
+    const accounts = listSlots(current).map((slot) => (slot.name === target.name ? fresh : slot));
+    const wholeSignedOut = "signedOut" in current && current.signedOut === true;
+    const reproject = wholeSignedOut || slotMirrorsFlat(current, target);
+    const next = { ...(reproject ? projectFlatFields(current, fresh) : current), accounts };
+    if (reproject)
+        Reflect.deleteProperty(next, "signedOut");
+    return next;
+}
 /**
  * A login of an account that is already saved rewrites that account instead of
  * appending another `login-N` copy of it. Appending kept the old copy, and once the
@@ -405,7 +523,13 @@ function replaceSameAccount(current, flat, accountIdentity, onAllocated) {
     if (identity === undefined)
         return undefined;
     const slots = listSlots(current);
-    const matches = slots.filter((slot) => slot.source !== "env" && slot.access !== undefined && accountIdentity({ access: slot.access }) === identity);
+    // A token identity names a ChatGPT account, not a sign-in: the legacy Codex route and Sign in with ChatGPT
+    // hold separate grants for one person, so a login replaces only a slot on its own route (#5003).
+    const route = flat.route ?? "codex";
+    const matches = slots.filter((slot) => slot.source !== "env" &&
+        (slot.route ?? "codex") === route &&
+        slot.access !== undefined &&
+        accountIdentity({ access: slot.access }) === identity);
     const kept = matches[0];
     if (!kept)
         return undefined;
@@ -413,14 +537,12 @@ function replaceSameAccount(current, flat, accountIdentity, onAllocated) {
         onAllocated?.(kept.name, "generated");
         return flat;
     }
+    // Built through the account-field projection so the login's route, issued client, issuer, subject, ID token
+    // and scopes reach the slot; a hand-copied token triple dropped them (#5003).
     const fresh = {
-        name: kept.name,
+        ...slotFromFlatCredentialNamed(flat, kept.name),
         ...(kept.displayName === undefined ? {} : { displayName: kept.displayName }),
         ...(kept.source === undefined ? {} : { source: kept.source }),
-        access: flat.access,
-        refresh: flat.refresh,
-        expires: flat.expires,
-        ...credentialSlotEnv(flat),
     };
     const dropped = new Set(matches.slice(1).map((slot) => slot.name));
     const accounts = slots.flatMap((slot) => (slot === kept ? [fresh] : dropped.has(slot.name) ? [] : [slot]));
@@ -510,7 +632,7 @@ export function mergeRefreshedSlot(current, name, refreshed) {
     const target = current.accounts.find((slot) => slot.name === name);
     if (!target)
         return current;
-    const rotated = { access: refreshed.access, refresh: refreshed.refresh, expires: refreshed.expires };
+    const rotated = withOAuthAccountFields({ access: refreshed.access, refresh: refreshed.refresh, expires: refreshed.expires }, refreshed);
     const accounts = current.accounts.map((slot) => (slot === target ? { ...slot, ...rotated } : slot));
     const mirrorsFlat = target.access === current.access || target.refresh === current.refresh;
     return mirrorsFlat ? { ...current, ...rotated, accounts } : { ...current, accounts };
@@ -522,11 +644,11 @@ export function mergeRefreshed(current, refreshed) {
     if (refreshed.type !== "oauth" || current.type !== "oauth")
         return refreshed;
     const target = current.accounts.find((slot) => slot.access === current.access || slot.refresh === current.refresh);
-    const rotated = {
+    const rotated = withOAuthAccountFields({
         access: refreshed.access,
         refresh: refreshed.refresh,
         expires: refreshed.expires,
-    };
+    }, refreshed);
     const accounts = target
         ? current.accounts.map((slot) => (slot === target ? { ...slot, ...rotated } : slot))
         : current.accounts;

package/dist/auth/types.d.ts

@@ -1,12 +1,16 @@
-import type { ProviderEnv, ProviderHeaders } from "../types.ts";
+import type { Api, Model, ProviderEnv, ProviderHeaders } from "../types.ts";
 /**
  * Request auth for a single model request. If a value cannot be expressed as
- * `apiKey`, `headers`, or `baseUrl`, it is provider config, not auth.
+ * `apiKey`, `headers`, `baseUrl`, or the credential's chat route, it is provider config, not auth.
  */
 export interface ModelAuth {
     apiKey?: string;
     headers?: ProviderHeaders;
     baseUrl?: string;
+    /** Credential-selected chat transport; absent preserves the selected model's API. */
+    api?: Api;
+    /** Request restrictions belonging to the selected credential's chat route. */
+    compat?: Model<Api>["compat"];
 }
 /**
  * Stored api-key credential. `env` holds provider-scoped environment/config
@@ -24,6 +28,8 @@ export interface OAuthCredentials {
     refresh: string;
     access: string;
     expires: number;
+    /** ChatGPT slots without a route retain the legacy Codex protocol. */
+    route?: "siwc" | "codex";
     [key: string]: unknown;
 }
 /** Stored canonical OAuth credential. */
@@ -268,6 +274,11 @@ export interface LoginOptions {
      * an account; callers must not infer this from the provider's active credential.
      */
     reauthorize?: OAuthCredential;
+    /**
+     * The saved account name of `reauthorize`. The login then restores that account in place, signed-out ones
+     * included, instead of matching by token or appending another `login-N` copy of it.
+     */
+    reauthorizeSlot?: string;
     /**
      * Returns the stable ID of this app installation, e.g. sent to OpenAI as its
      * agent host ID. Called only by login flows that need it, so apps can create

package/dist/index.d.ts

@@ -58,7 +58,7 @@ export * from "./utils/event-stream.ts";
 export * from "./utils/json-parse.ts";
 export * from "./utils/overflow.ts";
 export * from "./utils/provider-error.ts";
-export { isAnthropicApiBaseUrl, PROMPT_CACHE_TTL_LONG_SECONDS, PROMPT_CACHE_TTL_OPENAI_EXTENDED_SECONDS, PROMPT_CACHE_TTL_SHORT_SECONDS, type PromptCacheLifetime, resolvePromptCacheLifetime, resolvePromptCacheTtlSeconds, } from "./utils/prompt-cache-ttl.ts";
+export { isAnthropicApiBaseUrl, PROMPT_CACHE_TTL_LONG_SECONDS, PROMPT_CACHE_TTL_OPENAI_EXTENDED_SECONDS, PROMPT_CACHE_TTL_SHORT_SECONDS, type PromptCacheLifetime, resolvePromptCacheLifetime, resolvePromptCacheTtlSeconds, supportsAnthropicCacheWarming, } from "./utils/prompt-cache-ttl.ts";
 export * from "./utils/provider-failure-description.ts";
 export * from "./utils/retry.ts";
 export * from "./utils/server-fallback-receipt.ts";

package/dist/index.js

@@ -44,7 +44,7 @@ export * from "./utils/event-stream.js";
 export * from "./utils/json-parse.js";
 export * from "./utils/overflow.js";
 export * from "./utils/provider-error.js";
-export { isAnthropicApiBaseUrl, PROMPT_CACHE_TTL_LONG_SECONDS, PROMPT_CACHE_TTL_OPENAI_EXTENDED_SECONDS, PROMPT_CACHE_TTL_SHORT_SECONDS, resolvePromptCacheLifetime, resolvePromptCacheTtlSeconds, } from "./utils/prompt-cache-ttl.js";
+export { isAnthropicApiBaseUrl, PROMPT_CACHE_TTL_LONG_SECONDS, PROMPT_CACHE_TTL_OPENAI_EXTENDED_SECONDS, PROMPT_CACHE_TTL_SHORT_SECONDS, resolvePromptCacheLifetime, resolvePromptCacheTtlSeconds, supportsAnthropicCacheWarming, } from "./utils/prompt-cache-ttl.js";
 export * from "./utils/provider-failure-description.js";
 export * from "./utils/retry.js";
 export * from "./utils/server-fallback-receipt.js";

package/dist/models.js

@@ -2,7 +2,7 @@ import { lazyStream } from "./api/lazy.js";
 import { defaultProviderAuthContext as defaultAuthContext } from "./auth/context.js";
 import { InMemoryCredentialStore, revokeStoredOAuth } from "./auth/credential-store.js";
 import { stampLogin } from "./auth/pool/login-id.js";
-import { appendLoginSlot, assertLoginKeyPresent, removeSlot, withoutBlankKey } from "./auth/pool/slots.js";
+import { appendLoginSlot, assertLoginKeyPresent, ReauthorizeAccountMismatchError, removeSlot, withoutBlankKey, } from "./auth/pool/slots.js";
 import { resolveRefreshCredential } from "./auth/refresh-credential.js";
 import { ModelsError, providerNotConfiguredMessage, resolveProviderAuth, } from "./auth/resolve.js";
 import { inferGoogleThinkingLevelMap } from "./google-thinking-generation.js";
@@ -385,7 +385,7 @@ class ModelsImpl {
             return stampLogin(appendLoginSlot(current, credential, (name, origin) => {
                 committedName = name;
                 committedOrigin = origin;
-            }, { accountIdentity: provider.auth.oauth?.accountIdentity }));
+            }, { accountIdentity: provider.auth.oauth?.accountIdentity, reauthorizeSlot: options?.reauthorizeSlot }));
         }, { signal });
         void mutation.catch(() => { });
         try {
@@ -409,6 +409,9 @@ class ModelsImpl {
         }
         catch (error) {
             signal.throwIfAborted();
+            // The user must see why a reauthorization changed nothing, not a storage failure.
+            if (error instanceof ReauthorizeAccountMismatchError)
+                throw error;
             throw new ModelsError("auth", `Credential store modify failed for ${providerId}`, { cause: error });
         }
         if (committedName !== undefined && committedOrigin !== undefined) {
@@ -496,7 +499,14 @@ class ModelsImpl {
         if (options?.transformHeaders)
             headers = await options.transformHeaders(headers ?? {});
         const env = resolution.env || options?.env ? { ...(resolution.env ?? {}), ...(options?.env ?? {}) } : undefined;
-        const requestModel = auth.baseUrl ? { ...model, baseUrl: auth.baseUrl } : model;
+        const requestModel = auth.baseUrl || ((auth.api || auth.compat) && isModelType(model, "chat"))
+            ? {
+                ...model,
+                ...(auth.baseUrl ? { baseUrl: auth.baseUrl } : {}),
+                ...(auth.api && isModelType(model, "chat") ? { api: auth.api } : {}),
+                ...(auth.compat && isModelType(model, "chat") ? { compat: { ...model.compat, ...auth.compat } } : {}),
+            }
+            : model;
         const { transformHeaders: _transformHeaders, ...providerOptions } = options ?? {};
         const requestOptions = { ...providerOptions, apiKey, headers, env };
         return { requestModel, requestOptions };

package/dist/providers/chatgpt-subscription.d.ts

@@ -1,3 +1,3 @@
 import { type Provider } from "../models.ts";
-export declare function chatgptSubscriptionProvider(): Provider<"openai-codex-responses">;
+export declare function chatgptSubscriptionProvider(): Provider<"openai-codex-responses" | "openai-responses">;
 //# sourceMappingURL=chatgpt-subscription.d.ts.map