@code-yeongyu/senpi 2026.7.14 → 2026.7.16-3

package/node_modules/@code-yeongyu/senpi-codemode/src/tool/render.ts

@@ -330,40 +330,40 @@ function statusIcon(op: string): string {
 function formatStatusEvent(event: EvalStatusEvent, theme: Theme | undefined): string {
 	const op = event.op;
 	const icon = style(theme, "muted", statusIcon(op));
-	const error = eventString(event["error"]);
+	const error = eventString(event.error);
 	if (error !== undefined) return `${icon} ${style(theme, "warning", op)}: ${style(theme, "dim", error)}`;
 	const parts: string[] = [];
 	switch (op) {
 		case "read": {
-			parts.push(`${eventNumber(event["chars"] ?? event["bytes"])} chars`);
-			const path = eventString(event["path"]);
+			parts.push(`${eventNumber(event.chars ?? event.bytes)} chars`);
+			const path = eventString(event.path);
 			if (path !== undefined) parts.push(`from ${path}`);
 			break;
 		}
 		case "write": {
-			parts.push(`${eventNumber(event["chars"] ?? event["bytes"])} chars`);
-			const path = eventString(event["path"]);
+			parts.push(`${eventNumber(event.chars ?? event.bytes)} chars`);
+			const path = eventString(event.path);
 			if (path !== undefined) parts.push(`to ${path}`);
 			break;
 		}
 		case "cat":
-			parts.push(plural(eventNumber(event["files"]), "file", "files"));
-			parts.push(`${eventNumber(event["chars"])} chars`);
+			parts.push(plural(eventNumber(event.files), "file", "files"));
+			parts.push(`${eventNumber(event.chars)} chars`);
 			break;
 		case "ls":
-			parts.push(plural(eventNumber(event["count"]), "entry", "entries"));
+			parts.push(plural(eventNumber(event.count), "entry", "entries"));
 			break;
 		case "env": {
-			const action = eventString(event["action"]);
-			const key = eventString(event["key"]);
-			const value = eventString(event["value"]) ?? "";
+			const action = eventString(event.action);
+			const key = eventString(event.key);
+			const value = eventString(event.value) ?? "";
 			if (action === "set" && key !== undefined) parts.push(`set ${key}=${value.slice(0, 30)}`);
 			else if (action === "get" && key !== undefined) parts.push(`${key}=${value.slice(0, 30)}`);
-			else parts.push(plural(eventNumber(event["count"]), "variable", "variables"));
+			else parts.push(plural(eventNumber(event.count), "variable", "variables"));
 			break;
 		}
 		case "git_status": {
-			if (event["clean"] === true) parts.push("clean");
+			if (event.clean === true) parts.push("clean");
 			else {
 				const changes: string[] = [];
 				for (const key of ["staged", "modified", "untracked"] as const) {
@@ -372,41 +372,41 @@ function formatStatusEvent(event: EvalStatusEvent, theme: Theme | undefined): st
 				}
 				parts.push(changes.join(", ") || "unknown");
 			}
-			const branch = eventString(event["branch"]);
+			const branch = eventString(event.branch);
 			if (branch !== undefined) parts.push(`on ${branch}`);
 			break;
 		}
 		case "git_diff":
-			parts.push(plural(eventNumber(event["lines"]), "line", "lines"));
-			if (event["staged"] === true) parts.push("staged");
+			parts.push(plural(eventNumber(event.lines), "line", "lines"));
+			if (event.staged === true) parts.push("staged");
 			break;
 		case "git_log":
-			parts.push(plural(eventNumber(event["commits"]), "commit", "commits"));
+			parts.push(plural(eventNumber(event.commits), "commit", "commits"));
 			break;
 		case "run":
 		case "sh": {
-			const command = eventString(event["command"] ?? event["cmd"]);
+			const command = eventString(event.command ?? event.cmd);
 			if (command !== undefined) parts.push(command);
-			if (typeof event["exitCode"] === "number") parts.push(`exit ${event["exitCode"]}`);
+			if (typeof event.exitCode === "number") parts.push(`exit ${event.exitCode}`);
 			break;
 		}
 		case "completion": {
-			const model = eventString(event["model"]);
-			const tier = eventString(event["tier"]);
+			const model = eventString(event.model);
+			const tier = eventString(event.tier);
 			if (model !== undefined) parts.push(model);
 			if (tier !== undefined && tier !== model) parts.push(tier);
-			parts.push(`${eventNumber(event["chars"])} chars`);
+			parts.push(`${eventNumber(event.chars)} chars`);
 			break;
 		}
 		case "log":
-			parts.push(eventString(event["message"]) ?? "");
+			parts.push(eventString(event.message) ?? "");
 			break;
 		case "phase":
-			parts.push(eventString(event["title"]) ?? "");
+			parts.push(eventString(event.title) ?? "");
 			break;
 		default: {
-			if (event["count"] !== undefined) parts.push(String(event["count"]));
-			const path = eventString(event["path"]);
+			if (event.count !== undefined) parts.push(String(event.count));
+			const path = eventString(event.path);
 			if (path !== undefined) parts.push(path);
 		}
 	}
@@ -443,7 +443,7 @@ function coalesceAgentEvents(events: readonly EvalStatusEvent[]): EvalStatusEven
 	const rows: EvalStatusEvent[] = [];
 	const indexes = new Map<string, number>();
 	for (const event of events) {
-		const id = eventString(event["id"]);
+		const id = eventString(event.id);
 		if (id === undefined) {
 			rows.push(event);
 			continue;
@@ -480,13 +480,13 @@ function renderAgentProgressEvents(events: readonly EvalStatusEvent[], environme
 	// Senpi Theme has no tree-token API; fixed ├/└/│ glyphs intentionally mirror omp.
 	for (const [index, event] of rows.entries()) {
 		const isLast = index === rows.length - 1;
-		const status = agentStatus(event["status"]);
+		const status = agentStatus(event.status);
 		const presentation = agentPresentation(status, environment.spinnerFrame);
-		const id = eventString(event["id"]) ?? "agent";
+		const id = eventString(event.id) ?? "agent";
 		const styledId = environment.theme === undefined ? id : environment.theme.bold(id);
 		let body = `${style(environment.theme, presentation.color, presentation.icon)} ${styledId} ${presentation.label}`;
 		if (status === "completed" || status === "failed" || status === "aborted") {
-			const duration = eventNumber(event["durationMs"]);
+			const duration = eventNumber(event.durationMs);
 			if (duration > 0) body += ` · ${style(environment.theme, "dim", formatDuration(duration))}`;
 		}
 		const branch = isLast ? "└ " : "├ ";
@@ -496,8 +496,8 @@ function renderAgentProgressEvents(events: readonly EvalStatusEvent[], environme
 			renderPrefixed(body, environment, { prefix: branch, continuation: continuation, color: "dim" }),
 		);
 		if (status !== "running") continue;
-		const currentTool = eventString(event["currentTool"]);
-		const lastIntent = eventString(event["lastIntent"]);
+		const currentTool = eventString(event.currentTool);
+		const lastIntent = eventString(event.lastIntent);
 		if (currentTool === undefined && lastIntent === undefined) continue;
 		const detail =
 			currentTool === undefined

package/node_modules/@earendil-works/pi-agent-core/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@earendil-works/pi-agent-core",
 	"private": true,
-	"version": "2026.7.14",
+	"version": "2026.7.16-3",
 	"description": "General-purpose agent with transport abstraction, state management, and attachment support",
 	"type": "module",
 	"main": "./dist/index.js",
@@ -30,7 +30,7 @@
 		"prepublishOnly": "npm run clean && npm run build"
 	},
 	"dependencies": {
-		"@earendil-works/pi-ai": "^2026.7.14",
+		"@earendil-works/pi-ai": "^2026.7.16-3",
 		"ignore": "7.0.5",
 		"typebox": "1.1.38",
 		"yaml": "2.9.0"
@@ -54,8 +54,8 @@
 	},
 	"devDependencies": {
 		"@types/node": "25.9.1",
-		"@vitest/coverage-v8": "4.1.8",
+		"@vitest/coverage-v8": "4.1.9",
 		"typescript": "6.0.3",
-		"vitest": "4.1.8"
+		"vitest": "4.1.9"
 	}
 }

package/node_modules/@earendil-works/pi-ai/README.md

@@ -17,6 +17,7 @@ Unified LLM API with provider collections, automatic auth resolution, token and
   - [Dynamic Providers](#dynamic-providers)
 - [Auth](#auth)
   - [How Auth Resolves](#how-auth-resolves)
+  - [Transforming Request Headers](#transforming-request-headers)
   - [Credential Store](#credential-store)
   - [Environment Variables](#environment-variables)
 - [Tools](#tools)
@@ -334,18 +335,45 @@ await models.complete(model, context);
 await models.complete(model, context, { apiKey: 'sk-explicit' });
 ```
 
-You can inspect resolution without making a request — useful for status UIs:
+You can inspect resolution without making a request. Pass a provider ID for provider-scoped auth, or a model to include its static `model.headers`:
 
 ```typescript
-const auth = await models.getAuth(model);
-if (auth) {
-  console.log(`configured via ${auth.source}`); // e.g. "ANTHROPIC_API_KEY", "OAuth", "stored credential"
+const providerAuth = await models.getAuth(model.provider);
+const modelAuth = await models.getAuth(model);
+
+if (modelAuth) {
+  console.log(`configured via ${modelAuth.source}`); // e.g. "ANTHROPIC_API_KEY", "OAuth", "stored credential"
+  console.log(modelAuth.auth.headers);              // Provider auth headers + model.headers
 } else {
   console.log('not configured');
 }
 ```
 
-`getAuth()` resolves `undefined` for unconfigured providers and rejects with `ModelsError` when something is actually broken (`"oauth"`: token refresh failed, credential preserved for re-login; `"auth"`: key resolution or credential store failure). Request paths surface the same failures as stream errors.
+Both overloads resolve credentials, refresh expired OAuth when necessary, and may return an auth-derived `apiKey`, `headers`, or `baseUrl`. `getAuth()` resolves `undefined` for unconfigured providers and rejects with `ModelsError` when something is actually broken (`"oauth"`: token refresh failed, credential preserved for re-login; `"auth"`: key resolution or credential store failure). Request paths surface the same failures as stream errors.
+
+### Transforming Request Headers
+
+`Models.stream()`, `complete()`, `streamSimple()`, and `completeSimple()` accept a Models-only `transformHeaders` option. It runs once after provider auth, `model.headers`, and explicit `options.headers` have been merged, but before provider dispatch:
+
+```typescript
+const response = await models.completeSimple(model, context, {
+  headers: { "X-Client": "my-app" },
+  transformHeaders: async (headers) => ({
+    ...headers,
+    "X-Request-ID": crypto.randomUUID(),
+  }),
+});
+```
+
+The ordering is:
+
+```text
+provider auth headers -> model.headers -> explicit options.headers -> transformHeaders -> Provider.stream*()
+```
+
+Header names are merged case-insensitively. Explicit headers override auth/model headers, and the transform has final control; returning `null` for a header suppresses lower-level defaults that support deletion.
+
+`transformHeaders` belongs to `Models`, not `Provider`. A `Models` implementation must consume it and remove it before calling `Provider.stream*()`. Provider implementations continue receiving ordinary `ApiStreamOptions` or `SimpleStreamOptions` and never handle the transform themselves. Use this option instead of calling `getAuth(model)` before `stream*()`, which would resolve request auth twice.
 
 ### Credential Store
 
@@ -359,7 +387,7 @@ const models = createModels({ credentials: myFileBackedStore });
 // const models = builtinModels({ credentials: myFileBackedStore });
 ```
 
-The contract is small: `read(providerId)`, `modify(providerId, fn)` (the only write path — a serialized read-modify-write), and `delete(providerId)`. OAuth token refresh runs inside `modify`, so concurrent requests and processes cannot double-refresh a rotated token. A stored credential *owns* its provider: environment variables are only consulted when nothing is stored, and a failed refresh never silently falls back to an env key.
+The contract is small: `read(providerId)`, `list()` for non-secret `{ providerId, type }` metadata, `modify(providerId, fn)` (the only write path — a serialized read-modify-write), and `delete(providerId)`. Enumeration must not resolve secrets or execute configured key commands. OAuth token refresh runs inside `modify`, so concurrent requests and processes cannot double-refresh a rotated token. A stored credential *owns* its provider: environment variables are only consulted when nothing is stored, and a failed refresh never silently falls back to an env key.
 
 API-key credentials use the same discriminator as pi's `auth.json` and can carry provider-scoped env/config values:
 
@@ -412,7 +440,7 @@ Built-in providers resolve these env vars (Node.js; in browsers pass `apiKey` ex
 | Xiaomi MiMo Token Plan (Singapore) | `XIAOMI_TOKEN_PLAN_SGP_API_KEY` |
 | GitHub Copilot | `COPILOT_GITHUB_TOKEN` |
 
-Amazon Bedrock resolves ambient AWS credentials (`AWS_PROFILE`, access key pairs, `AWS_BEARER_TOKEN_BEDROCK`, ECS task roles, web identity tokens). Vertex AI resolves either an explicit key or gcloud Application Default Credentials plus project/location.
+Amazon Bedrock resolves ambient AWS credentials (`AWS_PROFILE`, access key pairs, `AWS_BEARER_TOKEN_BEDROCK`, ECS task roles, web identity tokens); its provider-owned login flow supports bearer tokens, AWS profiles, and the existing credential chain. Vertex AI resolves either an explicit key or gcloud Application Default Credentials plus project/location, with a provider-owned login flow for API keys, ADC, and service-account files.
 
 ## Tools
 
@@ -660,7 +688,7 @@ for (const block of result.output) {
 }
 ```
 
-Like the chat side, you can build the collection from parts: `createImagesModels({ credentials?, authContext? })`, the `openrouterImagesProvider()` factory from `@earendil-works/pi-ai/providers/openrouter-images`, and `createImagesProvider({ id, auth, models, refreshModels?, api })` for custom image providers (with `imagesModels.refresh(provider?)` for dynamic lists). Failures never reject — they return an `AssistantImages` with `stopReason: "error"`. The collection's `getAuth(model)` works exactly like the chat-side one.
+Like the chat side, you can build the collection from parts: `createImagesModels({ credentials?, authContext? })`, the `openrouterImagesProvider()` factory from `@earendil-works/pi-ai/providers/openrouter-images`, and `createImagesProvider({ id, auth, models, refreshModels?, api })` for custom image providers (with `imagesModels.refresh(provider?)` for dynamic lists). Failures never reject — they return an `AssistantImages` with `stopReason: "error"`. The collection's provider-scoped `getAuth(providerId)` works exactly like the chat-side one.
 
 The old global API (`getImageModel()` / `getImageModels()` / `getImageProviders()` / `generateImages()`) remains available on the [compat entrypoint](#migrating-from-the-old-global-api):
 
@@ -719,7 +747,7 @@ Many models support thinking/reasoning capabilities where they can show their in
 const model = models.getModel('anthropic', 'claude-sonnet-4-5')!;
 // or models.getModel('openai', 'gpt-5-mini');
 // or models.getModel('google', 'gemini-2.5-flash');
-// or models.getModel('xai', 'grok-code-fast-1');
+// or models.getModel('xai', 'grok-4.5');
 
 // Check if model supports reasoning
 if (model.reasoning) {
@@ -982,22 +1010,46 @@ const gateway = createProvider({
 });
 ```
 
-Dynamic model lists use `refreshModels`; the provider lists empty until the first `models.refresh()`:
+Provider-wide endpoint or request transformations belong in the provider's API implementation: wrap the `ProviderStreams` you pass as `api` so every request goes through the transformation before dispatch. The Cloudflare providers do this to materialize account/gateway endpoint placeholders from the resolved provider env:
 
 ```typescript
+function tenantStreams(streams: ProviderStreams): ProviderStreams {
+  const withTenant = (model: Model<Api>) => ({ ...model, baseUrl: model.baseUrl.replace('{tenant}', tenantId) });
+  return {
+    stream: (model, context, options) => streams.stream(withTenant(model), context, options),
+    streamSimple: (model, context, options) => streams.streamSimple(withTenant(model), context, options),
+  };
+}
+
+const tenantGateway = createProvider({
+  id: 'tenant-gateway',
+  auth: { apiKey: envApiKeyAuth('Gateway key', ['GATEWAY_API_KEY']) },
+  models: [/* ... */],
+  api: tenantStreams(openAICompletionsApi()),
+});
+```
+
+Dynamic model lists use `fetchModels`. `Models.refresh()` refreshes every configured dynamic provider, passing its effective API-key or refreshed OAuth credential. A `ModelsStore` persists dynamic catalogs; both stores default to in-memory implementations.
+
+```typescript
+const models = createModels({ credentials, modelsStore });
 const llamacpp = createProvider({
   id: 'llamacpp',
   auth: { apiKey: { name: 'llama.cpp', resolve: async () => ({ auth: {} }) } },
   models: [],
-  refreshModels: async () => fetchModelsFromServer('http://localhost:8080'),
+  fetchModels: async ({ signal }) => fetchModelsFromServer('http://localhost:8080', signal),
   api: openAICompletionsApi(),
 });
 
 models.setProvider(llamacpp);
-await models.refresh('llamacpp');
+const result = await models.refresh({ signal });
+if (result.aborted) console.log('refresh cancelled');
+for (const [provider, error] of result.errors) console.error(provider, error);
 ```
 
-Custom models can carry `headers` (e.g. proxies behind bot detection) and `compat` flags — see [OpenAI Compatibility Settings](#openai-compatibility-settings).
+Use `models.refresh({ allowNetwork: false })` to restore persisted catalogs without network access, or `models.refresh({ force: true })` to bypass provider freshness checks. Model reads stay synchronous and return the last restored or refreshed list.
+
+Custom models can carry `headers` (e.g. proxies behind bot detection) and `compat` flags. `Models.getAuth(model)` includes those model headers, and stream methods merge them before explicit request headers and `transformHeaders`. See [OpenAI Compatibility Settings](#openai-compatibility-settings).
 
 Some OpenAI-compatible servers do not understand the `developer` role used for reasoning-capable models. For those providers, set `compat.supportsDeveloperRole` to `false` so the system prompt is sent as a `system` message instead. If the server also does not support `reasoning_effort`, set `compat.supportsReasoningEffort` to `false` too. This commonly applies to Ollama, vLLM, SGLang, and similar OpenAI-compatible servers.
 
@@ -1070,7 +1122,8 @@ interface OpenAICompletionsCompat {
   supportsReasoningEffort?: boolean; // Whether provider supports `reasoning_effort` (default: true)
   supportsUsageInStreaming?: boolean; // Whether provider supports `stream_options: { include_usage: true }` (default: true)
   supportsStrictMode?: boolean;      // Whether provider supports `strict` in tool definitions (default: true)
-  sendSessionAffinityHeaders?: boolean; // Whether to send `session_id`, `x-client-request-id`, and `x-session-affinity` from `sessionId` when caching is enabled (default: false)
+  sendSessionAffinityHeaders?: boolean; // Send session-affinity data from `sessionId` (default: false)
+  sessionAffinityFormat?: 'openai' | 'openai-nosession' | 'openrouter'; // Format for session affinity: 'openai' uses `prompt_cache_key`, `session_id`, `x-client-request-id`, and `x-session-affinity`; 'openai-nosession' uses `prompt_cache_key`, `x-client-request-id`, and `x-session-affinity`; 'openrouter' uses `x-session-id` (default: auto-detected)
   maxTokensField?: 'max_completion_tokens' | 'max_tokens';  // Which field name to use (default: max_completion_tokens)
   requiresToolResultName?: boolean;  // Whether tool results require the `name` field (default: false)
   requiresAssistantAfterToolResult?: boolean; // Whether tool results must be followed by an assistant message (default: false)
@@ -1085,7 +1138,7 @@ interface OpenAICompletionsCompat {
 
 interface OpenAIResponsesCompat {
   supportsDeveloperRole?: boolean;   // Whether provider supports `developer` role vs `system` (default: true)
-  sendSessionIdHeader?: boolean;     // Whether to send `session_id` from `sessionId` when caching is enabled (default: true)
+  sessionAffinityFormat?: 'openai' | 'openai-nosession' | 'openrouter'; // Session-affinity header format: 'openai' sends `session_id` and `x-client-request-id`; 'openai-nosession' sends `x-client-request-id`; 'openrouter' sends `x-session-id`. Does not affect the `prompt_cache_key` body param (default: auto-detected)
   supportsLongCacheRetention?: boolean; // Whether provider supports `prompt_cache_retention: "24h"` (default: true)
 }
 ```
@@ -1368,7 +1421,7 @@ Several providers support OAuth authentication instead of static API keys:
 - **OpenAI Codex** (ChatGPT Plus/Pro subscription, access to GPT-5.x Codex models)
 - **GitHub Copilot** (Copilot subscription)
 
-Each of these providers carries an `OAuthAuth` on `provider.auth.oauth` with three operations: `login(callbacks)` runs the interactive flow and returns a credential, `refresh(credential)` exchanges the refresh token, and `toAuth(credential)` derives request auth (GitHub Copilot's per-account base URL comes from here). Refresh is automatic: `models.getAuth()` and the request paths refresh expired tokens under a credential-store lock, so concurrent requests and processes cannot double-refresh.
+Each of these providers carries an `OAuthAuth` on `provider.auth.oauth` with three operations: `login(interaction)` uses the provider-neutral `AuthInteraction.prompt()`/`notify()` protocol and returns a credential, `refresh(credential)` exchanges the refresh token, and `toAuth(credential)` derives request auth (GitHub Copilot's per-account base URL comes from here). Refresh is automatic: `models.getAuth(providerId)` and request paths refresh expired tokens under a credential-store lock, so concurrent requests and processes cannot double-refresh.
 
 ```typescript
 import { createModels } from '@earendil-works/pi-ai';
@@ -1377,34 +1430,36 @@ import { anthropicProvider } from '@earendil-works/pi-ai/providers/anthropic';
 const models = createModels({ credentials: myStore }); // persistent CredentialStore
 models.setProvider(anthropicProvider());
 
-// Login: drive the flow with prompt()/notify() callbacks, persist the credential
-const provider = models.getProvider('anthropic')!;
-const credential = await provider.auth.oauth!.login({
+// Login: Models drives the flow and persists the credential
+await models.login('anthropic', 'oauth', {
   prompt: async (p) => {
     // p.type: 'text' | 'secret' | 'select' | 'manual_code'
     // manual_code prompts race a local callback server; p.signal aborts them when the server wins
     return await askUser(p.message);
   },
   notify: (event) => {
-    // event.type: 'auth_url' | 'device_code' | 'progress'
+    // event.type: 'info' | 'auth_url' | 'device_code' | 'progress'
+    if (event.type === 'info') {
+      console.log(event.message);
+      for (const link of event.links ?? []) console.log(`${link.label ?? 'More information'}: ${link.url}`);
+    }
     if (event.type === 'auth_url') console.log(`Open: ${event.url}`);
     if (event.type === 'device_code') console.log(`Code: ${event.userCode} at ${event.verificationUri}`);
     if (event.type === 'progress') console.log(event.message);
   },
 });
-await myStore.modify('anthropic', async () => credential);
 
 // From here on, requests resolve and refresh the token automatically
 const model = models.getModel('anthropic', 'claude-sonnet-4-5')!;
 await models.complete(model, context);
 
 // Logout
-await myStore.delete('anthropic');
+await models.logout('anthropic');
 ```
 
 ### Vertex AI
 
-Vertex AI models support either a Google Cloud API key or Application Default Credentials (ADC):
+Vertex AI models support either a Google Cloud API key or Application Default Credentials (ADC). Its provider-owned API-key login flow can configure either method:
 
 - **API key**: Set `GOOGLE_CLOUD_API_KEY` or pass `apiKey` in the call options.
 - **Local development (ADC)**: Run `gcloud auth application-default login`
@@ -1438,7 +1493,7 @@ Credentials are saved to `auth.json` in the current directory.
 
 ### Programmatic OAuth
 
-The legacy flow functions remain available via the `@earendil-works/pi-ai/oauth` entry point (`loginAnthropic`, `loginOpenAICodex`, `loginGitHubCopilot`, `refreshOAuthToken`, `getOAuthApiKey`); credential storage is the caller's responsibility there. New code should prefer the provider-owned `OAuthAuth` shown above — it composes with the credential store and gets locked auto-refresh for free.
+Built-in login and refresh flows are private provider implementations. Use provider-owned `OAuthAuth`, which composes with `CredentialStore` and gets locked auto-refresh through `Models`. The `@earendil-works/pi-ai/oauth` entry point retains only type declarations required by coding-agent extension OAuth compatibility.
 
 Provider notes:
 
@@ -1468,7 +1523,7 @@ Compat is a strict superset of the root entrypoint, so a file can switch its imp
 | `getModels('anthropic')` / `getProviders()` | `models.getModels('anthropic')` / `models.getProviders()` or `getBuiltin*` |
 | `stream(model, ctx, opts)` (env-key injection) | `models.stream(model, ctx, opts)` (provider auth resolution) |
 | `registerApiProvider({ api, stream, streamSimple })` | `createProvider({ id, auth, models, api })` + `models.setProvider()` |
-| `getEnvApiKey('openai')` | `await models.getAuth(model)` |
+| `getEnvApiKey('openai')` | `await models.getAuth(model.provider)` |
 | `streamAnthropic(model, ctx, opts)` | `stream` from `@earendil-works/pi-ai/api/anthropic-messages`, or a provider in a collection |
 | `registerFauxProvider()` | `fauxProvider()` + `models.setProvider()` |
 

package/node_modules/@earendil-works/pi-ai/dist/api/anthropic-messages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anthropic-messages.d.ts","sourceRoot":"","sources":["../../src/api/anthropic-messages.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAU1C,OAAO,KAAK,EAWX,mBAAmB,EAEnB,cAAc,EACd,aAAa,EAMb,MAAM,aAAa,CAAC;AAgKrB,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAE1E,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,SAAS,CAAC;AAuDhE,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACtD;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,CAAC;CACnB;AAkiBD,eAAO,MAAM,MAAM,EAAE,cAAc,CAAC,oBAAoB,EAAE,gBAAgB,CAoTzE,CAAC;AAoEF,eAAO,MAAM,YAAY,EAAE,cAAc,CAAC,oBAAoB,EAAE,mBAAmB,CA2ClF,CAAC"}
+{"version":3,"file":"anthropic-messages.d.ts","sourceRoot":"","sources":["../../src/api/anthropic-messages.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAU1C,OAAO,KAAK,EAWX,mBAAmB,EAEnB,cAAc,EACd,aAAa,EAMb,MAAM,aAAa,CAAC;AAgKrB,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAE1E,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,SAAS,CAAC;AAuDhE,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACtD;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,CAAC;CACnB;AAghBD,eAAO,MAAM,MAAM,EAAE,cAAc,CAAC,oBAAoB,EAAE,gBAAgB,CAsTzE,CAAC;AAoEF,eAAO,MAAM,YAAY,EAAE,cAAc,CAAC,oBAAoB,EAAE,mBAAmB,CA2ClF,CAAC"}

package/node_modules/@earendil-works/pi-ai/dist/api/anthropic-messages.js

@@ -200,24 +200,6 @@ const REPLAYABLE_ANTHROPIC_PROVIDER_NATIVE_TYPES = new Set([
 function isReplayableAnthropicProviderNativeBlock(raw) {
     return isRecord(raw) && typeof raw.type === "string" && REPLAYABLE_ANTHROPIC_PROVIDER_NATIVE_TYPES.has(raw.type);
 }
-function stripEncryptedContentFromWebSearchResult(raw) {
-    const { encrypted_content: _encryptedContent, ...rest } = raw;
-    return rest;
-}
-function sanitizeReplayableAnthropicProviderNativeBlock(raw) {
-    if (!isReplayableAnthropicProviderNativeBlock(raw))
-        return undefined;
-    if (!isRecord(raw) || raw.type !== "web_search_tool_result" || !Array.isArray(raw.content))
-        return raw;
-    return {
-        ...raw,
-        content: raw.content.map((item) => {
-            if (!isRecord(item) || item.type !== "web_search_result")
-                return item;
-            return stripEncryptedContentFromWebSearchResult(item);
-        }),
-    };
-}
 function isSameAnthropicModel(message, model) {
     return message.provider === model.provider && message.api === model.api && message.model === model.id;
 }
@@ -837,25 +819,27 @@ export const stream = (model, context, options) => {
                     }
                     // Only update usage fields if present (not null).
                     // Preserves input_tokens from message_start when proxies omit it in message_delta.
-                    if (event.usage.input_tokens != null) {
-                        output.usage.input = event.usage.input_tokens;
-                    }
-                    if (event.usage.output_tokens != null) {
-                        output.usage.output = event.usage.output_tokens;
-                    }
-                    if (event.usage.cache_read_input_tokens != null) {
-                        output.usage.cacheRead = event.usage.cache_read_input_tokens;
-                    }
-                    if (event.usage.cache_creation_input_tokens != null) {
-                        output.usage.cacheWrite = event.usage.cache_creation_input_tokens;
-                    }
-                    // Anthropic reports reasoning tokens in `output_tokens_details.thinking_tokens` on the
-                    // final message_delta usage (a subset of output_tokens). SDK 0.91.1 omits the field from
-                    // its Usage type, so read it through a narrow cast. Verified against the live API.
-                    const thinkingTokens = event.usage
-                        .output_tokens_details?.thinking_tokens;
-                    if (thinkingTokens != null) {
-                        output.usage.reasoning = thinkingTokens;
+                    if (event.usage) {
+                        if (event.usage.input_tokens != null) {
+                            output.usage.input = event.usage.input_tokens;
+                        }
+                        if (event.usage.output_tokens != null) {
+                            output.usage.output = event.usage.output_tokens;
+                        }
+                        if (event.usage.cache_read_input_tokens != null) {
+                            output.usage.cacheRead = event.usage.cache_read_input_tokens;
+                        }
+                        if (event.usage.cache_creation_input_tokens != null) {
+                            output.usage.cacheWrite = event.usage.cache_creation_input_tokens;
+                        }
+                        // Anthropic reports reasoning tokens in `output_tokens_details.thinking_tokens` on the
+                        // final message_delta usage (a subset of output_tokens). SDK 0.91.1 omits the field from
+                        // its Usage type, so read it through a narrow cast. Verified against the live API.
+                        const thinkingTokens = event.usage
+                            .output_tokens_details?.thinking_tokens;
+                        if (thinkingTokens != null) {
+                            output.usage.reasoning = thinkingTokens;
+                        }
                     }
                     // Anthropic doesn't provide total_tokens, compute from components
                     output.usage.totalTokens =
@@ -1336,11 +1320,8 @@ function convertMessages(transformedMessages, model, isOAuthToken, cacheControl,
                     });
                 }
                 else if (block.type === "providerNative") {
-                    if (isSameModel) {
-                        const replayableBlock = sanitizeReplayableAnthropicProviderNativeBlock(block.raw);
-                        if (replayableBlock)
-                            blocks.push(replayableBlock);
-                    }
+                    if (isSameModel && isReplayableAnthropicProviderNativeBlock(block.raw))
+                        blocks.push(block.raw);
                 }
             }
             if (blocks.length === 0)