@f5-sales-demo/pi-ai 20.20.6 → 20.22.2

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 # Changelog
 
+## Unreleased
+
+### Fixed
+
+- Omit an empty OpenAI-compatible `tools` field unless prior tool-call history requires the explicit empty array, and suppress the internal no-auth credential sentinel from keyless request headers ([#2942](https://github.com/f5-sales-demo/xcsh/issues/2942), [#3361](https://github.com/f5-sales-demo/xcsh/issues/3361)).
+
 ## [20.3.0] - 2026-08-04
 
 ### Changed
@@ -433,7 +439,7 @@
 - Removed `UsageCache` and `UsageCacheEntry` interfaces—caching is now handled internally by AuthStorage
 - Removed `google-gemini-cli-usage` export; use new `gemini` usage provider instead
 - Removed `resetInMs` computation from all usage providers
-- Removed cache TTL constants and cache management from usage fetchers (claude, github-copilot, google-antigravity, kimi, openai-codex, zai)
+- Removed cache TTL constants and cache management from usage fetchers (claude, GitHub Copilot, google-antigravity, kimi, openai-codex, zai)
 
 ### Fixed
 
@@ -1294,7 +1300,7 @@
 
 ### Changed
 
-- Updated @anthropic-ai/sdk to ^0.72.1
+- Updated `@anthropic-ai/sdk` to ^0.72.1
 - Updated @aws-sdk/client-bedrock-runtime to ^3.982.0
 - Updated @google/genai to ^1.39.0
 - Updated @smithy/node-http-handler to ^4.4.9

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/pi-ai",
-	"version": "20.20.6",
+	"version": "20.22.2",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -46,7 +46,7 @@
 		"@anthropic-ai/sdk": "^0.115",
 		"@aws-sdk/client-bedrock-runtime": "^3",
 		"@bufbuild/protobuf": "^2.11",
-		"@f5-sales-demo/pi-utils": "20.20.6",
+		"@f5-sales-demo/pi-utils": "20.22.2",
 		"@google/genai": "^2.15",
 		"@sinclair/typebox": "^0.34",
 		"@smithy/node-http-handler": "^4.4",

package/src/providers/openai-completions.ts

@@ -18,6 +18,7 @@ import {
 	type Message,
 	type MessageAttribution,
 	type Model,
+	NO_AUTH_API_KEY,
 	type ServiceTier,
 	type StopReason,
 	type StreamFunction,
@@ -581,6 +582,7 @@ async function createClient(
 		apiKey = $env.OPENAI_API_KEY;
 	}
 	const rawApiKey = apiKey;
+	const omitAuthorization = rawApiKey === NO_AUTH_API_KEY;
 
 	let headers = { ...(model.headers ?? {}), ...(extraHeaders ?? {}) };
 	if (model.provider === "openrouter") {
@@ -609,7 +611,19 @@ async function createClient(
 	let capturedErrorResponse: CapturedHttpErrorResponse | undefined;
 	const wrappedFetch = Object.assign(
 		async (input: string | URL | Request, init?: RequestInit): Promise<Response> => {
-			const response = await fetch(input, init);
+			let fetchInput = input;
+			let fetchInit = init;
+			if (omitAuthorization) {
+				if (input instanceof Request) {
+					const headers = new Headers(input.headers);
+					headers.delete("Authorization");
+					fetchInput = new Request(input, { headers });
+				}
+				const headers = new Headers(init?.headers);
+				headers.delete("Authorization");
+				fetchInit = { ...init, headers };
+			}
+			const response = await fetch(fetchInput, fetchInit);
 			if (response.ok) {
 				capturedErrorResponse = undefined;
 				return response;
@@ -715,7 +729,7 @@ function buildParams(
 		params.service_tier = options.serviceTier;
 	}
 
-	if (context.tools) {
+	if (context.tools && context.tools.length > 0) {
 		const builtTools = convertTools(context.tools, compat, toolStrictModeOverride);
 		params.tools = builtTools.tools;
 		toolStrictMode = builtTools.toolStrictMode;

package/src/types.ts

@@ -30,6 +30,9 @@ import type { AssistantMessageEventStream } from "./utils/event-stream";
 
 export type { AssistantMessageEventStream } from "./utils/event-stream";
 
+/** Internal credential sentinel that keeps keyless providers selectable without sending authentication. */
+export const NO_AUTH_API_KEY = "N/A";
+
 export type KnownApi =
 	| "openai-completions"
 	| "openai-responses"

package/src/utils/oauth/callback-server.ts

@@ -19,6 +19,11 @@ const CALLBACK_PATH = "/callback";
 
 export type CallbackResult = { code: string; state: string };
 
+interface CallbackServer {
+	port: number;
+	stop(closeActiveConnections?: boolean): void;
+}
+
 export interface OAuthCallbackFlowOptions {
 	preferredPort: number;
 	callbackPath?: string;
@@ -117,13 +122,13 @@ export abstract class OAuthCallbackFlow {
 	/**
 	 * Start callback server, trying preferred port first, falling back to random.
 	 */
-	async #startCallbackServer(expectedState: string): Promise<{ server: Bun.Server<unknown>; redirectUri: string }> {
+	async #startCallbackServer(expectedState: string): Promise<{ server: CallbackServer; redirectUri: string }> {
 		try {
 			const server = this.#createServer(this.preferredPort, expectedState);
 			if (this.redirectUri) {
 				return { server, redirectUri: this.redirectUri };
 			}
-			const redirectUri = `http://${this.callbackHostname}:${this.preferredPort}${this.callbackPath}`;
+			const redirectUri = `http://${this.callbackHostname}:${server.port}${this.callbackPath}`;
 			return { server, redirectUri };
 		} catch {
 			if (this.redirectUri) {
@@ -142,13 +147,45 @@ export abstract class OAuthCallbackFlow {
 	/**
 	 * Create HTTP server for OAuth callback.
 	 */
-	#createServer(port: number, expectedState: string): Bun.Server<unknown> {
-		return Bun.serve({
-			hostname: this.callbackHostname,
+	#createServer(port: number, expectedState: string): CallbackServer {
+		if (this.callbackHostname !== DEFAULT_HOSTNAME) {
+			return this.#createSingleServer(this.callbackHostname, port, expectedState);
+		}
+
+		// Bun resolves a localhost listener to IPv6 on some Linux images while clients resolve
+		// localhost to IPv4. Bind both loopback addresses, but keep localhost in the redirect URI
+		// so OAuth providers receive the conventional, portable callback host.
+		const ipv4Server = this.#createSingleServer("127.0.0.1", port, expectedState);
+		try {
+			const ipv6Server = this.#createSingleServer("::1", ipv4Server.port, expectedState);
+			return {
+				port: ipv4Server.port,
+				stop: closeActiveConnections => {
+					ipv4Server.stop(closeActiveConnections);
+					ipv6Server.stop(closeActiveConnections);
+				},
+			};
+		} catch (error) {
+			ipv4Server.stop();
+			throw error;
+		}
+	}
+
+	#createSingleServer(hostname: string, port: number, expectedState: string): CallbackServer {
+		const server = Bun.serve({
+			hostname,
 			port,
 			reusePort: false,
 			fetch: req => this.#handleCallback(req, expectedState),
 		});
+		if (server.port === undefined) {
+			server.stop();
+			throw new Error(`OAuth callback server did not report a bound port for ${hostname}`);
+		}
+		return {
+			port: server.port,
+			stop: closeActiveConnections => server.stop(closeActiveConnections),
+		};
 	}
 
 	/**