@f5-sales-demo/pi-ai 21.13.0 → 21.13.2

package/CHANGELOG.md

@@ -10,6 +10,21 @@
 
 ### Fixed
 
+- Removed output-only lifecycle statuses before replaying persisted OpenAI Responses items,
+  including remote compaction and compaction summaries. Semantically ported from
+  [can1357/oh-my-pi#7743](https://github.com/can1357/oh-my-pi/pull/7743) and
+  [#10415](https://github.com/can1357/oh-my-pi/pull/10415)
+  ([#3721](https://github.com/f5-sales-demo/xcsh/issues/3721)).
+- Extended rate-limit handling to keep API-key credentials blocked until their live usage reset
+  and to understand absolute English and Chinese reset timestamps. Semantically ported from
+  [can1357/oh-my-pi#10325](https://github.com/can1357/oh-my-pi/pull/10325)
+  ([#3721](https://github.com/f5-sales-demo/xcsh/issues/3721)).
+- Prevented case-insensitive Windows environment lookup from replacing literal stored credentials,
+  and delayed Cursor success until the HTTP/2/CONNECT protocol terminates cleanly so late stream
+  errors remain visible. Semantically ported from
+  [can1357/oh-my-pi#7362](https://github.com/can1357/oh-my-pi/pull/7362) and
+  [#5636](https://github.com/can1357/oh-my-pi/pull/5636)
+  ([#3711](https://github.com/f5-sales-demo/xcsh/issues/3711)).
 - Exported the canonical provider credential-shape matcher so xcsh can protect otherwise
   unconfigured tokens reversibly before provider submission, preserving exact-match local edits.
   Semantically ported from

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/pi-ai",
-	"version": "21.13.0",
+	"version": "21.13.2",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -46,7 +46,7 @@
 		"@anthropic-ai/sdk": "^0.115",
 		"@aws-sdk/client-bedrock-runtime": "^3",
 		"@bufbuild/protobuf": "^2.11",
-		"@f5-sales-demo/pi-utils": "21.13.0",
+		"@f5-sales-demo/pi-utils": "21.13.2",
 		"@google/genai": "^2.15",
 		"@sinclair/typebox": "^0.34",
 		"@smithy/node-http-handler": "^4.4",

package/src/auth-storage.ts

@@ -10,7 +10,7 @@
 import { Database, type Statement } from "bun:sqlite";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { getAgentDbPath, logger } from "@f5-sales-demo/pi-utils";
+import { $envExact, getAgentDbPath, logger } from "@f5-sales-demo/pi-utils";
 import { getEnvApiKey } from "./stream";
 import type { Provider } from "./types";
 import type {
@@ -149,7 +149,7 @@ export type AuthStorageOptions = {
  * Does NOT support "!command" syntax (that requires pi-natives).
  */
 async function defaultConfigValueResolver(config: string): Promise<string | undefined> {
-	const envValue = process.env[config];
+	const envValue = $envExact(config);
 	return envValue || config;
 }
 
@@ -1015,7 +1015,10 @@ export class AuthStorage {
 	// Queries provider usage endpoints to detect rate limits before they occur.
 	// ─────────────────────────────────────────────────────────────────────────────
 
-	#buildUsageCredential(credential: OAuthCredential): UsageCredential {
+	#buildUsageCredential(credential: AuthCredential): UsageCredential {
+		if (credential.type === "api_key") {
+			return { type: "api_key", apiKey: credential.key };
+		}
 		return {
 			type: "oauth",
 			accessToken: credential.access,
@@ -1417,11 +1420,11 @@ export class AuthStorage {
 
 	async #getUsageReport(
 		provider: Provider,
-		credential: OAuthCredential,
+		credential: AuthCredential,
 		options?: { baseUrl?: string; timeoutMs?: number },
 	): Promise<UsageReport | null> {
 		return this.#fetchUsageCached(
-			this.#buildUsageRequestForOauth(provider, credential, options?.baseUrl),
+			this.#buildUsageRequest(provider, this.#buildUsageCredential(credential), options?.baseUrl),
 			options?.timeoutMs ?? this.#usageRequestTimeoutMs,
 		);
 	}
@@ -1510,15 +1513,13 @@ export class AuthStorage {
 		const now = Date.now();
 		let blockedUntil = now + (options?.retryAfterMs ?? AuthStorage.#defaultBackoffMs);
 
-		if (sessionCredential.type === "oauth" && this.#rankingStrategyResolver?.(provider)) {
+		if (this.#rankingStrategyResolver?.(provider)) {
 			const credential = this.#getCredentialsForProvider(provider)[sessionCredential.index];
-			if (credential?.type === "oauth") {
+			if (credential?.type === sessionCredential.type) {
 				const report = await this.#getUsageReport(provider, credential, options);
 				if (report && this.#isUsageLimitReached(report)) {
-					const resetAtMs = this.#getUsageResetAtMs(report, Date.now());
-					if (resetAtMs && resetAtMs > blockedUntil) {
-						blockedUntil = resetAtMs;
-					}
+					const resetAtMs = this.#getUsageResetAtMs(report, now);
+					if (resetAtMs && resetAtMs > blockedUntil) blockedUntil = resetAtMs;
 				}
 			}
 		}

package/src/providers/cursor.ts

@@ -325,6 +325,27 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 		let h2Client: http2.ClientHttp2Session | null = null;
 		let h2Request: http2.ClientHttp2Stream | null = null;
 		let heartbeatTimer: NodeJS.Timeout | null = null;
+		const h2Completion = Promise.withResolvers<void>();
+		let h2Settled = false;
+		let sawTurnEnded = false;
+		let endStreamError: Error | null = null;
+		const settleH2 = (error?: unknown): void => {
+			if (h2Settled) return;
+			h2Settled = true;
+			if (error !== undefined) {
+				h2Completion.reject(error);
+				return;
+			}
+			if (endStreamError) {
+				h2Completion.reject(endStreamError);
+				return;
+			}
+			if (!sawTurnEnded) {
+				h2Completion.reject(new Error("Cursor stream ended before turnEnded"));
+				return;
+			}
+			h2Completion.resolve();
+		};
 
 		try {
 			const apiKey = options?.apiKey;
@@ -346,6 +367,7 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 
 			const baseUrl = model.baseUrl || CURSOR_API_URL;
 			h2Client = http2.connect(baseUrl);
+			h2Client.on("error", error => settleH2(error));
 
 			h2Request = h2Client.request({
 				":method": "POST",
@@ -363,7 +385,6 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 			stream.push({ type: "start", partial: output });
 
 			let pendingBuffer = Buffer.alloc(0);
-			let endStreamError: Error | null = null;
 			let currentTextBlock: (TextContent & { index: number }) | null = null;
 			let currentThinkingBlock: (ThinkingContent & { index: number }) | null = null;
 			let currentToolCall: ToolCallState | null = null;
@@ -400,8 +421,6 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 				conversationStateCache.set(conversationId, checkpoint);
 			};
 
-			let resolveH2: (() => void) | undefined;
-
 			h2Request.on("data", (chunk: Buffer) => {
 				pendingBuffer = Buffer.concat([pendingBuffer, chunk]);
 
@@ -417,6 +436,7 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 						const endError = parseConnectEndStream(messageBytes);
 						if (endError) {
 							endStreamError = endError;
+							settleH2(endError);
 							h2Request?.close();
 						}
 						continue;
@@ -443,13 +463,8 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 							log("error", "handleServerMessage", { error: String(error) });
 						});
 
-						// Resolve only on explicit turnEnded. stopReason defaults to "stop"
-						// and is not a reliable signal for stream completion.
-						if (isTurnEnded && resolveH2) {
-							const r = resolveH2;
-							resolveH2 = undefined;
-							r();
-						}
+						// Application completion is not protocol success; wait for a clean HTTP/2 end.
+						if (isTurnEnded) sawTurnEnded = true;
 					} catch (e) {
 						log("error", "parseServerMessage", { error: String(e) });
 					}
@@ -471,32 +486,24 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 
 			heartbeatTimer = setInterval(sendHeartbeat, 5000);
 
-			const h2Completion = Promise.withResolvers<void>();
-			resolveH2 = h2Completion.resolve;
-
 			h2Request!.on("trailers", trailers => {
 				const status = trailers["grpc-status"];
 				const msg = trailers["grpc-message"];
-				if (status && status !== "0") {
-					h2Completion.reject(new Error(`gRPC error ${status}: ${decodeURIComponent(String(msg || ""))}`));
+				if (status && status !== "0" && !endStreamError) {
+					endStreamError = new Error(`gRPC error ${status}: ${decodeURIComponent(String(msg || ""))}`);
 				}
 			});
 
 			h2Request!.on("end", () => {
-				resolveH2 = undefined;
-				if (endStreamError) {
-					h2Completion.reject(endStreamError);
-					return;
-				}
-				h2Completion.resolve();
+				settleH2();
 			});
 
-			h2Request!.on("error", h2Completion.reject);
+			h2Request!.on("error", error => settleH2(error));
 
 			if (options?.signal) {
 				options.signal.addEventListener("abort", () => {
 					h2Request?.close();
-					h2Completion.reject(new Error("Request was aborted"));
+					settleH2(new Error("Request was aborted"));
 				});
 			}
 			await h2Completion.promise;

package/src/utils/retry-after.ts

@@ -1,6 +1,31 @@
 export type HeadersLike = Headers | Record<string, string | undefined> | undefined | null;
 
 const RETRY_AFTER_HINT = "retry-after-ms=";
+const RETRY_AFTER_MS_BODY_PATTERN = /\bretry-after-ms\s*[:=]\s*([0-9]+)\b/i;
+const WILL_RESET_AT_PATTERN =
+	/(?:will\s+)?reset at\s+([0-9]{4}-[0-9]{2}-[0-9]{2}[ T][0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]+)?(?:Z|[+-][0-9]{2}:?[0-9]{2})?)/i;
+const CN_RESET_AT_PATTERN = /将在\s*([0-9]{4}-[0-9]{2}-[0-9]{2}\s+[0-9]{2}:[0-9]{2}:[0-9]{2})\s*重置/;
+
+/** Parse body-level retry hints that are not represented by HTTP headers. */
+export function getRetryAfterMsFromErrorText(message: string): number | undefined {
+	const retryAfterMsMatch = RETRY_AFTER_MS_BODY_PATTERN.exec(message);
+	if (retryAfterMsMatch?.[1]) {
+		const milliseconds = Number(retryAfterMsMatch[1]);
+		if (Number.isFinite(milliseconds) && milliseconds > 0) return milliseconds;
+	}
+
+	for (const pattern of [WILL_RESET_AT_PATTERN, CN_RESET_AT_PATTERN]) {
+		const match = pattern.exec(message);
+		if (!match?.[1]) continue;
+		const normalized = match[1].replace(" ", "T");
+		const timestamp = /(?:Z|[+-][0-9]{2}:?[0-9]{2})$/i.test(normalized) ? normalized : `${normalized}Z`;
+		const resetAt = Date.parse(timestamp);
+		const delay = resetAt - Date.now();
+		if (!Number.isNaN(resetAt) && delay > 0) return delay;
+	}
+
+	return undefined;
+}
 
 export function formatErrorMessageWithRetryAfter(error: unknown, headers?: HeadersLike): string {
 	const message = error instanceof Error ? error.message : JSON.stringify(error);

package/src/utils.ts

@@ -65,12 +65,42 @@ export function truncateResponseItemId(id: string, prefix: string): string {
 	return `${prefix}_${Bun.hash(id).toString(36)}`;
 }
 
+/**
+ * Remove response-only lifecycle state from item types that reject it when
+ * replayed as OpenAI Responses input. The original array and untouched item
+ * identities are preserved when no change is needed.
+ */
+export function stripOpenAIResponsesOutputOnlyStatusesForReplay<TItem extends { type?: unknown; status?: unknown }>(
+	items: TItem[],
+): TItem[] {
+	let sanitized: TItem[] | undefined;
+	for (let index = 0; index < items.length; index++) {
+		const item = items[index]!;
+		const rejectsOutputStatus =
+			item.type === "message" ||
+			item.type === "function_call" ||
+			item.type === "custom_tool_call" ||
+			item.type === "compaction" ||
+			item.type === "compaction_summary";
+		if (!rejectsOutputStatus || !Object.hasOwn(item, "status")) {
+			sanitized?.push(item);
+			continue;
+		}
+		if (!sanitized) sanitized = items.slice(0, index);
+		const withoutStatus = { ...item };
+		delete withoutStatus.status;
+		sanitized.push(withoutStatus);
+	}
+	return sanitized ?? items;
+}
+
 export function sanitizeOpenAIResponsesHistoryItemsForReplay(items: Array<Record<string, unknown>>): ResponseInput {
 	const normalizedCallIds = new Map<string, string>();
-	return items.flatMap(item => {
+	const sanitized = items.flatMap(item => {
 		const sanitized = sanitizeOpenAIResponsesHistoryItemForReplay(item, normalizedCallIds);
 		return sanitized ? [sanitized] : [];
 	});
+	return stripOpenAIResponsesOutputOnlyStatusesForReplay(sanitized);
 }
 
 function sanitizeOpenAIResponsesHistoryItemForReplay(