@jameslovespancakes/pi-plus 1.0.16 → 1.0.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jameslovespancakes/pi-plus",
-  "version": "1.0.16",
+  "version": "1.0.17",
   "type": "module",
   "description": "pi and more",
   "license": "MIT",
@@ -49,10 +49,10 @@
     "ws": "^8.18.3"
   },
   "peerDependencies": {
-    "@earendil-works/pi-agent-core": "^0.87.0",
-    "@earendil-works/pi-ai": "^0.87.0",
-    "@earendil-works/pi-coding-agent": "^0.87.0",
-    "@earendil-works/pi-tui": "^0.87.0",
+    "@earendil-works/pi-agent-core": "*",
+    "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-coding-agent": "*",
+    "@earendil-works/pi-tui": "*",
     "typebox": "*"
   },
   "scripts": {

package/src/core/anthropic/models.ts

@@ -1,5 +1,8 @@
 import type { Model } from "@earendil-works/pi-ai";
-import { ANTHROPIC_MODELS as PI_ANTHROPIC_MODELS } from "@earendil-works/pi-ai/providers/anthropic.models";
+// `providers/all` is one of the entry points pi supplies from its own copy;
+// a deep `providers/anthropic.models` import has nothing to resolve against
+// on a clean install.
+import { getBuiltinModels } from "@earendil-works/pi-ai/providers/all";
 import { cachedAnthropicModels, type LiveModel } from "./catalog.ts";
 
 /**
@@ -106,7 +109,7 @@ function nameFor(model: LiveModel): string {
   return version ? `Claude ${pretty} ${version}` : `Claude ${pretty}`;
 }
 
-const base = Object.values(PI_ANTHROPIC_MODELS as unknown as Record<string, AnthropicModel>);
+const base = getBuiltinModels("anthropic") as unknown as AnthropicModel[];
 
 /**
  * Newest model per family, used as the template for a model the live list

package/src/core/gemini/convert.ts

@@ -0,0 +1,239 @@
+import {
+  collapseSystemMessages,
+  withoutInitialSystemMessage,
+  type Api,
+  type AssistantMessage,
+  type Message,
+  type Model,
+  type TranscriptContext,
+} from "@earendil-works/pi-ai";
+
+/**
+ * pi messages → Gemini `contents`.
+ *
+ * A port of pi-ai's `convertMessages` / `transformMessages` from its Google
+ * adapter (MIT). pi does not supply that module to extensions — it hands out
+ * only its package root, `compat`, `oauth` and `providers/all`, and installs
+ * packages without their peers — so importing it resolves to nothing on a
+ * clean install. The behaviour is kept identical to pi's: thought-signature
+ * validation, cross-model thinking demoted to text, tool-call id
+ * normalisation, synthetic results for orphaned calls, and multimodal
+ * function responses. Re-check it against pi's adapter on a pi upgrade.
+ */
+
+export interface Part {
+  text?: string;
+  thought?: boolean;
+  thoughtSignature?: string;
+  inlineData?: { mimeType?: string; data?: string };
+  functionCall?: { name?: string; args?: Record<string, unknown>; id?: string };
+  functionResponse?: { name?: string; id?: string; response?: Record<string, unknown>; parts?: Part[] };
+}
+
+export interface Content {
+  role: "user" | "model";
+  parts: Part[];
+}
+
+/** Unpaired UTF-16 surrogates are rejected by the JSON the API parses. */
+export function sanitizeSurrogates(text: string): string {
+  return text.replace(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g, "");
+}
+
+// Thought signatures must be base64 (TYPE_BYTES); anything else is rejected.
+const BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
+const isValidSignature = (signature?: string): signature is string =>
+  !!signature && signature.length % 4 === 0 && BASE64.test(signature);
+
+function geminiMajor(modelId: string): number | undefined {
+  const match = /^gemini(?:-live)?-(\d+)/i.exec(modelId);
+  return match ? Number.parseInt(match[1], 10) : undefined;
+}
+
+/** Claude, GPT-OSS and Gemini 3+ need explicit ids on function calls and responses. */
+export function requiresToolCallId(modelId: string): boolean {
+  const major = geminiMajor(modelId);
+  return modelId.startsWith("claude-") || modelId.startsWith("gpt-oss-") || (major !== undefined && major >= 3);
+}
+
+function supportsMultimodalFunctionResponse(modelId: string): boolean {
+  const major = geminiMajor(modelId);
+  return major === undefined || major >= 3;
+}
+
+const USER_IMAGE_PLACEHOLDER = "(image omitted: model does not support images)";
+const TOOL_IMAGE_PLACEHOLDER = "(tool image omitted: model does not support images)";
+
+function withoutImages<T extends { type: string }>(content: T[], placeholder: string): T[] {
+  const result: T[] = [];
+  let previousWasPlaceholder = false;
+  for (const block of content) {
+    if (block.type === "image") {
+      if (!previousWasPlaceholder) result.push({ type: "text", text: placeholder } as unknown as T);
+      previousWasPlaceholder = true;
+      continue;
+    }
+    result.push(block);
+    previousWasPlaceholder = (block as { text?: string }).text === placeholder;
+  }
+  return result;
+}
+
+/**
+ * Makes a history replayable on `model`: another model's thinking becomes
+ * text, its signatures are dropped, its tool-call ids are normalised, failed
+ * turns are skipped, and every tool call is answered.
+ */
+function transformMessages(messages: Message[], model: Model<Api>, normalizeId: (id: string) => string): Message[] {
+  const idMap = new Map<string, string>();
+  const vision = model.input.includes("image");
+
+  const transformed = messages.map((raw): Message => {
+    const message = (raw.content == null ? { ...raw, content: [] } : raw) as Message;
+
+    if (message.role === "user") {
+      return !vision && Array.isArray(message.content)
+        ? { ...message, content: withoutImages(message.content, USER_IMAGE_PLACEHOLDER) }
+        : message;
+    }
+    if (message.role === "toolResult") {
+      const content = vision ? message.content : withoutImages(message.content, TOOL_IMAGE_PLACEHOLDER);
+      const toolCallId = idMap.get(message.toolCallId) ?? message.toolCallId;
+      return { ...message, content, toolCallId };
+    }
+    if (message.role !== "assistant") return message;
+
+    const sameModel = message.provider === model.provider && message.api === model.api && message.model === model.id;
+    const content = message.content.flatMap((block): AssistantMessage["content"] => {
+      if (block.type === "thinking") {
+        if (block.redacted) return sameModel ? [block] : [];
+        if (sameModel && block.thinkingSignature) return [block];
+        if (!block.thinking || block.thinking.trim() === "") return [];
+        return sameModel ? [block] : [{ type: "text", text: block.thinking }];
+      }
+      if (block.type === "text") return sameModel ? [block] : [{ type: "text", text: block.text }];
+      if (block.type === "toolCall" && !sameModel) {
+        const { thoughtSignature: _dropped, ...call } = block;
+        const id = normalizeId(block.id);
+        if (id !== block.id) idMap.set(block.id, id);
+        return [{ ...call, id }];
+      }
+      return [block];
+    });
+    return { ...message, content };
+  });
+
+  // Every tool call needs a result before the next turn; an unanswered one
+  // (an interrupted run, a user message mid-tool-flow) gets a synthetic error.
+  const result: Message[] = [];
+  let pending: { id: string; name: string }[] = [];
+  let answered = new Set<string>();
+  const closePending = () => {
+    for (const call of pending) {
+      if (answered.has(call.id)) continue;
+      result.push({
+        role: "toolResult",
+        toolCallId: call.id,
+        toolName: call.name,
+        content: [{ type: "text", text: "No result provided" }],
+        isError: true,
+        timestamp: Date.now(),
+      });
+    }
+    pending = [];
+    answered = new Set();
+  };
+
+  for (const message of transformed) {
+    if (message.role === "assistant") {
+      closePending();
+      // Incomplete turns are not replayed; the model resumes from the last good state.
+      if (message.stopReason === "error" || message.stopReason === "aborted") continue;
+      const calls = message.content.filter((block) => block.type === "toolCall");
+      if (calls.length > 0) {
+        pending = calls.map((call) => ({ id: call.id, name: call.name }));
+        answered = new Set();
+      }
+      result.push(message);
+    } else if (message.role === "toolResult") {
+      answered.add(message.toolCallId);
+      result.push(message);
+    } else {
+      if (message.role === "user") closePending();
+      result.push(message);
+    }
+  }
+  closePending();
+  return result;
+}
+
+/** Gemini `contents` for a transcript; the system prompt travels separately. */
+export function convertMessages(model: Model<Api>, context: TranscriptContext): Content[] {
+  // Gemini has no mid-conversation system messages; the prompt is systemInstruction.
+  const conversation = withoutInitialSystemMessage(collapseSystemMessages(context).messages);
+  const includeIds = requiresToolCallId(model.id);
+  const normalizeId = (id: string) => includeIds ? id.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 64) : id;
+  const contents: Content[] = [];
+
+  for (const message of transformMessages(conversation, model, normalizeId)) {
+    if (message.role === "user") {
+      const parts: Part[] = typeof message.content === "string"
+        ? [{ text: sanitizeSurrogates(message.content) }]
+        : message.content.map((item) => item.type === "text"
+          ? { text: sanitizeSurrogates(item.text) }
+          : { inlineData: { mimeType: item.mimeType, data: item.data } });
+      if (parts.length > 0) contents.push({ role: "user", parts });
+    } else if (message.role === "assistant") {
+      const sameModel = message.provider === model.provider && message.model === model.id;
+      const signature = (value?: string) => sameModel && isValidSignature(value) ? value : undefined;
+      const parts: Part[] = [];
+
+      for (const block of message.content) {
+        if (block.type === "text") {
+          const thoughtSignature = signature(block.textSignature);
+          // An empty part that carries a signature must still be echoed back,
+          // or the reasoning chain breaks and turns end with an empty STOP.
+          if ((!block.text || block.text.trim() === "") && !thoughtSignature) continue;
+          parts.push({ text: sanitizeSurrogates(block.text), ...(thoughtSignature && { thoughtSignature }) });
+        } else if (block.type === "thinking") {
+          if (sameModel) {
+            const thoughtSignature = signature(block.thinkingSignature);
+            if ((!block.thinking || block.thinking.trim() === "") && !thoughtSignature) continue;
+            parts.push({ thought: true, text: sanitizeSurrogates(block.thinking), ...(thoughtSignature && { thoughtSignature }) });
+          } else if (block.thinking && block.thinking.trim() !== "") {
+            parts.push({ text: sanitizeSurrogates(block.thinking) });
+          }
+        } else if (block.type === "toolCall") {
+          const thoughtSignature = signature(block.thoughtSignature);
+          parts.push({
+            functionCall: { name: block.name, args: block.arguments ?? {}, ...(includeIds && { id: block.id }) },
+            ...(thoughtSignature && { thoughtSignature }),
+          });
+        }
+      }
+      if (parts.length > 0) contents.push({ role: "model", parts });
+    } else if (message.role === "toolResult") {
+      const text = message.content.filter((item) => item.type === "text").map((item) => item.text).join("\n");
+      const images = model.input.includes("image") ? message.content.filter((item) => item.type === "image") : [];
+      const imageParts: Part[] = images.map((image) => ({ inlineData: { mimeType: image.mimeType, data: image.data } }));
+      const nested = imageParts.length > 0 && supportsMultimodalFunctionResponse(model.id);
+      const value = text.length > 0 ? sanitizeSurrogates(text) : imageParts.length > 0 ? "(see attached image)" : "";
+
+      const part: Part = {
+        functionResponse: {
+          name: message.toolName,
+          response: message.isError ? { error: value } : { output: value },
+          ...(nested && { parts: imageParts }),
+          ...(includeIds && { id: message.toolCallId }),
+        },
+      };
+      // Every function response of a turn must share one user turn.
+      const last = contents.at(-1);
+      if (last?.role === "user" && last.parts.some((existing) => existing.functionResponse)) last.parts.push(part);
+      else contents.push({ role: "user", parts: [part] });
+
+      if (imageParts.length > 0 && !nested) contents.push({ role: "user", parts: [{ text: "Tool result image:" }, ...imageParts] });
+    }
+  }
+  return contents;
+}

package/src/core/gemini/models.ts

@@ -1,5 +1,5 @@
 import type { Api, Model, ModelThinkingLevel, ThinkingLevelMap } from "@earendil-works/pi-ai";
-import { GOOGLE_MODELS } from "@earendil-works/pi-ai/providers/google.models";
+import { getBuiltinModels } from "@earendil-works/pi-ai/providers/all";
 import { GEMINI_ENDPOINT, type RuntimeModelInfo } from "./client.ts";
 
 /**
@@ -52,7 +52,7 @@ const familyOf = (id: string): Family => FAMILIES.find((family) => family.test.t
 
 /** pi's own definition of the same model, when its Google catalogue carries it. */
 function piModel(id: string): Model<Api> | undefined {
-  return (GOOGLE_MODELS as Record<string, Model<Api>>)[id];
+  return (getBuiltinModels("google") as Model<Api>[]).find((model) => model.id === id);
 }
 
 interface Definition {

package/src/core/gemini/request.ts

@@ -1,42 +1,29 @@
-import type { Api, Model, ModelThinkingLevel, ToolChoice, TranscriptContext } from "@earendil-works/pi-ai";
-import { sanitizeSurrogates } from "@earendil-works/pi-ai/utils/sanitize-unicode";
-import { getCurrentSystemPrompt, getCurrentTools } from "@earendil-works/pi-ai/utils/transcript";
+import {
+  getCurrentSystemPrompt,
+  getCurrentTools,
+  type Api,
+  type Model,
+  type ModelThinkingLevel,
+  type Tool,
+  type ToolChoice,
+  type TranscriptContext,
+} from "@earendil-works/pi-ai";
 import { stableUuid } from "./client.ts";
+import { convertMessages, sanitizeSurrogates, type Content, type Part } from "./convert.ts";
 import { runtimeModelId, thinkingConfig } from "./models.ts";
 import { bridgeSchema, selfContainedSchema } from "./schema.ts";
 
 /**
  * Builds a Gemini `streamGenerateContent` request.
  *
- * Inside the envelope the body is ordinary Gemini, so message conversion,
- * thought-signature validation, tool-call ids and function-calling mode all
- * come from pi's own Google adapter. What is added here is only what this
- * backend demands beyond the public Gemini API: the runtime model id, its
- * thinking budget, the Claude/GPT-OSS schema bridge, a few conversation-shape
- * repairs it enforces, and the agent envelope it expects.
+ * Inside the envelope the body is ordinary Gemini, converted the way pi's
+ * own Google adapter converts it (see convert.ts). What is added here is only
+ * what this backend demands beyond the public Gemini API: the runtime model
+ * id, its thinking budget, the Claude/GPT-OSS schema bridge, a few
+ * conversation-shape repairs it enforces, and the agent envelope it expects.
  */
 
-type GoogleShared = typeof import("@earendil-works/pi-ai/api/google-shared");
-let googleSharedModule: Promise<GoogleShared> | undefined;
-
-/** Loaded on first request, as pi loads its own Google adapter: it pulls in `@google/genai`. */
-export function googleShared(): Promise<GoogleShared> {
-  return googleSharedModule ??= import("@earendil-works/pi-ai/api/google-shared");
-}
-
-export interface Part {
-  text?: string;
-  thought?: boolean;
-  thoughtSignature?: string;
-  inlineData?: { mimeType?: string; data?: string };
-  functionCall?: { name?: string; args?: Record<string, unknown>; id?: string };
-  functionResponse?: { name?: string; id?: string; response?: Record<string, unknown>; parts?: Part[] };
-}
-
-export interface Content {
-  role: "user" | "model";
-  parts: Part[];
-}
+export type { Content, Part };
 
 export interface RequestOptions {
   /** Level after pi's clamp; undefined means thinking off. */
@@ -158,15 +145,23 @@ export function repairContents(contents: Content[], requireSignatures: boolean):
   return turns;
 }
 
-function toolDeclarations(declared: { functionDeclarations: Record<string, unknown>[] }[], bridge: boolean) {
-  return declared.map((group) => ({
-    functionDeclarations: group.functionDeclarations.map(({ parametersJsonSchema, parameters, ...rest }) => ({
-      ...rest,
+function toolDeclarations(tools: Tool[], bridge: boolean) {
+  return [{
+    functionDeclarations: tools.map((tool) => ({
+      name: tool.name,
+      description: tool.description,
       ...(bridge
-        ? { parameters: bridgeSchema(parametersJsonSchema ?? parameters) }
-        : { parametersJsonSchema: selfContainedSchema(parametersJsonSchema ?? parameters) }),
+        ? { parameters: bridgeSchema(tool.parameters) }
+        : { parametersJsonSchema: selfContainedSchema(tool.parameters) }),
     })),
-  }));
+  }];
+}
+
+/** pi's tool choice as Gemini's calling mode; omitted unless asked, as pi does. */
+function callingMode(toolChoice: RequestOptions["toolChoice"]): string | undefined {
+  if (toolChoice === "none") return "NONE";
+  if (toolChoice === "any") return "ANY";
+  return toolChoice ? "AUTO" : undefined;
 }
 
 /** Random signed 64-bit decimal, the shape the Antigravity CLI uses for session ids. */
@@ -204,32 +199,21 @@ function envelope(context: TranscriptContext, contents: Content[], runtimeId: st
   };
 }
 
-export async function buildRequest(
+export function buildRequest(
   model: Model<Api>,
   context: TranscriptContext,
   projectId: string,
   options: RequestOptions = {},
-): Promise<GeminiRequest> {
-  const google = await googleShared();
-  // pi's Google helpers are typed against its own Google APIs; the body inside
-  // the envelope has exactly the same model semantics.
-  const googleModel = model as unknown as Model<"google-generative-ai">;
+): GeminiRequest {
   const runtimeId = runtimeModelId(model, options.reasoning);
-
-  const contents = repairContents(
-    google.convertMessages(googleModel, context) as unknown as Content[],
-    requiresThoughtSignatures(runtimeId),
-  );
+  const contents = repairContents(convertMessages(model, context), requiresThoughtSignatures(runtimeId));
 
   // The system prompt and tools live in the transcript's system messages,
   // never on the context object; reading them any other way sends neither.
   const systemPrompt = getCurrentSystemPrompt(context.messages);
   const tools = getCurrentTools(context.messages);
   // Strict tool sampling (Gemini's VALIDATED mode) is not offered by this backend.
-  const declared = google.convertTools(tools, false, false);
-  const mode = tools.length > 0
-    ? google.resolveGoogleFunctionCallingMode(tools, options.toolChoice, false)
-    : undefined;
+  const mode = tools.length > 0 ? callingMode(options.toolChoice) : undefined;
 
   const thinking = thinkingConfig(runtimeId, options.reasoning);
   const generationConfig = {
@@ -247,7 +231,7 @@ export async function buildRequest(
       contents,
       ...(systemPrompt && { systemInstruction: { role: "user", parts: [{ text: sanitizeSurrogates(systemPrompt) }] } }),
       generationConfig,
-      ...(declared && { tools: toolDeclarations(declared, usesToolBridge(runtimeId)) }),
+      ...(tools.length > 0 && { tools: toolDeclarations(tools, usesToolBridge(runtimeId)) }),
       ...(mode !== undefined && { toolConfig: { functionCallingConfig: { mode } } }),
       sessionId,
       labels,

package/src/core/gemini/stream.ts

@@ -1,40 +1,39 @@
-import type {
-  Api,
-  AssistantMessage,
-  AssistantMessageEventStream,
-  Model,
-  ModelThinkingLevel,
-  ProviderStreams,
-  SimpleStreamOptions,
-  StopReason,
-  StreamOptions,
-  TextContent,
-  ThinkingContent,
-  ToolCall,
-  ToolChoice,
-  TranscriptContext,
+// Only pi-ai's package root: it is one of the entry points pi supplies to
+// extensions from its own copy. Deep imports have nothing to resolve against
+// on a clean install (see convert.ts).
+import {
+  calculateCost,
+  clampThinkingLevel,
+  createAssistantMessageEventStream,
+  formatThrownValue,
+  type Api,
+  type AssistantMessage,
+  type AssistantMessageEventStream,
+  type Model,
+  type ModelThinkingLevel,
+  type ProviderStreams,
+  type SimpleStreamOptions,
+  type StopReason,
+  type StreamOptions,
+  type TextContent,
+  type ThinkingContent,
+  type ToolCall,
+  type ToolChoice,
+  type TranscriptContext,
 } from "@earendil-works/pi-ai";
-import { calculateCost, clampThinkingLevel } from "@earendil-works/pi-ai";
-import { buildBaseOptions } from "@earendil-works/pi-ai/api/simple-options";
-import { formatProviderError, normalizeProviderError } from "@earendil-works/pi-ai/utils/error-body";
-// pi exports the concrete stream class from this subpath; the bare name on the
-// package root is the interface, which cannot be constructed.
-import { createAssistantMessageEventStream } from "@earendil-works/pi-ai/utils/event-stream";
-import { headersToRecord, providerHeadersToRecord } from "@earendil-works/pi-ai/utils/headers";
-import { retryProviderRequest } from "@earendil-works/pi-ai/utils/provider-retry";
 import { geminiHeaders, endpointsFor } from "./client.ts";
+import type { Part } from "./convert.ts";
 import { decodeApiKey } from "./credentials.ts";
 import { GEMINI_API, runtimeModelId } from "./models.ts";
-import { buildRequest, googleShared, type Part } from "./request.ts";
+import { buildRequest } from "./request.ts";
 
 /**
  * Gemini streaming transport.
  *
  * The request is Gemini inside an agent envelope, posted to
  * `v1internal:streamGenerateContent`, and every SSE frame comes back wrapped
- * in `.response`. Retry policy, error formatting, stop-reason mapping and
- * thought-signature retention are pi's; what is here is what this backend
- * needs beyond them — endpoint fallback, reading quota walls out of the
+ * in `.response`. Retrying is pi's: its session retries on the wording
+ * below. What is here is what this backend needs beyond that — endpoint fallback, reading quota walls out of the
  * response body, and a watchdog for streams that go silent.
  */
 
@@ -170,19 +169,39 @@ export function describeFailure(status: number, body: string, runtimeId: string)
 }
 
 /**
- * Response headers plus what the body said about retrying, in the form pi's
- * `retryProviderRequest` and the account pool both read.
+ * Response headers plus the retry delay the body stated, in the form the
+ * account pool reads when it decides how long to hold an account back.
  */
 function failureHeaders(headers: Headers, failure: Failure): Headers {
   const next = new Headers(headers);
-  // A quota wall will not clear within any retry backoff; spend nothing on it.
-  if (failure.quotaWall) next.set("x-should-retry", "false");
   if (failure.retryAfterSeconds !== undefined && !next.has("retry-after")) {
     next.set("retry-after", String(failure.retryAfterSeconds));
   }
   return next;
 }
 
+function toRecord(headers: Headers): Record<string, string> {
+  const record: Record<string, string> = {};
+  headers.forEach((value, name) => { record[name] = value; });
+  return record;
+}
+
+/** pi's header rule: later layers win, and a null value removes the header. */
+function mergeHeaders(...layers: Array<Record<string, string | null | undefined> | undefined>): Record<string, string> {
+  const merged: Record<string, string | null | undefined> = {};
+  for (const layer of layers) Object.assign(merged, layer);
+  return Object.fromEntries(Object.entries(merged).filter((entry): entry is [string, string] => typeof entry[1] === "string"));
+}
+
+/** "STOP" and "MAX_TOKENS" are successes; every other finish reason is a failure, as in pi. */
+function stopReasonOf(finishReason: string): StopReason {
+  return finishReason === "STOP" ? "stop" : finishReason === "MAX_TOKENS" ? "length" : "error";
+}
+
+/** Some backends send a signature only on a block's first delta; keep it. */
+const retainSignature = (existing: string | undefined, incoming: string | undefined) =>
+  typeof incoming === "string" && incoming.length > 0 ? incoming : existing;
+
 // --- Transport -------------------------------------------------------------
 
 function pause(ms: number, signal?: AbortSignal): Promise<void> {
@@ -274,17 +293,12 @@ export const stream = (
     try {
       const { token, projectId } = decodeApiKey(options?.apiKey);
       const runtimeId = runtimeModelId(model, options?.reasoning);
-      const google = await googleShared();
 
-      let body: unknown = await buildRequest(model, context, projectId, options);
+      let body: unknown = buildRequest(model, context, projectId, options);
       body = (await options?.onPayload?.(body, model)) ?? body;
       const payload = JSON.stringify(body);
 
-      const headers: Record<string, string> = {
-        ...geminiHeaders(token),
-        // Same precedence and null-suppression rules as pi's own adapters.
-        ...providerHeadersToRecord({ ...model.headers, ...options?.headers }),
-      };
+      const headers = mergeHeaders(geminiHeaders(token), model.headers, options?.headers);
       const fetchImpl = options?.fetch ?? globalThis.fetch;
       const headerTimeout = options?.timeoutMs ?? HEADER_TIMEOUT_MS;
       const idleTimeout = options?.timeoutMs ?? STALL_TIMEOUT_MS;
@@ -307,7 +321,7 @@ export const stream = (
             headerTimeout,
           );
           if (response.ok) {
-            await options?.onResponse?.({ status: response.status, headers: headersToRecord(response.headers) }, model);
+            await options?.onResponse?.({ status: response.status, headers: toRecord(response.headers) }, model);
             return response;
           }
           const failure = describeFailure(response.status, await response.text(), runtimeId);
@@ -318,7 +332,7 @@ export const stream = (
         const { status, headers: reported, failure } = failed!;
         // Reported with the body's reset time, so the account pool can hold a
         // quota-walled account out of routing until it actually resets.
-        await options?.onResponse?.({ status, headers: headersToRecord(reported) }, model);
+        await options?.onResponse?.({ status, headers: toRecord(reported) }, model);
         // The shape pi's retry policy reads: `status` plus `Headers`.
         throw Object.assign(new Error(failure.message), { status, headers: reported });
       };
@@ -360,7 +374,7 @@ export const stream = (
           for (const part of candidate?.content?.parts ?? []) {
             if (part.text !== undefined) {
               received = true;
-              const thinking = google.isThinkingPart(part);
+              const thinking = part.thought === true;
               if (!block || (thinking ? block.type !== "thinking" : block.type !== "text")) {
                 closeBlock(block);
                 block = thinking
@@ -373,11 +387,11 @@ export const stream = (
 
               if (block.type === "thinking") {
                 block.thinking += part.text;
-                block.thinkingSignature = google.retainThoughtSignature(block.thinkingSignature, part.thoughtSignature);
+                block.thinkingSignature = retainSignature(block.thinkingSignature, part.thoughtSignature);
                 events.push({ type: "thinking_delta", contentIndex: index(), delta: part.text, partial: output });
               } else {
                 block.text += part.text;
-                block.textSignature = google.retainThoughtSignature(block.textSignature, part.thoughtSignature);
+                block.textSignature = retainSignature(block.textSignature, part.thoughtSignature);
                 events.push({ type: "text_delta", contentIndex: index(), delta: part.text, partial: output });
               }
             }
@@ -409,7 +423,7 @@ export const stream = (
             output.rawStopReason = candidate.finishReason;
             output.stopReason = output.content.some((item) => item.type === "toolCall")
               ? "toolUse"
-              : google.mapStopReasonString(candidate.finishReason);
+              : stopReasonOf(candidate.finishReason);
           }
 
           const usage = data.usageMetadata;
@@ -475,11 +489,7 @@ export const stream = (
           output.rawStopReason = undefined;
           started = false;
         }
-        received = await consume(await retryProviderRequest(send, {
-          maxRetries: options?.maxRetries,
-          maxRetryDelayMs: options?.maxRetryDelayMs,
-          signal: options?.signal,
-        }));
+        received = await consume(await send());
       }
 
       if (!received) throw new Error("Gemini returned an empty response.");
@@ -499,7 +509,7 @@ export const stream = (
       events.end();
     } catch (error) {
       output.stopReason = options?.signal?.aborted ? "aborted" : "error";
-      output.errorMessage = formatProviderError(normalizeProviderError(error), "Gemini");
+      output.errorMessage = formatThrownValue(error);
       events.push({ type: "error", reason: output.stopReason, error: output });
       events.end();
     }
@@ -508,14 +518,35 @@ export const stream = (
   return events;
 };
 
+/** Headroom pi leaves between the estimated context and the window. */
+const CONTEXT_SAFETY_TOKENS = 4096;
+
+/**
+ * The context already used: the last response's reported usage, plus about
+ * four characters per token for anything after it. The same estimate pi uses
+ * to keep an output ceiling from pushing a request past the context window.
+ */
+function estimateContextTokens(context: TranscriptContext): number {
+  const messages = context.messages;
+  let index = messages.length - 1;
+  while (index >= 0 && !(messages[index].role === "assistant" && (messages[index] as AssistantMessage).usage?.totalTokens)) index--;
+  const usage = index >= 0 ? (messages[index] as AssistantMessage).usage : undefined;
+  const counted = usage ? usage.input + usage.output + usage.cacheRead + usage.cacheWrite : 0;
+  const trailing = messages.slice(index + 1).reduce((sum, message) => sum + JSON.stringify(message).length, 0);
+  return counted + Math.ceil(trailing / 4);
+}
+
 export const streamSimple = (
   model: Model<Api>,
   context: TranscriptContext,
   options?: SimpleStreamOptions,
 ): AssistantMessageEventStream => {
   const level = options?.reasoning && model.reasoning ? clampThinkingLevel(model, options.reasoning) : undefined;
+  const requested = options?.maxTokens ?? model.maxTokens;
+  const room = model.contextWindow - estimateContextTokens(context) - CONTEXT_SAFETY_TOKENS;
   return stream(model, context, {
-    ...buildBaseOptions(model, context, options, options?.apiKey),
+    ...options,
+    maxTokens: model.contextWindow > 0 ? Math.min(requested, Math.max(1, room)) : requested,
     toolChoice: options?.toolChoice,
     reasoning: level === "off" ? undefined : level,
   });

package/src/domains/subscriptions/providers/builtin.ts

@@ -0,0 +1,19 @@
+import type { Api, Provider } from "@earendil-works/pi-ai";
+import { builtinProviders } from "@earendil-works/pi-ai/providers/all";
+
+/**
+ * One of pi's own providers, from the host's copy of pi-ai.
+ *
+ * pi hands extensions its pi-ai through a fixed set of entry points (the
+ * package root, `compat`, `oauth` and `providers/all`) and installs packages
+ * without their peers. A deep import such as `pi-ai/providers/openai-codex`
+ * therefore has no copy to resolve against on a clean install, and wherever a
+ * stray copy does exist it is a different version from the host — the exact
+ * way stale provider definitions have dropped tools before.
+ * `providers/all` is always the host's, so providers come from here.
+ */
+export function builtinProvider<TApi extends Api>(id: string): Provider<TApi> {
+  const provider = builtinProviders().find((candidate) => candidate.id === id);
+  if (!provider) throw new Error(`This version of pi has no built-in "${id}" provider.`);
+  return provider as unknown as Provider<TApi>;
+}

package/src/domains/subscriptions/providers/codex.ts

@@ -1,5 +1,4 @@
 import type { OAuthCredential } from "@earendil-works/pi-ai";
-import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type { RoutingMode } from "../../../core/accounts/registry.ts";
 import { normalizeRoutingMode, type AccountQuotaState } from "../../../core/accounts/routing.ts";
@@ -13,6 +12,7 @@ import {
   saveCodexAccounts,
   type CodexAccount,
 } from "../../../core/codex/store.ts";
+import { builtinProvider } from "./builtin.ts";
 import {
   chooseCredential,
   createPooledOAuthAdapter,
@@ -146,7 +146,7 @@ function markCodexRateLimited(accountId: string, headers: Record<string, string>
 export const CODEX_SPEC: PooledOAuthProviderSpec<"openai-codex-responses"> = {
   id: "openai-codex",
   label: "Codex",
-  createProvider: openaiCodexProvider,
+  createProvider: () => builtinProvider("openai-codex"),
   store: CODEX_STORE,
   addPrompt: "Sign in with a DIFFERENT ChatGPT account in the browser. Continue?",
   describeAccount: (account) => describePlan(account as PooledOAuthAccount & CodexAccount),

package/src/domains/subscriptions/providers/hosted.ts

@@ -1,17 +1,16 @@
-import { kimiCodingProvider } from "@earendil-works/pi-ai/providers/kimi-coding";
-import { xaiProvider } from "@earendil-works/pi-ai/providers/xai";
+import { builtinProvider } from "./builtin.ts";
 import { createPooledOAuthAdapter, type PooledOAuthProviderSpec } from "./oauth-pool.ts";
 
 export const KIMI_SPEC: PooledOAuthProviderSpec<"anthropic-messages"> = {
   id: "kimi-coding",
   label: "Kimi",
-  createProvider: kimiCodingProvider,
+  createProvider: () => builtinProvider("kimi-coding"),
 };
 
 export const XAI_SPEC: PooledOAuthProviderSpec<"openai-responses"> = {
   id: "xai",
   label: "Grok",
-  createProvider: xaiProvider,
+  createProvider: () => builtinProvider("xai"),
 };
 
 export const kimiAccounts = createPooledOAuthAdapter(KIMI_SPEC);