@linxiraos/pi-ai 1.1.11 → 1.1.13

package/CHANGELOG.md

@@ -2,18 +2,20 @@
 
 ## [Unreleased]
 
+## [1.1.13] - 2026-09-10
+
+- 上游 v18.1.16 同步:AuthStorage 合并封锁契约——凭据级 `blockedUntilMs` 与 `providerTimed` 时间线合并,先到的更长封锁在短提示到来时保持有效;GitHub Copilot OAuth 拆分公共 GitHub / GHE 双 client-id;Codex WebSocket 传输 abort 携带 cause 链。
+
+## [1.1.12] - 2026-09-10
+
+- 品牌与合并工具链维护版本;无本包用户可见变更。
+
 ## [1.1.11] - 2026-09-08
 
 ### Added
 
 - Muse Code subscription sign-in, credential refresh, inference, and quota reporting in `/usage`, with durable rate-limit backoff so quota refresh recovers instead of repeatedly retrying.
 
-### Fixed
-
-- Reasoning-off requests (e.g. GitHub Copilot `gpt-6-astra`) no longer surface `400 Unsupported value: 'none'`: the reasoning-effort fallback now recognizes `Supported values` phrasing and retries at the lowest allowed effort.
-- Cursor GPT off-tier requests no longer send raw `-none` sibling ids (e.g. `gpt-5.6-sol-none-fast`), which the Run endpoint rejects; they normalize to the base model id with no reasoning parameter.
-- Fixed Codex compaction timeouts triggering prolonged retries instead of advancing to the next compaction method.
-
 ## [1.1.10-omp18.1.12] - 2026-09-06
 
 ### Added

package/dist/types/auth-storage.d.ts

@@ -496,10 +496,40 @@ export { isDefinitiveOAuthFailure } from "./error/auth-classify.js";
  * multi-hour) retry-after when it is sooner. `retryAtMs` is `undefined` when
  * no sibling credentials exist at all, or when the session has no tracked
  * credential to rotate away from.
+ *
+ * `blockedUntilMs` (epoch ms) is the just-blocked credential's own unblock
+ * deadline — the later of the caller's retry-after and any exhausted window
+ * the usage report reveals. Callers that wait the account out (instead of
+ * rotating) must sleep until this, not the error-text hint alone.
+ *
+ * `priorBlockedUntilMs` (epoch ms) is the live block deadline the map already
+ * stored for this credential before this call. The merged `blockedUntilMs`
+ * masks a pre-existing block shorter than this call's own heuristic
+ * fallback (`Math.max` in the mark), so callers that replace that heuristic
+ * with an authoritative report window must consult the prior deadline to
+ * keep honoring the earlier response's provider-stated block.
+ *
+ * `priorBlockedUntilTimed` is `true` when that prior deadline came from
+ * provider-stated timing (a parsed hint or usage-report reset) rather than
+ * another session's heuristic guess — only timed priors may extend a wait
+ * past an authoritative report window. Persisted blocks carry no provenance
+ * and count as untimed: a stale persisted heuristic must not outrank a
+ * fresh complete report (longer persisted deadlines still win through the
+ * merged `blockedUntilMs`).
+ *
+ * `reportResetAtMs` (epoch ms) is present only when the usage report is a
+ * complete authority for the wait: every exhausted window carries a future
+ * reset, so sleeping until the latest one can actually clear the account. A
+ * permanent cap alongside a timed window (or no report at all) leaves it
+ * unset, and the heuristic fallback alone must never authorize a wait.
  */
 export interface UsageLimitMarkResult {
     switched: boolean;
     retryAtMs?: number;
+    blockedUntilMs?: number;
+    priorBlockedUntilMs?: number;
+    priorBlockedUntilTimed?: boolean;
+    reportResetAtMs?: number;
 }
 export type ModelUsageHealthState = "healthy" | "reserve" | "depleted" | "unknown";
 export interface ModelUsageAccountHealth {
@@ -1013,6 +1043,12 @@ export declare class AuthStorage {
      */
     markUsageLimitReached(provider: string, sessionId: string | undefined, options?: {
         retryAfterMs?: number;
+        /**
+         * Whether `retryAfterMs` came from provider-stated timing (a parsed
+         * retry hint) rather than a heuristic/default guess. A report reset
+         * extending the block counts as provider timing regardless.
+         */
+        providerTimed?: boolean;
         baseUrl?: string;
         modelId?: string;
         apiKey?: string;

package/dist/types/error/flags.d.ts

@@ -87,6 +87,15 @@ export declare function isFastModeUnsupported(error: unknown): boolean;
  * fail identically) nor surface as an auth failure.
  */
 export declare function isClinePassSurfaceGateMessage(errorMessage: string | undefined): boolean;
+/**
+ * GitHub Copilot 403s are plan/model-policy/org denials against a valid token —
+ * never a revoked credential (those arrive as 401). Wiping stored credentials
+ * on them hides the whole provider from `/model` and forces a pointless
+ * re-login, so credential-lifetime decisions must exempt them even though
+ * they still classify as `Flag.AuthFailed` (issue #11275). Mirrors the 403
+ * contract in `rewriteCopilotError` (`utils/http-inspector.ts`).
+ */
+export declare function isGitHubCopilotPolicyDenial(provider: string | undefined, status: number | undefined, errorMessage: string | undefined): boolean;
 export declare function classifyMessage(message: {
     api?: Api;
     provider?: string;

package/dist/types/providers/openai-codex-responses.d.ts

@@ -223,7 +223,7 @@ type CodexToolPayload = {
 /** @internal Exported for tests. */
 export declare function convertOpenAICodexResponsesTools(tools: Tool[], model: Model<"openai-codex-responses">): CodexToolPayload[];
 export declare class CodexWebSocketTransportError extends Error {
-    constructor(detail: string);
+    constructor(detail: string, options?: ErrorOptions);
 }
 declare class CodexProviderStreamError extends Error {
     readonly retryable: boolean;

package/dist/types/registry/oauth/github-copilot.d.ts

@@ -15,7 +15,7 @@ type GitHubCopilotLoginOptions = {
 };
 /**
  * Refresh GitHub Copilot token.
- * GitHub OAuth tokens from both the former OpenCode app and the Copilot CLI app
+ * GitHub OAuth tokens from both the OpenCode app and the Copilot CLI app
  * remain directly usable, so existing logins need no token exchange or migration.
  */
 export declare function refreshGitHubCopilotToken(refreshToken: string, enterpriseDomain?: string, apiEndpoint?: string): OAuthCredentials;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@linxiraos/pi-ai",
-	"version": "1.1.11",
+	"version": "1.1.13",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -116,16 +116,19 @@
 		"./*.js": "./src/*.ts"
 	},
 	"scripts": {
-		"check": "tsgo -p tsconfig.json --noEmit",
+		"check": "oxlint . && oxfmt --check --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts' && bun run check:types",
 		"check:types": "tsgo -p tsconfig.json --noEmit",
-		"test": "bun test --parallel"
+		"lint": "oxlint .",
+		"test": "bun test --parallel",
+		"fix": "oxlint --fix --fix-suggestions . && bun run fmt",
+		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@linxiraos/pi-omptype": "1.1.11",
-		"@linxiraos/pi-catalog": "1.1.11",
-		"@linxiraos/pi-natives": "1.1.11",
-		"@linxiraos/pi-utils": "1.1.11",
-		"@linxiraos/pi-wire": "1.1.11"
+		"@linxiraos/pi-omptype": "1.1.13",
+		"@linxiraos/pi-catalog": "1.1.13",
+		"@linxiraos/pi-natives": "1.1.13",
+		"@linxiraos/pi-utils": "1.1.13",
+		"@linxiraos/pi-wire": "1.1.13"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/auth-storage.ts

@@ -757,10 +757,40 @@ export { isDefinitiveOAuthFailure } from "./error/auth-classify";
  * multi-hour) retry-after when it is sooner. `retryAtMs` is `undefined` when
  * no sibling credentials exist at all, or when the session has no tracked
  * credential to rotate away from.
+ *
+ * `blockedUntilMs` (epoch ms) is the just-blocked credential's own unblock
+ * deadline — the later of the caller's retry-after and any exhausted window
+ * the usage report reveals. Callers that wait the account out (instead of
+ * rotating) must sleep until this, not the error-text hint alone.
+ *
+ * `priorBlockedUntilMs` (epoch ms) is the live block deadline the map already
+ * stored for this credential before this call. The merged `blockedUntilMs`
+ * masks a pre-existing block shorter than this call's own heuristic
+ * fallback (`Math.max` in the mark), so callers that replace that heuristic
+ * with an authoritative report window must consult the prior deadline to
+ * keep honoring the earlier response's provider-stated block.
+ *
+ * `priorBlockedUntilTimed` is `true` when that prior deadline came from
+ * provider-stated timing (a parsed hint or usage-report reset) rather than
+ * another session's heuristic guess — only timed priors may extend a wait
+ * past an authoritative report window. Persisted blocks carry no provenance
+ * and count as untimed: a stale persisted heuristic must not outrank a
+ * fresh complete report (longer persisted deadlines still win through the
+ * merged `blockedUntilMs`).
+ *
+ * `reportResetAtMs` (epoch ms) is present only when the usage report is a
+ * complete authority for the wait: every exhausted window carries a future
+ * reset, so sleeping until the latest one can actually clear the account. A
+ * permanent cap alongside a timed window (or no report at all) leaves it
+ * unset, and the heuristic fallback alone must never authorize a wait.
  */
 export interface UsageLimitMarkResult {
 	switched: boolean;
 	retryAtMs?: number;
+	blockedUntilMs?: number;
+	priorBlockedUntilMs?: number;
+	priorBlockedUntilTimed?: boolean;
+	reportResetAtMs?: number;
 }
 
 export type ModelUsageHealthState = "healthy" | "reserve" | "depleted" | "unknown";
@@ -1327,6 +1357,14 @@ export class AuthStorage {
 	#oauthBearerFingerprints: Map<string, Map<number, string[]>> = new Map();
 	/** Maps provider:type -> credentialIndex -> blockedUntilMs for temporary backoff. */
 	#credentialBackoff: Map<string, Map<number, number>> = new Map();
+	/**
+	 * Provenance of each in-memory block: `true` when the deadline came from
+	 * provider-stated timing (a parsed retry hint or a usage-report reset),
+	 * `false` when it is a heuristic/default guess. Mirrors
+	 * {@link AuthStorage.#credentialBackoff} longest-wins semantics, tracking
+	 * the flag of whichever deadline currently wins.
+	 */
+	#credentialBackoffProviderTimed: Map<string, Map<number, boolean>> = new Map();
 	/** Earliest time a freshly-set in-memory block may be cleared by live usage reconciliation. */
 	#credentialBackoffProbeAfter: Map<string, Map<number, number>> = new Map();
 	/**
@@ -1802,6 +1840,10 @@ export class AuthStorage {
 			if (backoffMap.size === 0) {
 				this.#credentialBackoff.delete(backoffKey);
 			}
+			this.#credentialBackoffProviderTimed.get(backoffKey)?.delete(credentialIndex);
+			if (this.#credentialBackoffProviderTimed.get(backoffKey)?.size === 0) {
+				this.#credentialBackoffProviderTimed.delete(backoffKey);
+			}
 			const probeAfterMap = this.#credentialBackoffProbeAfter.get(backoffKey);
 			probeAfterMap?.delete(credentialIndex);
 			if (probeAfterMap?.size === 0) this.#credentialBackoffProbeAfter.delete(backoffKey);
@@ -1908,13 +1950,48 @@ export class AuthStorage {
 		return this.#getCredentialBlockedUntil(provider, providerKey, credentialIndex, blockScope) !== undefined;
 	}
 
-	/** Marks a credential as blocked until the specified time. */
+	/**
+	 * Whether the in-memory block currently sitting at exactly `deadline` for
+	 * this credential was written with provider-stated timing. Mirrors the
+	 * scope enumeration of {@link AuthStorage.#getCredentialBlockedUntil}.
+	 * A deadline with no matching in-memory entry came from the persisted
+	 * store, which carries no provenance — a stale persisted heuristic guess
+	 * (pre-restart hintless response) must not outrank a fresh complete usage
+	 * report, so persisted-only deadlines count as untimed. Persisted
+	 * deadlines longer than this call's own request still win through the
+	 * merged `blockedUntilMs` comparison, which needs no provenance.
+	 */
+	#isProviderTimedBlock(
+		providerKey: string,
+		blockScopeOrScopes: string | readonly string[] | undefined,
+		credentialIndex: number,
+		deadline: number,
+	): boolean {
+		const scopes = (
+			typeof blockScopeOrScopes === "string" ? [blockScopeOrScopes] : (blockScopeOrScopes ?? [])
+		).filter(scope => scope.length > 0);
+		for (const key of [providerKey, ...scopes.map(scope => this.#toScopedBackoffKey(providerKey, scope))]) {
+			const entry = this.#credentialBackoff.get(key)?.get(credentialIndex);
+			if (entry === undefined || entry !== deadline) continue;
+			if (this.#credentialBackoffProviderTimed.get(key)?.get(credentialIndex) === true) return true;
+		}
+		return false;
+	}
+
+	/**
+	 * Marks a credential as blocked until the specified time. `providerTimed`
+	 * records whether the requested deadline comes from provider-stated
+	 * timing (a parsed retry hint or a usage-report reset) rather than a
+	 * heuristic/default guess; the stored block keeps the provenance of
+	 * whichever deadline wins the longest-wins merge.
+	 */
 	#markCredentialBlocked(
 		provider: string,
 		providerKey: string,
 		credentialIndex: number,
 		blockedUntilMs: number,
 		blockScope: string | undefined = undefined,
+		providerTimed = false,
 	): void {
 		const backoffKey = this.#toScopedBackoffKey(providerKey, blockScope);
 		const backoffMap = this.#credentialBackoff.get(backoffKey) ?? new Map<number, number>();
@@ -1922,6 +1999,16 @@ export class AuthStorage {
 		const nextBlockedUntil = Math.max(existing, blockedUntilMs);
 		backoffMap.set(credentialIndex, nextBlockedUntil);
 		this.#credentialBackoff.set(backoffKey, backoffMap);
+		const timedMap = this.#credentialBackoffProviderTimed.get(backoffKey) ?? new Map<number, boolean>();
+		const existingTimed = timedMap.get(credentialIndex) ?? false;
+		const nextTimed =
+			blockedUntilMs > existing
+				? providerTimed
+				: blockedUntilMs === existing
+					? existingTimed || providerTimed
+					: existingTimed;
+		timedMap.set(credentialIndex, nextTimed);
+		this.#credentialBackoffProviderTimed.set(backoffKey, timedMap);
 		const probeAfterMap = this.#credentialBackoffProbeAfter.get(backoffKey) ?? new Map<number, number>();
 		probeAfterMap.set(credentialIndex, Math.min(nextBlockedUntil, Date.now() + USAGE_REPORT_TTL_MS));
 		this.#credentialBackoffProbeAfter.set(backoffKey, probeAfterMap);
@@ -2207,6 +2294,7 @@ export class AuthStorage {
 					selection.index,
 					blockedUntil,
 					args.blockScope,
+					resetAtMs !== undefined,
 				);
 				blocked = true;
 			}
@@ -2312,6 +2400,11 @@ export class AuthStorage {
 				this.#credentialBackoff.delete(key);
 			}
 		}
+		for (const key of this.#credentialBackoffProviderTimed.keys()) {
+			if (key.startsWith(`${provider}:`)) {
+				this.#credentialBackoffProviderTimed.delete(key);
+			}
+		}
 	}
 
 	/** Updates credential at index in-place (used for OAuth token refresh) */
@@ -4603,11 +4696,43 @@ export class AuthStorage {
 		targetIndex: number,
 		blockedUntil: number,
 		routing: CredentialBlockRouting,
+		providerTimed: boolean,
 	): UsageLimitMarkResult {
+		// Snapshot the live block deadline BEFORE this call's mark: the merged
+		// value below masks a pre-existing block shorter than this call's own
+		// request (longest-wins), and recovery that replaces this call's
+		// heuristic fallback with an authoritative report window still needs
+		// the prior response's provider-stated deadline.
+		const priorBlockedUntilMs =
+			targetIndex >= 0
+				? this.#getCredentialBlockedUntil(provider, routing.providerKey, targetIndex, routing.blockScope)
+				: undefined;
+		const priorBlockedUntilTimed =
+			targetIndex >= 0 && priorBlockedUntilMs !== undefined
+				? this.#isProviderTimedBlock(routing.providerKey, routing.blockScope, targetIndex, priorBlockedUntilMs)
+				: false;
 		if (targetIndex >= 0) {
-			this.#markCredentialBlocked(provider, routing.providerKey, targetIndex, blockedUntil, routing.blockScope);
+			this.#markCredentialBlocked(
+				provider,
+				routing.providerKey,
+				targetIndex,
+				blockedUntil,
+				routing.blockScope,
+				providerTimed,
+			);
 		}
 
+		// Report the merged deadline the block map actually stores, not this
+		// call's input: a sibling session may have established a longer block
+		// for the same credential (out-of-order usage-limit responses), and
+		// #markCredentialBlocked keeps the longest. Waiting on the shorter
+		// value would retry before the credential is actually usable.
+		const mergedBlockedUntil =
+			targetIndex >= 0
+				? (this.#getCredentialBlockedUntil(provider, routing.providerKey, targetIndex, routing.blockScope) ??
+					blockedUntil)
+				: blockedUntil;
+
 		const remainingCredentials = this.#getCredentialsForProvider(provider)
 			.map((credential, index) => ({ credential, index }))
 			.filter(
@@ -4625,10 +4750,22 @@ export class AuthStorage {
 				candidate.index,
 				routing.siblingBlockScopes,
 			);
-			if (candidateBlockedUntil === undefined) return { switched: true };
+			if (candidateBlockedUntil === undefined)
+				return {
+					switched: true,
+					blockedUntilMs: mergedBlockedUntil,
+					priorBlockedUntilMs,
+					priorBlockedUntilTimed,
+				};
 			if (retryAtMs === undefined || candidateBlockedUntil < retryAtMs) retryAtMs = candidateBlockedUntil;
 		}
-		return { switched: false, retryAtMs };
+		return {
+			switched: false,
+			retryAtMs,
+			blockedUntilMs: mergedBlockedUntil,
+			priorBlockedUntilMs,
+			priorBlockedUntilTimed,
+		};
 	}
 
 	/**
@@ -4643,6 +4780,12 @@ export class AuthStorage {
 		sessionId: string | undefined,
 		options?: {
 			retryAfterMs?: number;
+			/**
+			 * Whether `retryAfterMs` came from provider-stated timing (a parsed
+			 * retry hint) rather than a heuristic/default guess. A report reset
+			 * extending the block counts as provider timing regardless.
+			 */
+			providerTimed?: boolean;
 			baseUrl?: string;
 			modelId?: string;
 			apiKey?: string;
@@ -4676,7 +4819,17 @@ export class AuthStorage {
 		const routing = this.#credentialBlockRouting(provider, credentialType, options?.modelId);
 		const now = Date.now();
 		let blockedUntil = now + (options?.retryAfterMs ?? AuthStorage.#defaultBackoffMs);
-
+		// Heuristic/default fallbacks are guesses; provider-stated hints and
+		// report-derived extensions are timed.
+		let providerTimed = options?.providerTimed === true;
+
+		// Epoch ms of the usage-report-derived reset. Authoritative only when
+		// EVERY exhausted window carries a future reset: a permanent cap
+		// alongside a timed window must not authorize a wait that can never
+		// clear it, and a bare heuristic must not sleep alone. Set
+		// independently of whether the report extends the hint so a shorter
+		// authoritative window still counts as provider timing.
+		let reportResetAtMs: number | undefined;
 		if (target && routing.strategy) {
 			const report = await raceUsageWithSignal(
 				this.#getUsageReport(provider, target.credential, options),
@@ -4688,6 +4841,15 @@ export class AuthStorage {
 					const resetAtMs = this.#getUsageResetAtMs(scopedLimits, Date.now());
 					if (resetAtMs && resetAtMs > blockedUntil) {
 						blockedUntil = resetAtMs;
+						providerTimed = true;
+					}
+					const nowMs = Date.now();
+					const exhaustedLimits = scopedLimits.filter(limit => this.#isUsageLimitExhausted(limit));
+					const futureResets = exhaustedLimits
+						.map(limit => this.#resolveWindowResetAt(limit.window))
+						.filter((reset): reset is number => reset !== undefined && reset > nowMs);
+					if (exhaustedLimits.length > 0 && futureResets.length === exhaustedLimits.length) {
+						reportResetAtMs = Math.max(...futureResets);
 					}
 				}
 			}
@@ -4699,7 +4861,15 @@ export class AuthStorage {
 		const targetIndex = this.#getStoredCredentials(provider).findIndex(
 			entry => entry.id === targetCredentialId && entry.credential.type === credentialType,
 		);
-		return this.#blockCredentialForRotation(provider, credentialType, targetIndex, blockedUntil, routing);
+		const rotation = this.#blockCredentialForRotation(
+			provider,
+			credentialType,
+			targetIndex,
+			blockedUntil,
+			routing,
+			providerTimed,
+		);
+		return reportResetAtMs === undefined ? rotation : { ...rotation, reportResetAtMs };
 	}
 
 	#resolveWindowResetAt(window: UsageLimit["window"]): number | undefined {
@@ -4909,6 +5079,7 @@ export class AuthStorage {
 					selection.index,
 					blockedUntil,
 					args.blockScope,
+					resetAtMs !== undefined,
 				);
 				blocked = true;
 			}
@@ -5566,6 +5737,7 @@ export class AuthStorage {
 						selection.index,
 						resetAtMs ?? Date.now() + AuthStorage.#defaultBackoffMs,
 						blockScope,
+						resetAtMs !== undefined,
 					);
 					return undefined;
 				}
@@ -5646,6 +5818,7 @@ export class AuthStorage {
 							selection.index,
 							resetAtMs ?? Date.now() + AuthStorage.#defaultBackoffMs,
 							blockScope,
+							resetAtMs !== undefined,
 						);
 						return undefined;
 					}
@@ -6339,6 +6512,11 @@ export class AuthStorage {
 			backoffMap.delete(index);
 			if (backoffMap.size === 0) this.#credentialBackoff.delete(key);
 		}
+		for (const [key, timedMap] of this.#credentialBackoffProviderTimed) {
+			if (key !== providerKey && !key.startsWith(scopedPrefix)) continue;
+			timedMap.delete(index);
+			if (timedMap.size === 0) this.#credentialBackoffProviderTimed.delete(key);
+		}
 		for (const [key, probeAfterMap] of this.#credentialBackoffProbeAfter) {
 			if (key !== providerKey && !key.startsWith(scopedPrefix)) continue;
 			probeAfterMap.delete(index);
@@ -6400,6 +6578,9 @@ export class AuthStorage {
 		const backoffMap = this.#credentialBackoff.get(key);
 		backoffMap?.delete(credentialIndex);
 		if (backoffMap?.size === 0) this.#credentialBackoff.delete(key);
+		const timedMap = this.#credentialBackoffProviderTimed.get(key);
+		timedMap?.delete(credentialIndex);
+		if (timedMap?.size === 0) this.#credentialBackoffProviderTimed.delete(key);
 		const probeAfterMap = this.#credentialBackoffProbeAfter.get(key);
 		probeAfterMap?.delete(credentialIndex);
 		if (probeAfterMap?.size === 0) this.#credentialBackoffProbeAfter.delete(key);
@@ -6691,6 +6872,7 @@ export class AuthStorage {
 			return (
 				await this.markUsageLimitReached(provider, sessionId, {
 					retryAfterMs,
+					providerTimed: retryAfterMs !== undefined,
 					modelId: options?.modelId,
 					apiKey: options?.apiKey,
 					credentialId: options?.credentialId,
@@ -6730,6 +6912,7 @@ export class AuthStorage {
 				sessionCredential.index,
 				Date.now() + AuthStorage.#defaultBackoffMs,
 				routing,
+				false,
 			).switched;
 		}
 

package/src/dialect/deepseek.ts

@@ -608,7 +608,7 @@ function renderThinking(text: string): string {
 function renderTranscript(messages: readonly Message[], options: DialectRenderOptions = {}): string {
 	if (messages.length === 0) return "";
 	let out = DEEPSEEK_BOS;
-	for (let i = 0; i < messages.length; ) {
+	for (let i = 0; i < messages.length;) {
 		const message = messages[i]!;
 		if (message.role === "assistant") {
 			const parts = assistantTranscriptParts(message);

package/src/dialect/gemini.ts

@@ -533,7 +533,7 @@ function renderTranscript(messages: readonly Message[], options: DialectRenderOp
 	if (messages.length === 0) return "";
 	let out = "<bos>";
 	let pendingUserPreamble = "";
-	for (let i = 0; i < messages.length; ) {
+	for (let i = 0; i < messages.length;) {
 		const message = messages[i]!;
 		if (message.role === "developer") {
 			pendingUserPreamble = joinUserBodies(pendingUserPreamble, messageContentText(message.content));

package/src/dialect/gemma.ts

@@ -320,7 +320,7 @@ function renderThinking(text: string): string {
 function renderTranscript(messages: readonly Message[], options: DialectRenderOptions = {}): string {
 	if (messages.length === 0) return "";
 	let out = "<bos>";
-	for (let i = 0; i < messages.length; ) {
+	for (let i = 0; i < messages.length;) {
 		const message = messages[i]!;
 		if (message.role === "assistant") {
 			const parts = assistantTranscriptParts(message);

package/src/dialect/glm.ts

@@ -543,7 +543,7 @@ function renderThinking(text: string): string {
 function renderTranscript(messages: readonly Message[], options: DialectRenderOptions = {}): string {
 	if (messages.length === 0) return "";
 	let out = "[gMASK]<sop>";
-	for (let i = 0; i < messages.length; ) {
+	for (let i = 0; i < messages.length;) {
 		const message = messages[i]!;
 		if (message.role === "assistant") {
 			const parts = assistantTranscriptParts(message);

package/src/dialect/harmony.ts

@@ -298,7 +298,7 @@ function renderThinking(text: string): string {
 
 function renderTranscript(messages: readonly Message[], options: DialectRenderOptions = {}): string {
 	let out = "";
-	for (let i = 0; i < messages.length; ) {
+	for (let i = 0; i < messages.length;) {
 		const message = messages[i]!;
 		if (message.role === "assistant") {
 			const parts = assistantTranscriptParts(message);

package/src/dialect/kimi.ts

@@ -291,7 +291,7 @@ function renderThinking(text: string): string {
 
 function renderTranscript(messages: readonly Message[], _options?: DialectRenderOptions): string {
 	let out = "";
-	for (let i = 0; i < messages.length; ) {
+	for (let i = 0; i < messages.length;) {
 		const message = messages[i]!;
 		if (message.role === "assistant") {
 			const parts = assistantTranscriptParts(message);

package/src/dialect/rendering.ts

@@ -111,7 +111,7 @@ export function renderChatMlTranscript(
 ): string {
 	if (messages.length === 0) return "";
 	let out = config.bos ?? "";
-	for (let i = 0; i < messages.length; ) {
+	for (let i = 0; i < messages.length;) {
 		const message = messages[i]!;
 		if (message.role === "assistant") {
 			const parts = assistantTranscriptParts(message);
@@ -141,7 +141,7 @@ export function renderLegacyTextTranscript(
 	config: LegacyTextTranscriptConfig,
 ): string {
 	let out = "";
-	for (let i = 0; i < messages.length; ) {
+	for (let i = 0; i < messages.length;) {
 		const message = messages[i]!;
 		if (message.role === "assistant") {
 			const parts = assistantTranscriptParts(message);

package/src/dialect/thinking.ts

@@ -309,7 +309,7 @@ function trailingLineIndent(text: string, prior: number): number {
  * extend it into a non-fence line).
  */
 function findFenceCloseEnd(buffer: string, ticks: number, final: boolean): number {
-	for (let start = 0; start <= buffer.length; ) {
+	for (let start = 0; start <= buffer.length;) {
 		const nl = buffer.indexOf("\n", start);
 		const terminated = nl !== -1;
 		const line = buffer.slice(start, terminated ? nl : buffer.length).trim();

package/src/error/flags.ts

@@ -157,7 +157,7 @@ const TRANSIENT_ENVELOPE_PATTERN = /anthropic stream envelope error:/i;
 const TRANSIENT_ENVELOPE_TRUNCATION_PATTERN = /before message_(?:start|stop)/i;
 export const STREAM_READ_ERROR_PATTERN = /stream[_ -]?read[_ -]?error/i;
 export const TRANSIENT_TRANSPORT_PATTERN =
-	/\b(?:no[_ -]?capacity|(?:high|peak)[ _-]?demand|(?:at|over|insufficient)[ _-]?capacity|capacity[ _-]?(?:exceeded|exhausted)|peak[ _-]?load)\b|overloaded|provider.?returned.?error|rate.?limit|too many requests|\b(?:429|500|502|503|504)\b|service.?unavailable|server.?error|internal.?error|retry your request|network.?error|connection.?error|connection.?refused|unable.?to.?connect\.\s*is the computer able to access the url\?|other side closed|fetch failed|upstream.?connect|upstream.?request.?failed|reset before headers|socket hang up|timed? out|timeout|terminated|retry delay|stream stall|no error details in response|HTTP2(?:StreamReset|RefusedStream|EnhanceYourCalm)|nghttp2_(?:internal_error|refused_stream)|stream closed with error code nghttp2_(?:internal_error|refused_stream)|malformed.?function.?call/i;
+	/\b(?:no[_ -]?capacity|(?:high|peak)[ _-]?demand|(?:at|over|insufficient)[ _-]?capacity|capacity[ _-]?(?:exceeded|exhausted)|peak[ _-]?load)\b|overloaded|provider.?returned.?error|rate.?limit|too many requests|auth-gateway\s+5\d{2}(?=[:\s]|$)|\b(?:429|500|502|503|504)\b|service.?unavailable|server.?error|internal.?error|retry your request|network.?error|connection.?error|connection.?refused|unable.?to.?connect\.\s*is the computer able to access the url\?|other side closed|fetch failed|upstream.?connect|upstream.?request.?failed|reset before headers|socket hang up|timed? out|timeout|terminated|retry delay|stream stall|no error details in response|HTTP2(?:StreamReset|RefusedStream|EnhanceYourCalm)|nghttp2_(?:internal_error|refused_stream)|stream closed with error code nghttp2_(?:internal_error|refused_stream)|malformed.?function.?call/i;
 const AUTH_FAILURE_PATTERN =
 	/\b(?:401|403|unauthorized|forbidden|authentication|auth[_ ]?unavailable|no auth available|(?:invalid|no)[_ ]?api[_ ]?key)\b/i;
 const MALFORMED_FUNCTION_CALL_PATTERN = /\bmalformed.?function.?call\b/i;
@@ -694,6 +694,26 @@ export function isClinePassSurfaceGateMessage(errorMessage: string | undefined):
 	return errorMessage !== undefined && CLINE_PASS_SURFACE_GATE_PATTERN.test(errorMessage);
 }
 
+const GITHUB_COPILOT_POLICY_DENIAL_PATTERN = /GitHub Copilot access denied \(HTTP 403\)/;
+
+/**
+ * GitHub Copilot 403s are plan/model-policy/org denials against a valid token —
+ * never a revoked credential (those arrive as 401). Wiping stored credentials
+ * on them hides the whole provider from `/model` and forces a pointless
+ * re-login, so credential-lifetime decisions must exempt them even though
+ * they still classify as `Flag.AuthFailed` (issue #11275). Mirrors the 403
+ * contract in `rewriteCopilotError` (`utils/http-inspector.ts`).
+ */
+export function isGitHubCopilotPolicyDenial(
+	provider: string | undefined,
+	status: number | undefined,
+	errorMessage: string | undefined,
+): boolean {
+	if (provider !== "github-copilot") return false;
+	if (status === 403) return true;
+	return errorMessage !== undefined && GITHUB_COPILOT_POLICY_DENIAL_PATTERN.test(errorMessage);
+}
+
 export function classifyMessage(message: {
 	api?: Api;
 	provider?: string;

package/src/providers/anthropic.ts

@@ -5005,12 +5005,10 @@ function buildAnthropicBaseToolInputSchema(tool: Tool): Record<string, unknown>
 }
 
 function buildAnthropicToolSchemaPlans(tools: Tool[], disableStrictTools = false): AnthropicToolSchemaPlan[] {
-	const plans = tools.map(
-		(tool): AnthropicToolSchemaPlan => ({
-			inputSchema: buildAnthropicBaseToolInputSchema(tool) as AnthropicToolInputSchema,
-			strict: false,
-		}),
-	);
+	const plans = tools.map((tool): AnthropicToolSchemaPlan => ({
+		inputSchema: buildAnthropicBaseToolInputSchema(tool) as AnthropicToolInputSchema,
+		strict: false,
+	}));
 	if (NO_STRICT || disableStrictTools) return plans;
 
 	const candidateIndexes = tools.flatMap((tool, index) => {

package/src/providers/gitlab-duo-workflow.ts

@@ -915,12 +915,12 @@ function markGitLabDuoWorkflowSettingsEnsured(apiKey: string, baseUrl: string, c
 function hasGitLabDuoWorkflowExplicitNamespace(options: GitLabDuoWorkflowOptions): boolean {
 	return Boolean(
 		nonEmptyString(options.rootNamespaceId) ??
-			nonEmptyString(options.namespaceId) ??
-			nonEmptyString(Bun.env.GITLAB_DUO_NAMESPACE_ID) ??
-			nonEmptyString(options.projectId) ??
-			nonEmptyString(options.projectPath) ??
-			nonEmptyString(Bun.env.GITLAB_DUO_PROJECT_ID) ??
-			nonEmptyString(Bun.env.GITLAB_DUO_PROJECT_PATH),
+		nonEmptyString(options.namespaceId) ??
+		nonEmptyString(Bun.env.GITLAB_DUO_NAMESPACE_ID) ??
+		nonEmptyString(options.projectId) ??
+		nonEmptyString(options.projectPath) ??
+		nonEmptyString(Bun.env.GITLAB_DUO_PROJECT_ID) ??
+		nonEmptyString(Bun.env.GITLAB_DUO_PROJECT_PATH),
 	);
 }
 
@@ -1846,12 +1846,10 @@ function defaultGitLabDuoWorkflowWebSocketFactory(
 	url: string,
 	options: GitLabDuoWorkflowWebSocketFactoryOptions,
 ): GitLabDuoWorkflowWebSocketLike {
-	return new (
-		WebSocket as unknown as new (
-			url: string,
-			options: Bun.WebSocketOptions,
-		) => GitLabDuoWorkflowWebSocketLike
-	)(url, { headers: options.headers });
+	return new (WebSocket as unknown as new (
+		url: string,
+		options: Bun.WebSocketOptions,
+	) => GitLabDuoWorkflowWebSocketLike)(url, { headers: options.headers });
 }
 
 export function runGitLabDuoWorkflowSocket(

package/src/providers/openai-codex-responses.ts

@@ -2147,6 +2147,17 @@ class CodexStreamProcessor {
 					firstTokenTime = this.#handleStreamEvent(rawEvent, firstTokenTime);
 					if (this.runtime.sawTerminalEvent) break;
 				}
+				if (!this.runtime.sawTerminalEvent) {
+					CODEX_DEBUG &&
+						logger.debug("[codex] codex stream ended unexpectedly", {
+							transport: this.runtime.transport,
+							terminalEventSeen: false,
+							unexpectedStreamEnd: true,
+							sentTurnStateHeader: Boolean(this.requestContext.turnState.value),
+							sentModelsEtagHeader: Boolean(this.requestContext.websocketState?.modelsEtag),
+						});
+					throw new CodexProviderStreamError("Codex stream ended before terminal completion event", true);
+				}
 				return { firstTokenTime };
 			} catch (error) {
 				const recovered = await this.#recoverStreamError(error);
@@ -2952,21 +2963,6 @@ class CodexStreamProcessor {
 		if (this.options?.signal?.aborted) {
 			throw new AIError.AbortError();
 		}
-		if (!this.runtime.sawTerminalEvent) {
-			if (this.requestContext.websocketState) {
-				resetCodexWebSocketAppendState(this.requestContext.websocketState);
-				this.requestContext.websocketState.modelsEtag = undefined;
-			}
-			CODEX_DEBUG &&
-				logger.debug("[codex] codex stream ended unexpectedly", {
-					transport: this.runtime.transport,
-					terminalEventSeen: this.runtime.sawTerminalEvent,
-					unexpectedStreamEnd: true,
-					sentTurnStateHeader: Boolean(this.requestContext.turnState.value),
-					sentModelsEtagHeader: Boolean(this.requestContext.websocketState?.modelsEtag),
-				});
-			throw new CodexProviderStreamError("Codex stream ended before terminal completion event", false);
-		}
 		if (output.stopReason === "aborted" || output.stopReason === "error") {
 			throw new CodexProviderStreamError("Codex response failed", false);
 		}
@@ -3734,12 +3730,12 @@ class CodexWebSocketConnection {
 			if (signal) signal.removeEventListener("abort", onAbort);
 		};
 		const onAbort = () => {
-			this.close("aborted");
 			if (!settled) {
 				settled = true;
 				clearPending();
-				reject(new CodexWebSocketTransportError(`request was aborted`));
+				reject(new CodexWebSocketTransportError(`request was aborted`, { cause: signal?.reason }));
 			}
+			this.close("aborted");
 		};
 		if (signal) {
 			if (signal.aborted) {
@@ -3844,7 +3840,7 @@ class CodexWebSocketConnection {
 			throw new CodexWebSocketTransportError(`websocket request already in progress`);
 		}
 		if (signal?.aborted) {
-			throw new CodexWebSocketTransportError(`request was aborted`);
+			throw new CodexWebSocketTransportError(`request was aborted`, { cause: signal.reason });
 		}
 		this.#activeRequest = true;
 		this.#streamObserver = onSseEvent;
@@ -3860,8 +3856,9 @@ class CodexWebSocketConnection {
 		// the death signal instead of writing into a dead socket.
 		this.#dropStaleFrames();
 		const onAbort = () => {
+			this.#push(new CodexWebSocketTransportError(`request was aborted`, { cause: signal?.reason }));
+			// Closing can synchronously enqueue a generic onclose error.
 			this.close("aborted");
-			this.#push(new CodexWebSocketTransportError(`request was aborted`));
 		};
 		if (signal) signal.addEventListener("abort", onAbort, { once: true });
 
@@ -3882,8 +3879,15 @@ class CodexWebSocketConnection {
 			const requestPayload = JSON.stringify(request);
 			notifyCodexWebSocketOutbound(onSseEvent, request, requestPayload);
 			// Re-check liveness: the debug-session await above can outlive the socket.
+			// Preserve the abort cause: onAbort already queued a caused error, but this
+			// throw would otherwise mask it before #nextMessage() drains the queue.
 			const socket = this.#socket;
 			if (!socket || socket.readyState !== WebSocket.OPEN) {
+				if (signal?.aborted) {
+					throw new CodexWebSocketTransportError(`websocket connection is unavailable`, {
+						cause: signal.reason,
+					});
+				}
 				throw new CodexWebSocketTransportError(`websocket connection is unavailable`);
 			}
 			try {
@@ -4752,8 +4756,8 @@ export function convertOpenAICodexResponsesTools(
 }
 
 export class CodexWebSocketTransportError extends Error {
-	constructor(detail: string) {
-		super(`${CODEX_WEBSOCKET_TRANSPORT_ERROR_PREFIX}: ${detail}`);
+	constructor(detail: string, options?: ErrorOptions) {
+		super(`${CODEX_WEBSOCKET_TRANSPORT_ERROR_PREFIX}: ${detail}`, options);
 		this.name = "CodexWebSocketTransportError";
 	}
 }

package/src/providers/openai-responses.ts

@@ -199,9 +199,7 @@ function isRetryableOpenAIResponsesStreamFailure(error: unknown): boolean {
 }
 
 interface OpenAIResponsesProviderSessionState
-	extends ProviderSessionState,
-		OpenAIStrictToolsState,
-		OpenAIReasoningEffortFallbackState {
+	extends ProviderSessionState, OpenAIStrictToolsState, OpenAIReasoningEffortFallbackState {
 	nativeHistoryReplayWarmed: boolean;
 	/** Stateful `previous_response_id` chain baselines, keyed by baseUrl/model/session. */
 	chains: Map<string, OpenAIResponsesChainState>;

package/src/registry/oauth/github-copilot.ts

@@ -1,5 +1,15 @@
 /**
- * GitHub Copilot OAuth flow using the official Copilot CLI app.
+ * GitHub Copilot OAuth flow (OpenCode OAuth app, minimal read:user grant).
+ *
+ * The device flow intentionally uses the OpenCode app identity rather than
+ * the official Copilot CLI app: GitHub renders each app's existing per-user
+ * grant (Existing access) on the consent page, and Enterprise orgs that
+ * restrict OAuth apps block the CLI app's broad historic grant
+ * (repo/gist/codespace) no matter what scope this request asks for
+ * (issue #11275). API request identity still mimics the Copilot CLI via
+ * COPILOT_API_HEADERS. Enterprise domains keep the GitHub-owned Copilot CLI
+ * client: private instances run their own OAuth registry and reject the
+ * github.com-registered OpenCode client.
  */
 import { scheduler } from "node:timers/promises";
 import { getBundledModels } from "@linxiraos/pi-catalog/models";
@@ -15,8 +25,19 @@ import * as AIError from "../../error";
 import type { FetchImpl } from "../../types";
 import type { OAuthController, OAuthCredentials } from "./types";
 
-const CLIENT_ID = "Ov23ctDVkRmgkPke0Mmm";
-const OAUTH_SCOPE = "read:user,read:org,repo,gist,codespace";
+const OPENCODE_CLIENT_ID = "Ov23li8tweQw6odWQebz";
+const COPILOT_CLI_CLIENT_ID = "Ov23ctDVkRmgkPke0Mmm";
+
+/**
+ * OAuth client for the device flow. Public github.com uses the minimal-grant
+ * OpenCode app (narrow consent, issue #11275); private GitHub Enterprise
+ * instances run their own OAuth registry, which does not know that github.com
+ * registration, so they keep the GitHub-owned Copilot CLI client.
+ */
+function resolveOAuthClientId(domain: string): string {
+	return isPublicGitHubHost(domain) ? OPENCODE_CLIENT_ID : COPILOT_CLI_CLIENT_ID;
+}
+const OAUTH_SCOPE = "read:user";
 const OAUTH_HEADERS = {
 	Accept: "application/json",
 	"Content-Type": "application/x-www-form-urlencoded",
@@ -82,7 +103,7 @@ async function startDeviceFlow(domain: string, fetchImpl: FetchImpl): Promise<De
 			method: "POST",
 			headers: OAUTH_HEADERS,
 			body: new URLSearchParams({
-				client_id: CLIENT_ID,
+				client_id: resolveOAuthClientId(domain),
 				scope: OAUTH_SCOPE,
 			}),
 		},
@@ -156,7 +177,7 @@ async function pollForGitHubAccessToken(
 				method: "POST",
 				headers: OAUTH_HEADERS,
 				body: new URLSearchParams({
-					client_id: CLIENT_ID,
+					client_id: resolveOAuthClientId(domain),
 					device_code: deviceCode,
 					grant_type: "urn:ietf:params:oauth:grant-type:device_code",
 				}),
@@ -207,7 +228,7 @@ const FAR_FUTURE_MS = Date.now() + 10 * 365.25 * 24 * 60 * 60 * 1000;
 
 /**
  * Refresh GitHub Copilot token.
- * GitHub OAuth tokens from both the former OpenCode app and the Copilot CLI app
+ * GitHub OAuth tokens from both the OpenCode app and the Copilot CLI app
  * remain directly usable, so existing logins need no token exchange or migration.
  */
 export function refreshGitHubCopilotToken(
@@ -335,8 +356,8 @@ export async function loginGitHubCopilot(options: GitHubCopilotLoginOptions): Pr
 
 	const apiEndpoint = await discoverGitHubCopilotApiEndpoint(githubAccessToken, fetchImpl);
 
-	// Keep storing the GitHub token directly so credentials minted by the former
-	// OpenCode OAuth app remain valid alongside new Copilot CLI app logins.
+	// Keep storing the GitHub token directly so credentials minted by the
+	// Copilot CLI OAuth app remain valid alongside new OpenCode app logins.
 	const credentials: OAuthCredentials = {
 		refresh: githubAccessToken,
 		access: githubAccessToken,

package/src/utils/harmony-leak.ts

@@ -485,7 +485,7 @@ const PREVIEW_TOKEN_RE =
 function redactedJunkPreview(text: string): string {
 	const source = text.slice(0, 64);
 	let out = "";
-	for (let i = 0; i < source.length; ) {
+	for (let i = 0; i < source.length;) {
 		const tok = PREVIEW_TOKEN_RE.exec(source.slice(i));
 		if (tok) {
 			out += tok[0];

package/src/utils/thinking-loop.ts

@@ -187,7 +187,7 @@ export class ThinkingLoopDetector {
 				return null;
 			}
 			// An over-long segment is chunked so each piece stays comparable.
-			for (let rest = raw; rest.length > 0; ) {
+			for (let rest = raw; rest.length > 0;) {
 				const chunk = rest.length > SEGMENT_CHAR_CAP ? rest.slice(0, SEGMENT_CHAR_CAP) : rest;
 				rest = rest.slice(chunk.length);
 				const hit = this.#consumeSegment(chunk);