@linxiraos/pi-ai 1.1.26 → 1.1.27

package/CHANGELOG.md

@@ -2,9 +2,25 @@
 
 ## [Unreleased]
 
-## [1.1.26] - 2026-10-03
+## [1.1.27] - 2026-10-07
 
-- 版本线推进至 1.1.26；本版无独立用户可见变化。
+- 版本线推进至 1.1.27；本版无独立用户可见变化。
+
+### Changed
+
+- Reduced CPU spent on thinking-loop detection while streaming long reasoning ([#14284](https://github.com/can1357/oh-my-pi/pull/14284) by [@abilliontokens](https://github.com/abilliontokens)).
+- Added `recordAffinity: false` to credential resolution options, selecting as the session would without pinning the choice to that session ([#14512](https://github.com/can1357/oh-my-pi/pull/14512) by [@will-bogusz](https://github.com/will-bogusz))
+
+### Fixed
+
+- Fixed replayed Responses and Codex history, including persisted Codex user/developer and assistant items, sending `detail: "original"` images to endpoints whose `supportsImageDetailOriginal` is off ([#13687](https://github.com/can1357/oh-my-pi/pull/13687) by [@alphastorm](https://github.com/alphastorm)).
+- Fixed thinking in turns kept after Anthropic native compaction being rejected or dropped on the next request ([#14251](https://github.com/can1357/oh-my-pi/pull/14251) by [@will-bogusz](https://github.com/will-bogusz))
+- Fixed Claude usage being re-polled every 10 seconds while Anthropic rate-limits the account; a failed refresh now waits a minute before trying again ([#14515](https://github.com/can1357/oh-my-pi/pull/14515) by [@will-bogusz](https://github.com/will-bogusz))
+- Fixed Devin requests skipping the `onPayload` hook, so payload capture now sees each Devin chat request and a returned replacement is what gets sent ([#14506](https://github.com/can1357/oh-my-pi/pull/14506) by [@will-bogusz](https://github.com/will-bogusz))
+- An OpenAI Responses turn whose connection drops mid-stream can now recover the finished answer from the provider (on hosts that store results, such as Muse Code) instead of re-running the whole turn and discarding the reasoning already done. Storage is opt-in: pass `storeResponses: true`, set `PI_MUSE_STORE_RESPONSES=1`, or set a process-wide default with `configureProviderStoreResponses` ([#14293](https://github.com/can1357/oh-my-pi/pull/14293) and [#14534](https://github.com/can1357/oh-my-pi/pull/14534) by [@abilliontokens](https://github.com/abilliontokens)).
+- Fixed the auth broker exiting when a background OAuth refresh sweep cannot read the credential store; the failure is now logged and the next sweep retries ([#14538](https://github.com/can1357/oh-my-pi/issues/14538))
+- Fixed Anthropic OAuth billing headers changing during developer-first sessions and side turns, preserving the prompt-cache prefix ([#14495](https://github.com/can1357/oh-my-pi/issues/14495)).
+- Fixed OpenAI-compatible chat-completions gateways recording completed turns as client-cancelled because the connection closed before their `[DONE]` sentinel arrived ([#14481](https://github.com/can1357/oh-my-pi/issues/14481)).
 
 ## [1.1.25] - 2026-10-03
 
@@ -13,3 +29,10 @@
 ## [1.1.24] - 2026-10-03
 
 - 网关身份头统一 `x-zeta-*`（消费方同步）；新增 `extractHttpStatusFromError`/`extractRetryHint` 导出。
+
+### Fixed
+
+- Fixed Antigravity chat and image requests sending an outdated client version when the model list came from cache, which could make newer models such as Claude Opus 5.5 unavailable.
+- When a DeepSeek model writes a broken DSML tool call (for example with the opening `<｜DSML｜tool_calls>` and `<｜DSML｜invoke>` tags missing), its closing tags are now kept in the streamed text instead of being dropped. This lets the agent remove exactly the broken call while keeping any text after it ([#14202](https://github.com/can1357/oh-my-pi/pull/14202) by [@H4vC](https://github.com/H4vC)).
+
+Older entries are archived in [packages/ai/CHANGELOG.md@a20cc0d04b64](https://github.com/can1357/oh-my-pi/blob/a20cc0d04b64f4a68fcc559cbd258743d984c50e/packages/ai/CHANGELOG.md).

package/README.md

@@ -77,6 +77,7 @@ Unified LLM API with automatic model discovery, provider configuration, token an
 - **QwenCloud Token Plan** (supports `/login alibaba-token-plan`, `ALIBABA_TOKEN_PLAN_API_KEY`, or `BAILIAN_TOKEN_PLAN_API_KEY`; interactive login first selects a region — International (Singapore, default), China (Beijing) for 百炼 Token Plan keys, or a custom base URL — since region keys are non-interchangeable, then optionally stores a `home.qwencloud.com` Cookie request header for best-effort 5-hour and 7-day quota reporting)
   To enable quota reporting, sign in to the Token Plan dashboard, copy the `Cookie` request-header value from a `home.qwencloud.com` request in browser developer tools, and paste it at the second login prompt. Press Enter to skip; the Cookie is sensitive and session-lived, so rerun login when it expires.
 - **Cloudflare AI Gateway** (supports `/login cloudflare-ai-gateway`, or `CLOUDFLARE_AI_GATEWAY_API_KEY` with `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_GATEWAY_ID`)
+- **Snowflake Cortex** (browser `/login snowflake`, or `SNOWFLAKE_ACCOUNT` + `SNOWFLAKE_PAT`; account-billed Cortex REST API)
 - **Ollama** (local OpenAI-compatible runtime; optional `OLLAMA_API_KEY`)
 - **Ollama Cloud** (hosted native Ollama API; requires `OLLAMA_CLOUD_API_KEY`)
 - **llama.cpp** (local OpenAI and Anthropic compatible inference server)
@@ -961,6 +962,7 @@ In Node.js environments, you can set environment variables to avoid passing API
 | ZenMux                | `ZENMUX_API_KEY`                                                                                                    |
 | vLLM                  | `VLLM_API_KEY`                                                                                                      |
 | Cloudflare AI Gateway | `CLOUDFLARE_AI_GATEWAY_API_KEY` + `CLOUDFLARE_ACCOUNT_ID` + `CLOUDFLARE_GATEWAY_ID`                                 |
+| Snowflake Cortex      | `SNOWFLAKE_PAT` + `SNOWFLAKE_ACCOUNT`                                                                               |
 | GitHub Copilot        | `COPILOT_GITHUB_TOKEN` or `GH_TOKEN` or `GITHUB_TOKEN`                                                              |
 
 `/login cloudflare-ai-gateway` collects and stores the gateway token, account ID, and gateway ID. For environment configuration, set all three Cloudflare values above. OMP derives provider endpoints from the account and gateway IDs.
@@ -1029,9 +1031,22 @@ Several providers support OAuth authentication (some also support static API key
 - **Google Gemini CLI** (Gemini 2.0/2.5 via Google Cloud Code Assist; free tier or paid subscription)
 - **Antigravity** (Free Gemini 3, Claude, GPT-OSS via Google Cloud)
 - **Qwen Portal** (Qwen OAuth token or API key)
+- **Snowflake Cortex** (Snowflake account OAuth with PKCE and refresh, subject to the account's local-application integration)
 
 For paid Cloud Code Assist subscriptions, set `GOOGLE_CLOUD_PROJECT` or `GOOGLE_CLOUD_PROJECT_ID` to your project ID.
 
+### Snowflake Cortex
+
+`/login snowflake` prompts for an account identifier (for example, `myorg-myaccount`), an HTTPS Snowflake account URL, or a Snowsight account link. It opens Snowflake's built-in `SNOWFLAKE$LOCAL_APPLICATION` OAuth flow using PKCE and a `127.0.0.1` callback (port 54551, with an ephemeral-port fallback). The stored account selects the inference endpoint; OAuth credentials cannot be sent to a different account through a custom model endpoint.
+
+The default inference role must hold either `SNOWFLAKE.CORTEX_USER` or the narrower, REST-only `SNOWFLAKE.CORTEX_REST_API_USER` (recommended for least privilege). `CORTEX_REST_API_USER` cannot be granted to a user directly; grant it to a custom role, and revoke `CORTEX_USER` from users who already hold it so the narrower control applies. The Cortex REST API is not available in China-region (`.snowflakecomputing.cn`) accounts. An administrator can check local-app availability with `SHOW SECURITY INTEGRATIONS LIKE 'SNOWFLAKE$LOCAL_APPLICATION'` and enable the integration or refresh issuance if necessary. When Snowflake issues a refresh token, omp refreshes the access token automatically. Without one, login remains valid until expiry; then sign in again or use the PAT environment alternative.
+
+For PAT authentication, set both `SNOWFLAKE_ACCOUNT` and `SNOWFLAKE_PAT`. Prefer a short-lived PAT restricted to a dedicated inference role and the required user-scoped network allowlist; do not disable network-policy enforcement. See [Snowflake PAT setup](https://docs.snowflake.com/en/user-guide/programmatic-access-tokens) and [local-application OAuth](https://docs.snowflake.com/en/user-guide/oauth-local-applications).
+
+Claude models use `/api/v2/cortex/v1/messages`; OpenAI models use `/api/v2/cortex/v1/chat/completions`. Both reuse omp's streaming transports and local tool execution. The 15 bundled models are a documented roster, not an account entitlement check: availability still depends on Cortex REST API enablement, role grants, model allowlists, and region. If authentication succeeds but Cortex returns `003001` ("This account is not allowed to access this endpoint"), Snowflake has not enabled Cortex REST for the account. [Self-service trial accounts disable AI features until a credit card is added](https://docs.snowflake.com/en/user-guide/admin-trial-account#label-trial-account-ai-features) (adding one does not end the trial); REST access can remain disabled even after AI SQL functions work, in which case Snowflake support must enable it. Cross-region inference requires an account administrator's explicit decision. `omp models snowflake --json` lists available models only after credentials are configured.
+
+This provider uses the [public, account-billed Cortex REST API](https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-rest-api). CoCo-subscription coverage is unverified. Catalog prices are per-million-token estimates from [Consumption Table 6(b)](https://www.snowflake.com/legal-files/CreditConsumptionTable.pdf) at [$2 per AI Credit](https://docs.snowflake.com/en/user-guide/snowflake-cortex/pricing) for on-demand global routing, not your contract price. Output is capped at the REST API's documented 16,384-token maximum; context windows are conservative AI_COMPLETE limits, not verified REST maxima. Cortex compatibility rules limit explicit cache retention to five minutes. Paste an account identifier or current Snowsight link; legacy `app.snowflake.com/<region>/<locator>` links are rejected because they don't map uniformly to an account host.
+
 ### Vertex AI (ADC)
 
 Vertex AI models use Application Default Credentials (ADC):

package/dist/types/auth/cascade.d.ts

@@ -12,6 +12,13 @@ export declare class KeyOverrides {
     configKey(provider: string): string | undefined;
     /** Config value consulted only after stored OAuth/login credentials. */
     fallbackKey(provider: string): string | undefined;
+    /**
+     * Config value consulted only after every other source, including stored
+     * api_key credentials — the lowest cascade tier. The OMP compatibility
+     * overlay uses it so an upstream key is a pure fallback: any credential
+     * the user later stores locally wins without needing to evict the mirror.
+     */
+    mirrorKey(provider: string): string | undefined;
     /** Resolve a config value (env var name, "!command", literal) to the secret. */
     resolve(config: string): Promise<string | undefined>;
     /**
@@ -37,12 +44,17 @@ export declare class KeyOverrides {
      * credentials (at the env-var tier). Providers that own a `/login` flow use
      * this so their default key reference (e.g. an unset env-var name, which
      * resolves to its literal text) cannot shadow the key the user logged in with.
+     *
+     * `mirror: true` ranks the value below everything else, under stored
+     * api_key credentials — a read-only compatibility mirror (upstream OMP
+     * agent.db key) that must never shadow a key the user stores locally.
      */
     setConfig(provider: string, apiKeyConfig: string, options?: {
         fallback?: boolean;
+        mirror?: boolean;
     }): void;
     /**
-     * Remove a single config-sourced API key (override or fallback).
+     * Remove a single config-sourced API key (override, fallback, or mirror).
      */
     removeConfig(provider: string): void;
     /**
@@ -68,7 +80,7 @@ export interface KeyCascadeDeps {
     rotate: LimitsApi["rotate"];
     sourceLabel?: string;
 }
-/** The provider auth precedence cascade (runtime → config → OAuth → login key → env → stored key). */
+/** The provider auth precedence cascade (runtime → config → OAuth → login key → env → stored key → compat mirror). */
 export declare class KeyCascade implements KeysApi {
     #private;
     constructor(deps: KeyCascadeDeps);
@@ -94,8 +106,8 @@ export declare class KeyCascade implements KeysApi {
     /**
      * Classify where a provider's auth comes from, following the same precedence
      * as {@link KeyCascade.get}: runtime override → config override →
-     * stored OAuth → login-stored api_key → config fallback → env var → stored api_key.
-     * Returns undefined when no auth is configured.
+     * stored OAuth → login-stored api_key → config fallback → env var →
+     * stored api_key → compat mirror. Returns undefined when no auth is configured.
      *
      * Compact, structured counterpart to {@link KeyCascade.describe}; `env`
      * selects dedicated-only, alias-aware, or no environment fallback.
@@ -114,7 +126,8 @@ export declare class KeyCascade implements KeysApi {
     /**
      * Get API key for a provider.
      * Priority (first match wins): runtime override, config override, OAuth,
-     * login API key, environment variable, then another stored API key.
+     * login API key, environment variable, another stored API key, then the
+     * lowest-tier OMP compat mirror.
      */
     get(provider: string, sessionId?: string, options?: AuthApiKeyOptions, onCredentialId?: (id: number, identity?: OAuthRequestIdentity) => void): Promise<string | undefined>;
     /**
@@ -143,6 +156,7 @@ export declare class KeyCascade implements KeysApi {
      *   4. API key persisted by a successful `/login`.
      *   5. Env var — overrides a stored static api_key (e.g. a stale broker copy).
      *   6. Stored api_key credential.
+     *   7. OMP compatibility mirror (upstream agent.db fallback key).
      *
      * The string is purely informational; consumers must not parse it.
      */
@@ -151,6 +165,7 @@ export declare class KeyCascade implements KeysApi {
     removeRuntime(provider: string): void;
     setConfig(provider: string, apiKeyConfig: string, options?: {
         fallback?: boolean;
+        mirror?: boolean;
     }): void;
     removeConfig(provider: string): void;
     clearConfig(): void;

package/dist/types/auth/types.d.ts

@@ -220,6 +220,8 @@ export interface CheckCredentialsOptions {
     completionProbe?: CompletionProbe;
     /** Per-credential completion probe timeout (ms). Defaults to `timeoutMs`. */
     completionTimeoutMs?: number;
+    /** Providers whose credentials are skipped entirely (not probed, not reported). */
+    excludeProviders?: ReadonlySet<string>;
 }
 /**
  * Sentinel value placed in OAuth `refresh` fields when a credential is shared
@@ -424,6 +426,8 @@ export type AuthApiKeyOptions = {
     forceRefresh?: boolean;
     /** Explicit provider-401 recovery; generic force refreshes leave this unset. */
     refreshReason?: OAuthRefreshReason;
+    /** When false, select as `sessionId` would without recording the choice as that session's sticky credential. */
+    recordAffinity?: boolean;
 };
 /** Non-secret identity bound to the OAuth credential selected for one request attempt. */
 export interface OAuthRequestIdentity {
@@ -808,6 +812,8 @@ export interface KeysApi {
      * 4. API key persisted by a successful `/login`
      * 5. Environment variable
      * 6. Stored API key (e.g. a broker-migrated copy) — last resort, so an explicit env var wins
+     * 7. OMP compatibility mirror — below every stored credential, so a key the
+     *    user saves locally always wins over the upstream fallback
      */
     get(provider: string, sessionId?: string, options?: AuthApiKeyOptions): Promise<string | undefined>;
     /** Resolve a bearer together with its durable stored credential row id, when known. */
@@ -865,12 +871,17 @@ export interface KeysApi {
      * `fallback: true` ranks the value below stored OAuth and `/login`
      * credentials instead, so a provider's default key reference cannot shadow
      * a key the user logged in with.
+     *
+     * `mirror: true` ranks the value below everything else, under stored
+     * api_key credentials — a read-only compatibility mirror (upstream OMP
+     * agent.db key) that must never shadow a locally stored key.
      */
     setConfig(provider: string, apiKeyConfig: string, options?: {
         fallback?: boolean;
+        mirror?: boolean;
     }): void;
     /**
-     * Remove a single config-sourced API key (override or fallback).
+     * Remove a single config-sourced API key (override, fallback, or mirror).
      */
     removeConfig(provider: string): void;
     /**

package/dist/types/auth-broker/refresher.d.ts

@@ -20,6 +20,11 @@ export declare class AuthBrokerRefresher {
     start(): void;
     stop(): void;
     getSchedule(): AuthBrokerRefresherSchedule;
-    /** Run one sweep. Exposed for tests. */
+    /**
+     * Run one sweep. Exposed for tests.
+     *
+     * Never rejects: callers fire it unawaited from a timer, so a failed sweep
+     * (e.g. an unreadable credential store) is logged and retried next interval.
+     */
     tick(): Promise<void>;
 }

package/dist/types/auth-gateway/dispatch.d.ts

@@ -5,8 +5,9 @@ import type { Api, FetchImpl, Model, Usage } from "../types.js";
 import type { ClientUsageIdentity } from "../usage.js";
 import type { AuthGatewayServerOptions } from "./types.js";
 export type ModelResolver = (modelId: string) => Model<Api> | undefined;
-export interface AuthGatewayBootOptions extends AuthGatewayServerOptions {
-    /** Source of credentials. Caller wires this to a broker-backed AuthStorage. */
+/** What the gateway's routes need, whatever transport carries the requests. */
+export interface AuthGatewayRouteOptions {
+    /** Source of credentials: broker-backed for `serve`, the CLI's own for `stdio`. */
     storage: AuthStorage;
     /**
      * Resolve a client-requested model id to a pi-ai Model. Caller supplies
@@ -19,6 +20,9 @@ export interface AuthGatewayBootOptions extends AuthGatewayServerOptions {
     /** Upstream transport for every provider call; defaults to global `fetch`. Test seam. */
     fetch?: FetchImpl;
 }
+/** The HTTP server's options: the routes' plus its listener and inbound auth. */
+export interface AuthGatewayBootOptions extends AuthGatewayServerOptions, AuthGatewayRouteOptions {
+}
 /**
  * The client's own session key, or `undefined` when it sent none. A blank key
  * counts as none: honouring it would collapse every caller that sends an empty

package/dist/types/auth-gateway/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./dispatch.js";
 export * from "./http.js";
 export * from "./session-state.js";
+export * from "./stdio.js";
 export * from "./server.js";
 export * from "./types.js";

package/dist/types/auth-gateway/routes/embeddings.d.ts

@@ -1,3 +1,3 @@
-import { type AuthGatewayBootOptions } from "../dispatch.js";
+import { type AuthGatewayRouteOptions } from "../dispatch.js";
 /** OpenAI-compatible `POST /v1/embeddings` gateway handler. */
-export declare function handleEmbeddings(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;
+export declare function handleEmbeddings(bootOpts: AuthGatewayRouteOptions, req: Request, peer: string): Promise<Response>;

package/dist/types/auth-gateway/routes/images.d.ts

@@ -1,3 +1,3 @@
-import { type AuthGatewayBootOptions } from "../dispatch.js";
-export declare function handleImageGenerations(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;
-export declare function handleImageEdits(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;
+import { type AuthGatewayRouteOptions } from "../dispatch.js";
+export declare function handleImageGenerations(bootOpts: AuthGatewayRouteOptions, req: Request, peer: string): Promise<Response>;
+export declare function handleImageEdits(bootOpts: AuthGatewayRouteOptions, req: Request, peer: string): Promise<Response>;

package/dist/types/auth-gateway/routes/rerank.d.ts

@@ -1,3 +1,3 @@
-import { type AuthGatewayBootOptions } from "../dispatch.js";
+import { type AuthGatewayRouteOptions } from "../dispatch.js";
 /** OpenRouter-compatible `POST /v1/rerank` gateway handler. */
-export declare function handleRerank(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;
+export declare function handleRerank(bootOpts: AuthGatewayRouteOptions, req: Request, peer: string): Promise<Response>;

package/dist/types/auth-gateway/routes/speech.d.ts

@@ -1,2 +1,2 @@
-import { type AuthGatewayBootOptions } from "../dispatch.js";
-export declare function handleSpeech(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;
+import { type AuthGatewayRouteOptions } from "../dispatch.js";
+export declare function handleSpeech(bootOpts: AuthGatewayRouteOptions, req: Request, peer: string): Promise<Response>;

package/dist/types/auth-gateway/routes/systemone.d.ts

@@ -1,2 +1,2 @@
-import { type AuthGatewayBootOptions } from "../dispatch.js";
-export declare function handleSystemOne(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;
+import { type AuthGatewayRouteOptions } from "../dispatch.js";
+export declare function handleSystemOne(bootOpts: AuthGatewayRouteOptions, req: Request, peer: string): Promise<Response>;

package/dist/types/auth-gateway/routes/transcriptions.d.ts

@@ -1,3 +1,3 @@
-import { type AuthGatewayBootOptions } from "../dispatch.js";
+import { type AuthGatewayRouteOptions } from "../dispatch.js";
 /** OpenAI-compatible `POST /v1/audio/transcriptions` gateway handler. */
-export declare function handleTranscriptions(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;
+export declare function handleTranscriptions(bootOpts: AuthGatewayRouteOptions, req: Request, peer: string): Promise<Response>;

package/dist/types/auth-gateway/routes/video.d.ts

@@ -1,7 +1,7 @@
-import { type AuthGatewayBootOptions } from "../dispatch.js";
+import { type AuthGatewayRouteOptions } from "../dispatch.js";
 /** OpenRouter-compatible `POST /v1/videos` asynchronous video submit handler. */
-export declare function handleVideoSubmit(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response>;
+export declare function handleVideoSubmit(bootOpts: AuthGatewayRouteOptions, req: Request, peer: string): Promise<Response>;
 /** OpenRouter-compatible `GET /v1/videos/:id` asynchronous video poll handler. */
-export declare function handleVideoPoll(bootOpts: AuthGatewayBootOptions, req: Request, peer: string, gatewayId: string): Promise<Response>;
+export declare function handleVideoPoll(bootOpts: AuthGatewayRouteOptions, req: Request, peer: string, gatewayId: string): Promise<Response>;
 /** OpenRouter-compatible `GET /v1/videos/:id/content` streaming video content handler. */
-export declare function handleVideoContent(bootOpts: AuthGatewayBootOptions, req: Request, peer: string, gatewayId: string): Promise<Response>;
+export declare function handleVideoContent(bootOpts: AuthGatewayRouteOptions, req: Request, peer: string, gatewayId: string): Promise<Response>;

package/dist/types/auth-gateway/server.d.ts

@@ -1,5 +1,5 @@
 /**
- * zeta-c auth-gateway HTTP server.
+ * zeta auth-gateway router and HTTP server.
  *
  * Accepts any provider-format request (OpenAI chat-completions, Anthropic
  * messages, OpenAI Responses) and dispatches through pi-ai's `streamSimple()`
@@ -23,8 +23,25 @@
  *   POST /v1/audio/transcriptions          → speech-to-text, multipart or JSON base64 in (routes/transcriptions)
  *
  * Chat routes live in this file; every other modality is a `routes/*` module
- * built on the shared plumbing in `dispatch.ts`.
+ * built on the shared plumbing in `dispatch.ts`. {@link createAuthGatewayRouter}
+ * answers the `/v1/*` routes for any transport: {@link startAuthGateway}
+ * serves them over HTTP behind bearer auth, `stdio.ts` over JSON lines.
  */
-import { type AuthGatewayBootOptions } from "./dispatch.js";
+import { type AuthGatewayBootOptions, type AuthGatewayRouteOptions } from "./dispatch.js";
 import type { AuthGatewayServerHandle } from "./types.js";
+/** The gateway's `/v1/*` routes, for a transport that has already admitted the caller. */
+export interface AuthGatewayRouter {
+    /** Answers one request; `peer` names the caller in logs. Never rejects: a crashed route answers 500. */
+    route(req: Request, peer: string): Promise<Response>;
+    /**
+     * Closes the retained provider session state (Codex WebSockets, GitLab Duo
+     * workflows), whose sockets and timers would otherwise keep the process alive.
+     */
+    close(): void;
+}
+/**
+ * The gateway's routes over `opts`, owning their per-session provider state:
+ * two routers in one process never share (or tear down) each other's.
+ */
+export declare function createAuthGatewayRouter(opts: AuthGatewayRouteOptions): AuthGatewayRouter;
 export declare function startAuthGateway(opts: AuthGatewayBootOptions): AuthGatewayServerHandle;

package/dist/types/auth-gateway/stdio.d.ts

@@ -0,0 +1,12 @@
+export interface AuthGatewayStdioOptions {
+    /** Request lines. */
+    input: ReadableStream<Uint8Array>;
+    /** Writes one response line, newline included. */
+    write(line: string): void;
+    /** Answers one request; never rejects (the gateway router's `route`, or a wrapper around it). */
+    route(req: Request): Promise<Response>;
+    /** Reported on the ready line. */
+    version?: string;
+}
+/** Serves `opts.input` until it ends and every request it carried is answered. */
+export declare function serveAuthGatewayStdio(opts: AuthGatewayStdioOptions): Promise<void>;

package/dist/types/error/flags.d.ts

@@ -43,6 +43,21 @@ export declare function isResponsesRequestBodyReadTimeout(message: {
     errorMessage?: string;
     requestBodyReadTimeoutFullReplay?: boolean;
 }): boolean;
+/**
+ * Codex code for the experimental native turn lane refusing a mid-response
+ * `response.steer`; the server then drops the in-flight response and closes
+ * the socket.
+ */
+export declare const CODEX_NATIVE_LANE_STEER_REJECTED_CODE = "unsupported_native_inflight_message";
+/**
+ * A Codex turn the native turn lane dropped because omp steered it. The
+ * rejection answers our own `response.steer`, not the model's health: the
+ * provider stops steering the session, so the same model replays cleanly.
+ */
+export declare function isCodexSteerRejection(message: {
+    api?: Api;
+    errorMessage?: string;
+}): boolean;
 export declare const TRANSIENT_TRANSPORT_PATTERN: RegExp;
 export declare const ANTHROPIC_ACCOUNT_POLICY_PATTERN: RegExp;
 /** Whether an error message represents an Anthropic account-scoped permission/policy denial. */

package/dist/types/index.d.ts

@@ -1,7 +1,7 @@
 export { type Type, type } from "@linxiraos/pi-omptype";
 export * from "./api-registry.js";
 export type * from "./auth-broker/index.js";
-export type { AuthGatewayBootOptions, ModelResolver } from "./auth-gateway/dispatch.js";
+export type { AuthGatewayBootOptions, AuthGatewayRouteOptions, ModelResolver } from "./auth-gateway/dispatch.js";
 export * from "./auth-gateway/types.js";
 export * from "./auth-retry.js";
 export * from "./auth-storage.js";

package/dist/types/providers/anthropic.d.ts

@@ -1,4 +1,5 @@
-import type { AnthropicOutputEffort, FetchImpl, Message, Model, ServiceTier, SimpleStreamOptions, StreamFunction, StreamOptions, Usage } from "../types.js";
+import type { Effort } from "@linxiraos/pi-catalog/effort";
+import type { AnthropicCompactionRequest, AnthropicOutputEffort, FetchImpl, Message, Model, ServiceTier, SimpleStreamOptions, StreamFunction, StreamOptions, Usage } from "../types.js";
 import { type AnthropicFetchOptions, type AnthropicMessagesClientLike } from "./anthropic-client.js";
 import { type FallbackParam, type MessageParam, type TextBlockParam } from "./anthropic-wire.js";
 import { resolvesToOfficialAnthropicEndpoint, supportsAnthropicCompaction, supportsAnthropicCompactionOnClient } from "./anthropic-compaction.js";
@@ -209,7 +210,7 @@ export type AnthropicSystemBlock = {
 type SystemBlockOptions = {
     includeClaudeCodeInstruction?: boolean;
     extraInstructions?: string[];
-    /** Text of the first user message — used as fingerprint seed for the billing header. */
+    /** Text of the first conversational wire user turn, used as the billing fingerprint seed. */
     firstUserMessageText?: string;
     /** Cache lifetime shared by the OAuth system breakpoint and later message breakpoints. */
     cacheControl?: AnthropicCacheControl;
@@ -234,6 +235,16 @@ export declare function budgetThinkingOutput(maxTokens: number | undefined, budg
     maxTokens: number;
     budgetTokens: number;
 };
+/**
+ * The effort whose thinking allowance an on-demand compaction request over
+ * `messages` gets. It sends no effort change of its own, so once an earlier
+ * request recorded an effort, the one it left in force applies, even when
+ * `requested` differs or is off. When that request named none, the API's
+ * per-model default applies, which is not known here: the request gets the
+ * largest effort's allowance (`max_tokens` is a cap, not spend). Without a
+ * recorded effort the request sets its own.
+ */
+export declare function resolveAnthropicCompactionEffort(model: Model<"anthropic-messages">, messages: readonly Message[], requested: Effort | undefined): Effort | undefined;
 /**
  * Whether the conversation has stopped being thinking-led, so routes with
  * `compat.stripThinkingHistory` drop the budget `thinking` config and replay
@@ -269,5 +280,7 @@ export declare function convertAnthropicMessages(messages: Message[], model: Mod
     dropAllThinking?: boolean;
     droppedThinkingBlocks?: ReadonlySet<string>;
     credentialId?: number;
+    /** On-demand compaction request: it ends inside the conversation, so it gets nothing live requests lack there. */
+    compactionRequest?: AnthropicCompactionRequest;
 }): AnthropicMessageParam[];
 export declare function normalizeAnthropicToolSchema(schema: unknown): unknown;

package/dist/types/providers/aws-credentials.d.ts

@@ -29,14 +29,10 @@ export interface CredentialResolveOptions {
     fetch?: FetchImpl;
 }
 export declare function resolveAwsCredentials(opts?: CredentialResolveOptions): Promise<ResolvedCredentials>;
-/** POSIX-shell-style tokenizer used by the AWS CLI for `credential_process`.
- *
- * Outside quotes a backslash escapes the next character. Inside single quotes
- * everything is literal (no escapes, cannot contain `'`). Inside double quotes
- * a backslash only escapes `$`, `` ` ``, `"`, and `\` — every other backslash
- * is preserved verbatim, which is what makes Windows paths like
- * `"C:\Program Files\tool\auth.exe"` survive tokenization. */
-export declare function tokenizeCredentialProcessCommand(cmd: string): string[];
+/** Split a `credential_process` command into argv the way botocore's
+ * `compat_shell_split` does: Windows command-line (CRT) rules on `win32`,
+ * POSIX shell rules everywhere else. */
+export declare function tokenizeCredentialProcessCommand(cmd: string, platform?: NodeJS.Platform): string[];
 /** Test/diagnostic helper — drops cached credentials. */
 export declare function clearAwsCredentialCache(): void;
 /**

package/dist/types/providers/connect-error-detail.d.ts

@@ -4,6 +4,15 @@
  * usable is present.
  */
 export declare function summarizeConnectErrorDetails(details: unknown): string | undefined;
+/**
+ * True when Cursor's `aiserver.v1.ErrorDetails` entry declares the failure
+ * retryable. Its JSON `debug` form carries `details.isRetryable` — set on
+ * upstream outages such as ERROR_OPENAI ("Unable to reach the model
+ * provider") whose bare `code: message` text (`unavailable: Error`)
+ * classifies as a hard failure on its own. Other detail types are ignored
+ * even when they share the `debug.details` shape.
+ */
+export declare function hasRetryableCursorErrorDetail(details: unknown): boolean;
 /**
  * Formats a Connect end-stream error object into a diagnosable message.
  * The "Connect error code: message" prefix is preserved exactly; detail

package/dist/types/providers/openai-responses.d.ts

@@ -16,9 +16,9 @@ export interface OpenAIResponsesOptions extends StreamOptions {
     /**
      * Stateful turns: chain via `previous_response_id` + delta input instead of
      * replaying the full transcript. Forces `store: true` (the platform only
-     * resolves stored responses). Defaults ON against the official OpenAI API
-     * and OFF for other Responses endpoints; `PI_OPENAI_STATEFUL` overrides the
-     * default, and `false` here vetoes everything. Requires `sessionId` +
+     * resolves stored responses). Precedence: this option, then
+     * `PI_OPENAI_STATEFUL`, then `compat.statefulResponses`, then ON against the
+     * official OpenAI API and OFF elsewhere. Requires `sessionId` +
      * `providerSessionState`. Falls back to a full replay whenever history
      * mutates or the server reports a stale id.
      */
@@ -60,6 +60,27 @@ export interface OpenAIResponsesOptions extends StreamOptions {
     /** Opt-in GPT-5.6+ prompt-cache policy. Unsupported explicit mode fails locally. */
     promptCache?: OpenAIPromptCacheOptions;
 }
+/**
+ * Poll a stored Responses result until it reaches an adoptable terminal state.
+ * 404s, 5xx, and transport failures mean "not yet" (an in-flight run only
+ * becomes retrievable once the server finishes it); any other status, a
+ * mismatched id, or a failed/cancelled run ends the poll immediately. The
+ * whole recovery is bounded by one wall-clock deadline: each request's timeout
+ * is clamped to the time left, and no sleep may cross the deadline, so a
+ * stalled host cannot hold an already-failed turn past it. Returns the
+ * terminal object, or undefined on give-up/abort.
+ *
+ * @internal Exported for tests.
+ */
+export declare function pollOpenAIResponsesResultForCompletion(args: {
+    fetchImpl: NonNullable<StreamOptions["fetch"]>;
+    url: string;
+    headers: Record<string, string>;
+    responseId: string;
+    signal?: AbortSignal;
+    /** Sleep between polls; defaults to a real wait honoring `signal`. */
+    wait?: (ms: number, signal?: AbortSignal) => Promise<void>;
+}): Promise<Record<string, unknown> | undefined>;
 interface OpenAIResponsesProviderSessionState extends ProviderSessionState, OpenAIStrictToolsState, OpenAIReasoningEffortFallbackState {
     nativeHistoryReplayWarmed: boolean;
     /** Stateful `previous_response_id` chain baselines, keyed by baseUrl/model/session. */
@@ -85,6 +106,14 @@ interface OpenAIResponsesChainState {
     /** Set once chaining is judged unsupported for this session (circuit breaker). */
     disabled: boolean;
 }
+/**
+ * Set the process-wide storage default per provider id, used when a request
+ * leaves `storeResponses` unset. Hosts call this from their settings so every
+ * request follows the setting, including direct `streamSimple`/`completeSimple`
+ * side calls that do not pass per-request options. `PI_MUSE_STORE_RESPONSES`
+ * still overrides it.
+ */
+export declare function configureProviderStoreResponses(byProvider: Readonly<Record<string, boolean>> | undefined): void;
 /**
  * Drop the account-bound half of every retained `openai-responses` record in
  * `states`: the stateful `previous_response_id` chain baselines.

package/dist/types/providers/openai-shared.d.ts

@@ -78,7 +78,13 @@ export declare function applyOpenAIServiceTier(params: {
  * proxy can never skew those costs.
  */
 export declare function applyOpenAIResponsesServiceTierCost(model: Pick<Model, "provider" | "serviceTierCost">, usage: AssistantMessage["usage"], responseServiceTier: unknown, requestServiceTier: ServiceTier | null | undefined): void;
-/** Reconcile token-price estimates with a gateway's authoritative account charge. */
+/**
+ * Reconcile token-price estimates with a gateway's authoritative account charge.
+ * BYOK turns (`is_byok: true`) price from the provider spend in
+ * `cost_details.upstream_inference_cost` plus whatever credits charge
+ * OpenRouter reports in `cost` (its BYOK fee is plan-dependent and can be $0),
+ * so both are covered.
+ */
 export declare function applyProviderReportedCost(model: Pick<Model, "provider">, usage: Usage, rawUsage: unknown): void;
 export interface OpenAIUsageAccountingInput {
     promptTokens: number;
@@ -470,6 +476,13 @@ export interface BuildResponsesInputOptions<TApi extends Api> {
     supportsImageDetailOriginal: boolean;
     systemRole?: "system" | "developer";
     nativeHistory?: {
+        /**
+         * Replay same-provider native history. `false` marks a cold provider
+         * session (#489): native items are withheld except remote-compaction
+         * history and assistant turns that carry no server-issued state
+         * ({@link isColdReplayableResponsesTurn}); other turns are rebuilt from
+         * message content.
+         */
         replay: boolean;
         filterReasoning: boolean;
     };

package/dist/types/providers/transform-messages.d.ts

@@ -1,4 +1,15 @@
 import type { Api, AssistantMessage, Message, Model } from "../types.js";
+/**
+ * Maximum tool-call id length the strictest replay provider accepts.
+ *
+ * Anthropic requires `^[a-zA-Z0-9_-]+$` with a 64-char cap; Google and Codex
+ * `normalizeToolCallId` implementations cap individual id segments to the same
+ * 64-char ceiling. Replacement ids minted here flow back through
+ * `convertAnthropicMessages` (and friends) unchanged, so the `_dupN` suffix
+ * MUST not push a normalized id past this bound.
+ */
+export declare const MAX_TOOL_CALL_ID_LENGTH = 64;
+export declare function appendDuplicateSuffix(originalId: string, suffix: string, maxLength: number): string;
 /**
  * Whether a tool-call name cannot belong to any declared tool: missing, empty,
  * longer than OpenAI's 128-character replay limit, or containing whitespace or

package/dist/types/registry/oauth/snowflake.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthController, OAuthCredentials } from "./types.js";
+export declare function loginSnowflake(ctrl: OAuthController): Promise<OAuthCredentials>;
+export declare function refreshSnowflakeToken(credentials: OAuthCredentials, signal?: AbortSignal): Promise<OAuthCredentials>;

package/dist/types/registry/snowflake.d.ts

@@ -0,0 +1,4 @@
+import type { ProviderTransport } from "./build.js";
+/** Normalize account identifiers and Snowsight links without accepting arbitrary credential-receiving hosts. */
+export declare function normalizeSnowflakeAccountUrl(input: string): string;
+export declare const snowflakeTransport: ProviderTransport;