@linxiraos/pi-ai 1.2.0 → 1.3.0

package/CHANGELOG.md

@@ -1,5 +1,88 @@
 ## [Unreleased]
 
+## [1.3.0] - 2026-10-18
+
+### Breaking Changes
+
+- `isOfficialCodexApiUrl` moved from `@linxiraos/pi-ai` to `@linxiraos/pi-catalog/wire/codex`, next to `CODEX_BASE_URL`, so the catalog's compat resolver classifies Codex endpoints with the same check ([#15434](https://github.com/can1357/oh-my-pi/pull/15434) by [@will-bogusz](https://github.com/will-bogusz))
+- `resolveGatewayApiKey` and `buildGatewayApiKeyResolver` (`@oh-my-pi/pi-ai/auth-gateway`) take the request's route options (`{ storage, client? }`) instead of an `AuthStorage`, their resolver callback receives the resolved credential, and `resolveGatewayAccount` takes that credential ([#15900](https://github.com/can1357/oh-my-pi/pull/15900) by [@alphastorm](https://github.com/alphastorm))
+- `PI_CODEX_ZSTD` is replaced by `PI_REQUEST_COMPRESSION`; set `PI_REQUEST_COMPRESSION=0` to send Codex (and every other) request body uncompressed ([#16086](https://github.com/can1357/oh-my-pi/pull/16086) by [@H4vC](https://github.com/H4vC))
+
+### Added
+
+- Added support for `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS` on the `anthropic` provider: when set, requests omit pre-release fields (`context_management`, beta tool fields such as `strict` and `defer_loading`, task budgets, structured-output format, `thinking.block_binding`, and Anthropic server compaction) along with their beta headers, so `ANTHROPIC_BASE_URL` gateways that reject them keep working ([#15458](https://github.com/can1357/oh-my-pi/pull/15458) by [@H4vC](https://github.com/H4vC))
+- Added `withoutUnverifiedThinking` utility to filter reasoning capability from models when no effort is requested
+- Added `reachesOfficialEndpoint(model)`: whether a request to the model reaches the official endpoint its compat was built for, following `ANTHROPIC_BASE_URL` and Foundry's `FOUNDRY_BASE_URL` reroutes of first-party Anthropic models ([#15434](https://github.com/can1357/oh-my-pi/pull/15434) by [@will-bogusz](https://github.com/will-bogusz))
+- Added `AssistantMessage.elidedOutputTokens`, the visible output tokens a history rewrite (shake) has removed from the turn, which `usage.output` still counts ([#15446](https://github.com/can1357/oh-my-pi/pull/15446) by [@will-bogusz](https://github.com/will-bogusz))
+- Exported `shouldDropTruncatedThinkingOnlyAssistant` from `providers/transform-messages`, `isColdReplayableResponsesTurn` from `providers/openai-shared` and the new `openAIResponsesReplaysNativeHistory` from `providers/openai-responses`, so local token estimates can follow which turns replay drops and whether a session replays native history ([#15447](https://github.com/can1357/oh-my-pi/pull/15447) by [@will-bogusz](https://github.com/will-bogusz))
+- Added image support for native OpenAI Decisions and Workers AI judgments, prompted vision chat, and auth-gateway System One requests; images exceeding a judgment API's documented caps (e.g. Clef's 4 images, 4 MiB each) are rejected locally ([#15471](https://github.com/can1357/oh-my-pi/pull/15471) by [@anatoli-tsinovoy](https://github.com/anatoli-tsinovoy)).
+- `isSurvivingAssistant` in `providers/transform-messages`: whether an assistant turn reaches a replay, malformed tool calls dropped first, so callers outside `transformMessages` pick the same latest turn ([#15791](https://github.com/can1357/oh-my-pi/pull/15791) by [@will-bogusz](https://github.com/will-bogusz))
+- Added scoped clients to `startAuthGateway` (`clients`, `setClients`): each client bearer is limited to its own models and OAuth accounts, with no fallback to other accounts or API keys, and request log lines name the client and the credential a request started on ([#5098](https://github.com/can1357/oh-my-pi/issues/5098), [#15900](https://github.com/can1357/oh-my-pi/pull/15900) by [@alphastorm](https://github.com/alphastorm))
+- Added experimental native image judgments for TypeSafe Jev's `jev-latest`, `jev-preview`, `jev-1.13.0`, and `jev-1.14.0`, plus OpenRouter's `typesafe/jev-1.13`, `typesafe/jev-1.14`, and `~typesafe/jev-latest` models; images outside Jev's documented size bounds fall through to a vision chat judge instead of failing ([#15887](https://github.com/can1357/oh-my-pi/pull/15887) by [@anatoli-tsinovoy](https://github.com/anatoli-tsinovoy))
+- Added `ThinkingContent.narration`, set on Anthropic and Bedrock thinking blocks whose signature marks them as between-tool narration, and `presentNarrationAsAnswer(message)` to show those blocks as reply text while replay keeps them as signed thinking
+- Added `keys.peek(provider, { includeExpired: true })` to name the stored account behind an expired OAuth token for reads that never send it, such as keying an offline model-cache lookup ([#16061](https://github.com/can1357/oh-my-pi/pull/16061) by [@gchai](https://github.com/gchai))
+- Added `prewarmModelConnection(model)` (`providers/connection-prewarm`), which opens the model's API connection ahead of a request using the same transport and TLS settings so the request reuses it instead of paying the connection handshake ([#16086](https://github.com/can1357/oh-my-pi/pull/16086) by [@H4vC](https://github.com/H4vC))
+
+### Changed
+
+- Anthropic requests to the official API now gzip the request body, so long conversations reach the model sooner on slow uplinks; set `PI_REQUEST_COMPRESSION=0` to disable it ([#16044](https://github.com/can1357/oh-my-pi/pull/16044) by [@H4vC](https://github.com/H4vC))
+- GitHub Copilot requests (chat completions, Responses, and Claude messages) now send zstd-compressed bodies, cutting upload size by roughly 60–75% on long conversations; set `PI_REQUEST_COMPRESSION=0` to disable it ([#16086](https://github.com/can1357/oh-my-pi/pull/16086) by [@H4vC](https://github.com/H4vC))
+- A rejected request-body encoding now only disables compression for that host, and only after the uncompressed resend succeeds, so a genuine 400 no longer turns compression off ([#16086](https://github.com/can1357/oh-my-pi/pull/16086) by [@H4vC](https://github.com/H4vC))
+- Connection warm-up now covers every catalog provider, not only the official Anthropic API: it re-warms the origin a model's requests actually reach (Copilot plan hosts, `MOONSHOT_BASE_URL`, regional hosts), throttled per host; custom providers, built-in provider ids routed to a gateway, local hosts, and Anthropic gateways are never probed ([#16086](https://github.com/can1357/oh-my-pi/pull/16086) by [@H4vC](https://github.com/H4vC))
+
+### Fixed
+
+- Fixed Claude on Google Antigravity failing every turn with "image exceeds 5 MB maximum" once a large image entered the conversation; images are now downscaled to the host's limits before sending, as on the Anthropic API ([#15444](https://github.com/can1357/oh-my-pi/pull/15444) by [@will-bogusz](https://github.com/will-bogusz))
+- Fixed Codex cybersecurity policy errors incorrectly retrying without Daybreak and disabling it for subsequent requests, while preserving retries without Daybreak when access is rejected ([#15472](https://github.com/can1357/oh-my-pi/pull/15472) by [@taibenvenuti](https://github.com/taibenvenuti))
+- Fixed Codex-hosted image generation ignoring the requested `aspect_ratio`/`image_size`, and `3:2`/`2:3` requests sending no size to OpenAI image models ([#15601](https://github.com/can1357/oh-my-pi/pull/15601) by [@chulmin-dev](https://github.com/chulmin-dev))
+- Fixed Claude subagents failing to return structured results when `yield` arguments arrived as invalid JSON ([#15605](https://github.com/can1357/oh-my-pi/pull/15605) by [@farnoy](https://github.com/farnoy))
+- Fixed turns stopping instead of retrying when a gateway reports its upstream WebSocket closed before `response.completed` ([#15628](https://github.com/can1357/oh-my-pi/pull/15628) by [@nqrwhal](https://github.com/nqrwhal)).
+- Fixed Claude on Google Vertex ignoring `cacheRetention: "long"`: prompt caches now get the 1h TTL instead of expiring after 5 minutes, and the `extended-cache-ttl` beta (which Vertex rejects) is never sent there ([#15505](https://github.com/can1357/oh-my-pi/pull/15505) by [@hpost](https://github.com/hpost))
+- Fixed Gemini tool continuations failing on OpenAI-compatible gateways that return `reasoning_signature`, including restored sessions ([#15678](https://github.com/can1357/oh-my-pi/pull/15678) by [@Zzz141592653](https://github.com/Zzz141592653))
+- Fixed Cursor sessions failing every rebuilt request with `PROVIDER_ERROR` after the server re-sent a tool call: the call is recorded once, and histories that already repeat it replay it once with its latest result ([#15749](https://github.com/can1357/oh-my-pi/issues/15749))
+- Fixed Cursor turns cut off mid-stream failing every retry with `PROVIDER_ERROR` until you sent a new message; the retry now starts a fresh Cursor conversation ([#15830](https://github.com/can1357/oh-my-pi/issues/15830))
+- Fixed malformed image-generation inputs being forwarded to providers or reported as credential/upstream errors ([#15765](https://github.com/can1357/oh-my-pi/pull/15765) by [@anatoli-tsinovoy](https://github.com/anatoli-tsinovoy)).
+- Fixed broker-backed auth-gateway processes retaining a cache entry for every distinct client session indefinitely under sustained traffic ([#15841](https://github.com/can1357/oh-my-pi/issues/15841)).
+- Fixed turns ending on a pinned error when a provider reports "temporarily unavailable" or finishes with an `unknown`, `other` or `unspecified` finish reason: these now retry automatically ([#15424](https://github.com/can1357/oh-my-pi/pull/15424) by [@lockwo](https://github.com/lockwo))
+- Fixed parallel tool calls failing with "Tool call arguments are not valid JSON" on some OpenAI-compatible gateways, such as Gemini ([#15682](https://github.com/can1357/oh-my-pi/pull/15682) by [@Zzz141592653](https://github.com/Zzz141592653))
+- Fixed Anthropic fallback-credit redemption losing its credit on errors that only mention `400` in their text, such as an overload message ([#15702](https://github.com/can1357/oh-my-pi/pull/15702) by [@H4vC](https://github.com/H4vC))
+- Fixed Anthropic fallback-credit redemption sending an extra `fallback-credit-2026-06-01` beta when the refused request used a newer one ([#15702](https://github.com/can1357/oh-my-pi/pull/15702) by [@H4vC](https://github.com/H4vC))
+- Fixed Anthropic fallback-credit redemptions failing when the refused turn included unsigned thinking ([#15702](https://github.com/can1357/oh-my-pi/pull/15702) by [@H4vC](https://github.com/H4vC))
+- Fixed turns ending without automatic retry when a gateway forwards Go's `use of closed network connection` transport error; it now retries like other dropped connections ([#15385](https://github.com/can1357/oh-my-pi/issues/15385))
+- Fixed Codex SSE streams failing with an abort instead of retrying when the first event stalls ([#15542](https://github.com/can1357/oh-my-pi/issues/15542))
+- Fixed Codex (ChatGPT subscription) requests with reasoning disabled, such as judges, titles, commit messages, and thinking `off`, leaving effort to the server default; they now send the lowest supported effort, or `none` where the model accepts it ([#15514](https://github.com/can1357/oh-my-pi/issues/15514))
+- Fixed a Codex account whose token OpenAI rejects (401/403) continuing to show its last quota as healthy; `omp usage` now drops the stale report and `omp auth-gateway check` reports the credential as failing ([#15439](https://github.com/can1357/oh-my-pi/issues/15439))
+- Fixed usage reports being served indefinitely while their provider keeps failing; the last successful report is now shown for at most 24 hours after it was fetched ([#15439](https://github.com/can1357/oh-my-pi/issues/15439))
+- Fixed Responses requests 400ing (DeepSeek: "The `reasoning_text` in the thinking mode must be passed back to the API") after a tool call whose arguments were invalid JSON: the call is now replayed with its parse diagnostic instead of being dropped and leaving a trailing `[Orphan tool result]` note ([#15568](https://github.com/can1357/oh-my-pi/issues/15568))
+- Fixed DeepSeek on OpenAI-compatible gateways leaving doubled-pipe DSML markup (`</｜｜DSML｜｜parameter>`) in assistant text and reasoning ([#15485](https://github.com/can1357/oh-my-pi/issues/15485))
+- Fixed sessions failing every request with `400 … thinking or redacted_thinking blocks in the latest assistant message cannot be modified` after a response fell back to another model mid-turn (e.g. through a gateway that opts into Anthropic server-side fallback); the turn now replays one model's reasoning, and a session already stuck on such a turn recovers by dropping that turn's reasoning and retrying ([#15654](https://github.com/can1357/oh-my-pi/pull/15654) by [@abilliontokens](https://github.com/abilliontokens))
+- Fixed `omp auth-gateway`'s Anthropic `/v1/messages` stream misnumbering content blocks after a redacted reasoning block, which misrouted every later delta in index-addressed clients ([#15654](https://github.com/can1357/oh-my-pi/pull/15654) by [@abilliontokens](https://github.com/abilliontokens))
+- Fixed error results from non-first-party providers regaining partial output the provider had discarded; an error with empty content now stays empty ([#14516](https://github.com/can1357/oh-my-pi/issues/14516), [#14572](https://github.com/can1357/oh-my-pi/pull/14572) by [@oleg494](https://github.com/oleg494))
+- Fixed the auth gateway's `POST /v1/audio/speech` answering 502 for requests the speech adapter rejects (unsupported format, over-long input); they now get 400 `invalid_request_error` ([#14508](https://github.com/can1357/oh-my-pi/pull/14508) by [@F0Rextasy](https://github.com/F0Rextasy))
+- Fixed a single-string tool call with two or more mislabelled string fields silently dispatching whichever field came first in the JSON; such ambiguous calls now fail validation and the model sees its own arguments back ([#14414](https://github.com/can1357/oh-my-pi/pull/14414) by [@F0Rextasy](https://github.com/F0Rextasy))
+- Fixed GLM-5.2 on Ollama Cloud losing its reasoning between turns; Ollama Cloud now keeps assistant thinking in history for models verified to accept it ([#14440](https://github.com/can1357/oh-my-pi/pull/14440) by [@Dante-dan](https://github.com/Dante-dan))
+- Fixed GPT Image generation and edits failing on gateways that validate request parameters, such as LiteLLM; `response_format` is no longer sent to GPT Image models ([#14619](https://github.com/can1357/oh-my-pi/pull/14619) by [@jimhester](https://github.com/jimhester))
+- Fixed OpenRouter errors such as "Access denied by security policy" dropping the routed upstream's own explanation from `error.metadata.raw` ([#10906](https://github.com/can1357/oh-my-pi/issues/10906), [#14435](https://github.com/can1357/oh-my-pi/pull/14435) by [@F0Rextasy](https://github.com/F0Rextasy))
+- Fixed GitHub Copilot usage reporting an AI-credit allowance as "Premium Requests" in request units; the unit each billing item reports is now honoured ([#13849](https://github.com/can1357/oh-my-pi/issues/13849), [#14501](https://github.com/can1357/oh-my-pi/pull/14501) by [@F0Rextasy](https://github.com/F0Rextasy))
+- Fixed an OpenAI-compatible server's `finish_reason: "repetition"` or `stop_reason: "repetition_detected"` not being treated as a thinking loop, so the degenerate partial reasoning was kept and replayed into the next turn ([#12525](https://github.com/can1357/oh-my-pi/issues/12525), [#14535](https://github.com/can1357/oh-my-pi/pull/14535) by [@F0Rextasy](https://github.com/F0Rextasy))
+- Fixed JSON Schema dereferencing rewriting literal values in `const`, `enum`, `default`, examples, and custom annotations, or treating property names as schema keywords ([#15927](https://github.com/can1357/oh-my-pi/pull/15927) by [@jchanghong023](https://github.com/jchanghong023)).
+- Fixed Anthropic requests hanging forever on Bun 1.3 when the upstream accepted the request but never sent headers: aborting the request (including the first-event timeout) now fails it, so the turn retries instead of waiting until the user interrupts it ([#16010](https://github.com/can1357/oh-my-pi/pull/16010) by [@ca-io-systems](https://github.com/ca-io-systems))
+- Fixed the auth gateway's `POST /v1/chat/completions` streams being dropped (`terminated`) after ~255 s without upstream output, e.g. while xAI generates a large tool call's arguments, which arrive only when complete; the stream now sends an SSE `: keepalive` comment every 15 s ([#15940](https://github.com/can1357/oh-my-pi/pull/15940) by [@radkawar](https://github.com/radkawar))
+- Fixed Anthropic models with mid-conversation system messages (e.g. Claude Opus 5.5) receiving `@file` mention contents and hidden extension messages as a trailing `system` message instead of ending the request on the user's turn ([#15881](https://github.com/can1357/oh-my-pi/issues/15881))
+- Fixed Ollama and Ollama Cloud streaming errors being silently accepted as successful responses ([#16039](https://github.com/can1357/oh-my-pi/pull/16039) by [@mottopanikeiku](https://github.com/mottopanikeiku))
+- Fixed the hermes in-band scanner exposing a truncated tool name for streaming tool calls: `toolStart` now waits for the complete JSON name, so a stream that splits or stops mid-name never reports a partial tool name ([#16064](https://github.com/can1357/oh-my-pi/pull/16064) by [@adi-IL](https://github.com/adi-IL))
+- Fixed `keys.peek()` rotating through stored accounts on each call; it now returns the first account whose token has not expired, every time, so model discovery keeps reading one account's cached catalog ([#16061](https://github.com/can1357/oh-my-pi/pull/16061) by [@gchai](https://github.com/gchai))
+- Fixed local JSON Schema references with URI-percent-encoded, JSON Pointer-escaped, or empty definition names resolving incorrectly during dereferencing, strict conversion, and value validation ([#15926](https://github.com/can1357/oh-my-pi/pull/15926) by [@jchanghong023](https://github.com/jchanghong023)).
+- Fixed network failures showing a generic "Connection error."; offline, connection-refused, and TLS-verification failures now name the host and the cause ([#16036](https://github.com/can1357/oh-my-pi/pull/16036) by [@jorgoose](https://github.com/jorgoose))
+- Fixed Jev image limits rejecting inputs for unrelated native judges and redundant TypeSafe image judgments when only detail changes ([#16002](https://github.com/can1357/oh-my-pi/pull/16002) by [@anatoli-tsinovoy](https://github.com/anatoli-tsinovoy)).
+- Fixed SIGTERM interrupting an in-flight OAuth token rotation before its replacement refresh token was saved ([#15845](https://github.com/can1357/oh-my-pi/issues/15845)).
+- Fixed sessions getting stuck on HTTP 400 after replaying tool names unsupported by the target provider, including invented `proc://*` calls and Google tool names sent to Bedrock ([#15839](https://github.com/can1357/oh-my-pi/issues/15839))
+- Fixed every request failing behind a TLS-inspecting proxy that refuses compressed uploads: a 400/403/415 whose body is not JSON, or the Anthropic API's "request body is not valid JSON" after a proxy drops `Content-Encoding`, now resends the body uncompressed and stops compressing for that host ([#16108](https://github.com/can1357/oh-my-pi/pull/16108) by [@alphastorm](https://github.com/alphastorm))
+
+### Removed
+
+- Removed the `toolNamespacesInfo` stream option; Codex requests no longer send `tool_namespaces_info` turn metadata, and `code_mode_tool_names`/`tool_namespaces_info` are no longer reserved client metadata keys.
+
 ## [1.2.0] - 2026-10-12
 
 - 版本线推进至 1.2.0；本版无独立用户可见变化。

package/README.md

@@ -84,7 +84,7 @@ Unified LLM API with automatic model discovery, provider configuration, token an
 - **vLLM** (OpenAI-compatible server; `VLLM_API_KEY` for secured deployments)
 - **GitHub Copilot** (requires OAuth, see below)
 - **Google Gemini CLI** (requires OAuth, see below)
-- **Antigravity** (requires OAuth, see below)
+- **Google Antigravity** (requires OAuth, see below)
 - **Any OpenAI-compatible API**: LM Studio, custom proxies, etc.
 
 ## Installation
@@ -565,6 +565,8 @@ if (message.stopReason === "error" || message.stopReason === "aborted") {
 }
 ```
 
+If the provider discards partial output by returning an error message with empty `content`, the final result remains empty. Leaked-thinking healing does not reconstruct discarded blocks from earlier streaming deltas.
+
 ### Aborting Requests
 
 The abort signal allows you to cancel in-progress requests. Aborted requests have `stopReason === 'aborted'`:
@@ -1029,7 +1031,7 @@ Several providers support OAuth authentication (some also support static API key
 - **OpenAI Codex** (ChatGPT Plus/Pro subscription, access to GPT-5.x Codex models)
 - **GitHub Copilot** (Copilot subscription)
 - **Google Gemini CLI** (Gemini 2.0/2.5 via Google Cloud Code Assist; free tier or paid subscription)
-- **Antigravity** (Free Gemini 3, Claude, GPT-OSS via Google Cloud)
+- **Google Antigravity** (Gemini, Claude, GPT-OSS via Google Cloud)
 - **Qwen Portal** (Qwen OAuth token or API key)
 - **Snowflake Cortex** (Snowflake account OAuth with PKCE and refresh, subject to the account's local-application integration)
 

package/THIRD-PARTY-NOTICES.txt

@@ -8,8 +8,8 @@ no rights in third-party code, fonts, data, or marks identified below.
 PYTHON DEPENDENCY DISTRIBUTION ROLE
 ===================================
 
-omp-rpc has no third-party runtime dependencies. robomp declares FastAPI,
-Uvicorn, HTTPX, Pydantic, pydantic-settings, python-dotenv, Click, and omp-rpc
+zeta-rpc has no third-party runtime dependencies. robomp declares FastAPI,
+Uvicorn, HTTPX, Pydantic, pydantic-settings, python-dotenv, Click, and zeta-rpc
 as ordinary installer-resolved dependencies. The Python wheels do not vendor
 those projects; each dependency remains a separately installed distribution
 carrying its own license metadata and files. Container/system assemblers must
@@ -79,9 +79,9 @@ uutils coreutils (https://github.com/uutils/coreutils), MIT
 --------------------------------------------------------------------------------
 Covers: base32, base64, basename, cat, cksum (shared checksum machinery),
 b2sum, md5sum, sha1sum, sha224sum, sha256sum, sha384sum, sha512sum, comm, cp,
-cut, date, dirname, head, hostname, ln, ls, mkdir, mktemp, mv, nproc, paste,
-printenv, readlink, realpath, rm, seq, sort, stat, tac, tail, tee, touch, tr,
-truncate, uname, uniq, wc, whoami, yes.
+cut, date, dirname, head, hostname, ln, ls, mkdir, mktemp, mv, nl, nproc,
+paste, printenv, readlink, realpath, rm, seq, sort, stat, tac, tail, tee,
+touch, tr, truncate, uname, uniq, wc, whoami, yes.
 
   Copyright (c) uutils developers
 
@@ -824,6 +824,56 @@ public licenses.
 
 Creative Commons may be contacted at creativecommons.org.
 
+-------------------------------------------------------------------------------
+scripts/brand/fonts/ANSI Shadow.flf, scripts/brand/fonts/mini.flf
+
+Two FIGlet font files from the standard FIGlet font distribution — the
+figlet.org font set shipped by figlet.js
+(https://github.com/patorjk/figlet.js/tree/master/fonts), fetched from
+figlet.js 1.8.0 — vendored so the welcome/splash brand art
+(`packages/tui/src/prompt/welcome.ts`) is generated reproducibly and offline
+by `bun scripts/brand/generate-logo-art.ts`. Both files are unmodified and
+retain their original FIGlet headers. They are build-time inputs only: no font
+file or font data is compiled into, or shipped with, a Zeta release artifact.
+The fonts' own headers carry their terms:
+
+- `ANSI Shadow.flf` — "ANSI Shadow". Author unknown ("Font Author: ?" in the
+  header); a TheDraw-archive font converted with the FIGlet font editor
+  (http://patorjk.com/figfont-editor). Distributed under the FIGlet font
+  license as carried by the standard FIGlet font set: free to use and
+  redistribute with the header intact.
+- `mini.flf` — "mini" by Glenn Chappell (4/93), from figlet release 2.1
+  (12 Aug 1994), "Includes ISO Latin-1"; modified by Paul Burton
+  <solution@earthlink.net> 12/96. Header grant: "Permission is hereby given to
+  modify this font, as long as the modifier's name is placed on a comment
+  line."
+
+FIGlet renderer — `figlet` 1.8.0 (https://github.com/patorjk/figlet.js), a
+root devDependency used only to generate the art at build time; it is not
+imported by any runtime bundle or shipped artifact.
+
+  MIT License
+
+  Copyright (C) 2014-present Patrick Gillespie and other contributors
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy
+  of this software and associated documentation files (the "Software"), to deal
+  in the Software without restriction, including without limitation the rights
+  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  copies of the Software, and to permit persons to whom the Software is
+  furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included in
+  all copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+  SOFTWARE.
+
 BUN / NPM DEPENDENCY INVENTORY
 ==============================
 This inventory is traversed from bun.lock, not from the host node_modules tree.

package/dist/types/auth/cascade.d.ts

@@ -2,7 +2,7 @@ import { type ApiKeyResolver, type ResolvedApiKey } from "../auth-retry.js";
 import type { SessionAffinity } from "./affinity.js";
 import type { CredentialPool } from "./pool.js";
 import type { CredentialSelector } from "./select.js";
-import type { AuthApiKeyOptions, AuthCredential, AuthSource, AuthSourceOptions, KeysApi, LimitsApi } from "./types.js";
+import type { AuthApiKeyOptions, AuthPeekOptions, AuthCredential, AuthSource, AuthSourceOptions, KeysApi, LimitsApi } from "./types.js";
 /** Runtime (--api-key) and config (models.yml) key overrides plus the config-value resolver. */
 export declare class KeyOverrides {
     #private;
@@ -126,9 +126,11 @@ export declare class KeyCascade implements KeysApi {
      * Used for model discovery where we only need to know if credentials exist
      * and get a best-effort token. GitHub Copilot's peek must preserve
      * enterprise routing metadata because discovery needs a structured
-     * credential to reach the correct host.
+     * credential to reach the correct host. With several stored accounts every
+     * peek returns the same one, so credential-scoped discovery caches stay on
+     * one namespace.
      */
-    peek(provider: string): Promise<string | undefined>;
+    peek(provider: string, options?: AuthPeekOptions): Promise<string | undefined>;
     /**
      * Resolve a bearer together with the stored row that supplied it, for a request.
      * Same precedence as {@link KeyCascade.get}, but rejects with

package/dist/types/auth/pool.d.ts

@@ -49,7 +49,7 @@ export declare class CredentialPool implements CredentialsApi {
      * The store is shared across every zeta process, but the pool is an
      * in-process cache refreshed only by this process's own writes. Without
      * this a long-running session ranks a stale pool for its whole lifetime:
-     * `zeta-c auth` in another terminal is invisible, rotation reports no usable
+     * `zetacode auth` in another terminal is invisible, rotation reports no usable
      * sibling while a freshly added account sits unblocked in SQLite, and the
      * turn degrades to the fallback chain. The auth-broker path already polls;
      * direct-store sessions had no equivalent.
@@ -178,7 +178,7 @@ export declare class CredentialPool implements CredentialsApi {
      */
     snapshot(): AuthCredentialSnapshot;
     /**
-     * Disabled credential tombstones for display surfaces (`zeta-c usage`,
+     * Disabled credential tombstones for display surfaces (`zetacode usage`,
      * broker `GET /v1/credentials/disabled`). Empty when the backing store
      * keeps no tombstones or the remote broker predates the endpoint.
      */
@@ -187,7 +187,7 @@ export declare class CredentialPool implements CredentialsApi {
      * Force the backing store to revalidate its credential snapshot, then
      * reload. Remote broker stores re-fetch the snapshot; local stores are
      * always current, so only the reload runs. Callers that pair live
-     * per-credential data with stored identities (`zeta-c usage`) use this so a
+     * per-credential data with stored identities (`zetacode usage`) use this so a
      * disk-cached snapshot cannot misattribute fresh reports.
      */
     revalidate(): Promise<void>;

package/dist/types/auth/select.d.ts

@@ -55,7 +55,11 @@ export declare class CredentialSelector {
     /**
      * Selects a credential of the specified type for a provider.
      * Returns both the credential and its index in the original array (for updates/removal).
-     * Uses deterministic hashing for session stickiness and skips blocked credentials when possible.
+     * With `sessionId` the scan starts at the session's hashed index; without one it starts at the
+     * first stored credential and never advances round-robin. Model discovery peeks through this,
+     * and credential-scoped catalogs (e.g. GitHub Copilot) key their cache rows on the credential
+     * picked, so a rotating pick would read another account's cache namespace on every pass.
+     * Blocked credentials are skipped when possible.
      */
     selectByType<T extends AuthCredential["type"]>(provider: string, type: T, sessionId?: string, filter?: (credential: AuthCredential) => boolean): {
         credential: Extract<AuthCredential, {

package/dist/types/auth/types.d.ts

@@ -80,7 +80,7 @@ export interface StoredCredentialBlock {
 /**
  * Identity slice of a disabled (soft-deleted) credential tombstone — cause and
  * account identity only, never token material. Surfaced so auto-disabled
- * accounts (e.g. an expired Anthropic OAuth grant) stay visible in `zeta-c usage`
+ * accounts (e.g. an expired Anthropic OAuth grant) stay visible in `zetacode usage`
  * instead of silently vanishing until the user notices missing quota.
  */
 export interface DisabledCredentialSummary {
@@ -631,6 +631,15 @@ export interface AuthSourceOptions {
      */
     env?: "dedicated" | "aliases" | "none";
 }
+/** Options for {@link KeysApi.peek}. */
+export interface AuthPeekOptions {
+    /**
+     * Fall back to an expired OAuth access token when no stored account holds an
+     * unexpired one. Only for reads that never send the token, e.g. keying an
+     * offline model-cache lookup on the account it names.
+     */
+    includeExpired?: boolean;
+}
 /** Where a provider's auth comes from ({@link CredentialOrigin}) plus whether any leg holds a concrete key. */
 export interface AuthSource extends CredentialOrigin {
     /** False when the only auth is an ambient AUTHENTICATED_SENTINEL source (AWS profile, ADC). */
@@ -746,7 +755,7 @@ export interface CredentialsApi {
      * Force the backing store to revalidate its credential snapshot, then
      * reload. Remote broker stores re-fetch the snapshot; local stores are
      * always current, so only the reload runs. Callers that pair live
-     * per-credential data with stored identities (`zeta-c usage`) use this so a
+     * per-credential data with stored identities (`zetacode usage`) use this so a
      * disk-cached snapshot cannot misattribute fresh reports.
      */
     revalidate(): Promise<void>;
@@ -805,7 +814,7 @@ export interface CredentialsApi {
      */
     disable(id: number, disabledCause: string): Promise<boolean>;
     /**
-     * Disabled credential tombstones for display surfaces (`zeta-c usage`,
+     * Disabled credential tombstones for display surfaces (`zetacode usage`,
      * broker `GET /v1/credentials/disabled`). Empty when the backing store
      * keeps no tombstones or the remote broker predates the endpoint.
      */
@@ -852,9 +861,10 @@ export interface KeysApi {
      * Peek at API key for a provider without refreshing OAuth tokens.
      * Used for model discovery where we only need to know if credentials exist
      * and get a best-effort token. For GitHub Copilot we preserve enterprise
-     * routing metadata so discovery can hit the correct host.
+     * routing metadata so discovery can hit the correct host. Repeated peeks
+     * return the same stored credential; they never rotate accounts.
      */
-    peek(provider: string): Promise<string | undefined>;
+    peek(provider: string, options?: AuthPeekOptions): Promise<string | undefined>;
     /** Resolve the first active auth source by precedence without refreshing credentials. */
     source(provider: string, options?: AuthSourceOptions): AuthSource | undefined;
     /**

package/dist/types/auth/usage-cache.d.ts

@@ -2,7 +2,7 @@ import type { AuthCredentialStore } from "./store.js";
 import type { AuthCredential, OAuthCredential } from "./types.js";
 import type { CredentialPool } from "./pool.js";
 import type { Provider } from "../types.js";
-import type { UsageCredential, UsageProvider } from "../usage.js";
+import type { UsageCredential, UsageProvider, UsageReport } from "../usage.js";
 /** Minimum interval between non-exhausted header snapshots; used by UsageService. */
 export declare const USAGE_HEADER_INGEST_INTERVAL_MS = 60000;
 /**
@@ -56,6 +56,8 @@ export declare class UsageCache {
     failureKey(reportKey: string): string;
     get<T>(key: string): UsageCacheEntry<T> | undefined;
     getStale<T>(key: string): UsageCacheEntry<T> | undefined;
+    /** Last successful report under `key` while inside its retention window; the failure-path fallback. */
+    lastGood(key: string): UsageReport | null;
     set<T>(key: string, entry: UsageCacheEntry<T>): void;
     deletePrefix(prefix: string): boolean;
     markForceRefresh(provider?: Provider): void;

package/dist/types/auth-gateway/clients.d.ts

@@ -0,0 +1,67 @@
+import type { SessionsApi } from "../auth/types.js";
+import type { Api, Model } from "../types.js";
+/** One scoped client. */
+export interface AuthGatewayClient {
+    /** Operator-chosen name, logged with the client's requests. */
+    name: string;
+    /** Hex SHA-256 digest of the client's bearer token. */
+    tokenSha256: string;
+    /** `provider/id` or `provider/*` grants; absent allows every served model, `[]` none. */
+    models?: readonly string[];
+    /** Provider id → OAuth identity keys the client's requests to that provider may use. */
+    accounts?: Readonly<Record<string, readonly string[]>>;
+}
+/** An admitted scoped client, as the gateway's routes see it. */
+export interface AuthGatewayClientScope {
+    readonly name: string;
+    /** False when the client may call every served model. */
+    readonly limitsModels: boolean;
+    /** Whether the client may call `model`. */
+    allows(model: Model<Api>): boolean;
+    /**
+     * Session id the client's credential lookups for `provider` resolve under:
+     * its own restricted session when `accounts` lists the provider, otherwise
+     * the request's `sessionId`. Throws for a provider `accounts` omits, and for
+     * a bound provider once the restriction is lifted, so a lookup can never
+     * resolve unrestricted on the client's behalf.
+     */
+    credentialSessionId(provider: string, sessionId: string): string;
+    /**
+     * Hold the client's account restriction while a request uses it; call the
+     * returned release once the request can no longer resolve a credential. A
+     * reload that retires the client lifts the restriction only after every
+     * hold is released. Take the first hold in the same tick as
+     * `authenticate`, before a reload can retire the client.
+     */
+    retain(): () => void;
+}
+/**
+ * Parse a clients file: a JSON object mapping each client name to
+ * `{ tokenSha256, models?, accounts? }`. Any malformed entry or unknown field
+ * rejects the whole file, since a misspelled `models` would otherwise allow
+ * every model. Errors name the offending field, never its value.
+ */
+export declare function parseAuthGatewayClients(text: string): AuthGatewayClient[];
+/** Hex SHA-256 digest of a bearer token, as `tokenSha256` records it. */
+export declare function hashAuthGatewayToken(token: string): string;
+type RestrictionSessions = Pick<SessionsApi, "restrict" | "unrestrict">;
+/**
+ * The scoped clients one gateway admits, looked up by the digest of the
+ * presented bearer.
+ */
+export declare class AuthGatewayClientTable {
+    #private;
+    constructor(sessions: RestrictionSessions, gatewayTokens: Iterable<string>);
+    /**
+     * Replace the admitted clients. An invalid table throws and changes
+     * nothing. An unchanged client keeps its scope; a new or changed one is
+     * restricted before its token is admitted; the scopes left out are retired.
+     * Ignored once the table is closed.
+     */
+    set(clients: readonly AuthGatewayClient[]): void;
+    /** The client `token` authenticates, if any. */
+    authenticate(token: string): AuthGatewayClientScope | undefined;
+    /** Admit no more clients and retire every scope. */
+    close(): void;
+}
+export {};

package/dist/types/auth-gateway/dispatch.d.ts

@@ -3,6 +3,7 @@ import type { AuthStorage } from "../auth-storage.js";
 import { type GatewayErrorClassification } from "../error/gateway.js";
 import type { Api, FetchImpl, Model, Usage } from "../types.js";
 import type { ClientUsageIdentity } from "../usage.js";
+import type { AuthGatewayClientScope } from "./clients.js";
 import type { AuthGatewayServerOptions } from "./types.js";
 export type ModelResolver = (modelId: string) => Model<Api> | undefined;
 /** What the gateway's routes need, whatever transport carries the requests. */
@@ -21,7 +22,15 @@ export interface AuthGatewayRouteOptions {
     excludeProviders?: ReadonlySet<string>;
     /** Upstream transport for every provider call; defaults to global `fetch`. Test seam. */
     fetch?: FetchImpl;
+    /**
+     * The scoped client that sent this request, set per request by the HTTP
+     * server: it narrows `resolveModel` / `listModels`, and every credential
+     * lookup below resolves under its {@link AuthGatewayClientScope.credentialSessionId}.
+     */
+    client?: AuthGatewayClientScope;
 }
+/** The route options a request's credential lookups read. */
+export type AuthGatewayCredentialOptions = Pick<AuthGatewayRouteOptions, "storage" | "client">;
 /** The HTTP server's options: the routes' plus its listener and inbound auth. */
 export interface AuthGatewayBootOptions extends AuthGatewayServerOptions, AuthGatewayRouteOptions {
 }
@@ -37,13 +46,20 @@ export declare function normalizeClientSessionKey(clientKey: string | undefined)
  *
  * `markUsageLimitReached` and the auth-retry resolver switch a session to a
  * sibling credential, so the provider state retained for that session can
- * outlive the account that taught it. OAuth rows expose an account id / email
- * that survives token refresh — fingerprinting the bearer instead would look
+ * outlive the account that taught it. A stored credential keeps its durable
+ * row id across token refreshes — fingerprinting the bearer instead would look
  * like a rotation every time a token refreshes and discard the retained
- * lessons for nothing. Key-based rows fall back to a hash of the key, never
- * the key itself: this value is held for the lifetime of the entry.
+ * lessons for nothing. The id comes from the selection itself, not the
+ * session's current pin, which a concurrent request on the same session may
+ * have moved. Unstored keys fall back to a hash of the key, never the key
+ * itself: this value is held for the lifetime of the entry.
  */
-export declare function resolveGatewayAccount(storage: AuthStorage, provider: string, sessionId: string, apiKey: string): string;
+export declare function resolveGatewayAccount(resolved: ResolvedApiKey): string;
+/** Who sent a request and which stored credential it started on, for the `auth-gateway request` log line. */
+export declare function gatewayRequestLogFields(opts: AuthGatewayCredentialOptions, resolved: ResolvedApiKey): {
+    client?: string;
+    credentialId?: number;
+};
 /**
  * Resolve the credential for one request from broker-backed storage.
  *
@@ -53,7 +69,7 @@ export declare function resolveGatewayAccount(storage: AuthStorage, provider: st
  * stored token before dispatch. Storage failures map through
  * {@link classifyGatewayError}; a provider without any credential is a 401.
  */
-export declare function resolveGatewayApiKey(storage: AuthStorage, model: Model<Api>, sessionId: string, signal: AbortSignal, peer: string): Promise<ResolvedApiKey | GatewayErrorClassification>;
+export declare function resolveGatewayApiKey(opts: AuthGatewayCredentialOptions, model: Model<Api>, sessionId: string, signal: AbortSignal, peer: string): Promise<ResolvedApiKey | GatewayErrorClassification>;
 /**
  * Build the {@link ApiKeyResolver} handed to a pi-ai client for a gateway
  * request. Drives the central a/b/c auth-retry policy server-side:
@@ -67,11 +83,13 @@ export declare function resolveGatewayApiKey(storage: AuthStorage, model: Model<
  * `lastKey` tracks the most recent bearer so the switch step invalidates the
  * credential that actually failed; a retry context's `previousKey` wins, since
  * concurrent operations sharing one resolver (split judgment chunks) each know
- * the bearer they sent. `onResolvedKey` observes every rotation; routes that
- * retain provider session state use it to re-key the account lease, one-shot
- * routes pass `undefined`.
+ * the bearer they sent. Every step resolves under the scoped client's
+ * credential session when `opts.client` binds the provider, so refresh,
+ * blocking and sibling rotation stay inside its accounts. `onResolvedKey`
+ * observes every rotation; routes that retain provider session state use it
+ * to re-key the account lease, one-shot routes pass `undefined`.
  */
-export declare function buildGatewayApiKeyResolver(storage: AuthStorage, model: Model<Api>, sessionId: string, initialKey: ResolvedApiKey, requestSignal: AbortSignal, format: string, peer: string, onResolvedKey?: (apiKey: string) => void): ApiKeyResolver;
+export declare function buildGatewayApiKeyResolver(opts: AuthGatewayCredentialOptions, model: Model<Api>, sessionId: string, initialKey: ResolvedApiKey, requestSignal: AbortSignal, format: string, peer: string, onResolvedKey?: (resolved: ResolvedApiKey) => void): ApiKeyResolver;
 /**
  * Attribute one settled upstream request to the originating client via the
  * broker's observed-usage channel (`AuthStorage.usage.observe`, batched

package/dist/types/auth-gateway/http.d.ts

@@ -24,6 +24,8 @@ export declare function hasMisplacedBearer(req: Request, url: URL, tokens: Reado
  * of the longer input so length itself doesn't leak via timing.
  */
 export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;
+/** The token of an `Authorization: Bearer <token>` header, trimmed; `undefined` without one. */
+export declare function readBearerToken(req: Request): string | undefined;
 export declare function isAuthorized(req: Request, tokens: ReadonlySet<string>): boolean;
 /**
  * Extract allow-listed passthrough headers from an inbound request. Keys are

package/dist/types/auth-gateway/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./clients.js";
 export * from "./dispatch.js";
 export * from "./http.js";
 export * from "./session-state.js";

package/dist/types/auth-gateway/server.d.ts

@@ -27,12 +27,17 @@
  * answers the `/v1/*` routes for any transport: {@link startAuthGateway}
  * serves them over HTTP behind bearer auth, `stdio.ts` over JSON lines.
  */
+import { type AuthGatewayClientScope } from "./clients.js";
 import { type AuthGatewayBootOptions, type AuthGatewayRouteOptions } from "./dispatch.js";
 import type { AuthGatewayServerHandle } from "./types.js";
 /** The gateway's `/v1/*` routes, for a transport that has already admitted the caller. */
 export interface AuthGatewayRouter {
-    /** Answers one request; `peer` names the caller in logs. Never rejects: a crashed route answers 500. */
-    route(req: Request, peer: string): Promise<Response>;
+    /**
+     * Answers one request; `peer` names the caller in logs, `client` is the
+     * scoped client the transport admitted, if any. Never rejects: a crashed
+     * route answers 500.
+     */
+    route(req: Request, peer: string, client?: AuthGatewayClientScope): Promise<Response>;
     /**
      * Closes the retained provider session state (Codex WebSockets, GitLab Duo
      * workflows), whose sockets and timers would otherwise keep the process alive.
@@ -40,8 +45,8 @@ export interface AuthGatewayRouter {
     close(): void;
 }
 /**
- * The gateway's routes over `opts`, owning their per-session provider state:
+ * The gateway's routes over `hostOpts`, owning their per-session provider state:
  * two routers in one process never share (or tear down) each other's.
  */
-export declare function createAuthGatewayRouter(opts: AuthGatewayRouteOptions): AuthGatewayRouter;
+export declare function createAuthGatewayRouter(hostOpts: AuthGatewayRouteOptions): AuthGatewayRouter;
 export declare function startAuthGateway(opts: AuthGatewayBootOptions): AuthGatewayServerHandle;

package/dist/types/auth-gateway/session-state.d.ts

@@ -77,6 +77,12 @@ export interface AuthGatewaySessionStateRequest {
      * resolves a sibling credential.
      */
     account: string;
+    /**
+     * Name of the scoped gateway client that sent the request, if any. A
+     * client's conversations never share retained state with another client's,
+     * or with unscoped traffic, even when their keys or histories match.
+     */
+    client?: string;
 }
 /**
  * Bounded per-session provider state, owned by one gateway server instance.

package/dist/types/auth-gateway/types.d.ts

@@ -1,7 +1,8 @@
 import type { Effort } from "@linxiraos/pi-catalog/effort";
+import type { AuthGatewayClient } from "./clients.js";
 import type { AssistantMessage, AssistantMessageEventStream, CacheRetention, Context, OpenAIResponseInclude, ServiceTier, TokenTaskBudget } from "../types.js";
 /**
- * Wire types for the zeta-c auth-gateway.
+ * Wire types for the zetacode auth-gateway.
  *
  * The gateway sits between unauthenticated clients (containerized zeta,
  * llm-git, …) and the broker. It accepts provider-format HTTP requests
@@ -123,8 +124,14 @@ export interface AuthGatewayFormatModule {
 export interface AuthGatewayServerOptions {
     /** Listen address. Default `127.0.0.1:4000`. */
     bind?: string;
-    /** Accept any of these bearer tokens. Empty allows unauthenticated calls. */
+    /** Accept any of these bearer tokens. Empty allows unauthenticated calls unless `clients` is set. */
     bearerTokens: string[];
+    /**
+     * Scoped clients, each admitted by its own bearer and limited to its models
+     * and accounts (see `clients.ts`). Any table, even an empty one, requires a
+     * bearer on every request. Throws at startup when invalid.
+     */
+    clients?: readonly AuthGatewayClient[];
     /** Honor forwarded peer headers only when the connecting proxy is trusted. Default false. */
     trustProxyHeaders?: boolean;
     /** Version surfaced on `/healthz`. */
@@ -135,4 +142,11 @@ export interface AuthGatewayServerHandle {
     port: number;
     hostname: string;
     close(): Promise<void>;
+    /**
+     * Replace the scoped clients. A removed or changed token is refused from
+     * the next request on; a request already in flight keeps the models and
+     * accounts it was admitted with, retries included, until it finishes.
+     * Throws, changing nothing, when the table is invalid. Turns bearer auth on.
+     */
+    setClients(clients: readonly AuthGatewayClient[]): void;
 }

package/dist/types/dialect/coercion.d.ts

@@ -21,3 +21,9 @@ export declare function partialSuffixOverlap(text: string, tag: string): number;
 export declare function partialSuffixOverlapAny(text: string, tags: readonly string[]): number;
 export declare function normalizeKimiFunctionName(rawId: string): string;
 export declare function asRecord(value: unknown): Record<string, unknown>;
+/**
+ * Extract a COMPLETE tool name from a partial in-band JSON body.
+ * Returns undefined until the name string is fully closed, so streaming
+ * scanners never start a tool call under a truncated name.
+ */
+export declare function parseCompleteToolName(body: string): string | undefined;