@linxiraos/pi-ai 1.2.0 → 1.3.0

package/src/providers/connection-prewarm.ts

@@ -0,0 +1,78 @@
+import { isCatalogEndpointUrl } from "@linxiraos/pi-catalog/compat/catalog-endpoint";
+import { logger } from "@linxiraos/pi-utils";
+import type { Api, FetchImpl, Model } from "../types";
+import { lastDispatchOrigin, transportFetch } from "../utils/transport-fetch";
+import { resolveAnthropicPrewarmTarget } from "./anthropic";
+
+/**
+ * Minimum gap between warm-ups of one origin. Idle pooled sockets outlive it
+ * by minutes (Copilot drops them after ~2.5–5 min, most hosts later), so a
+ * tighter cadence would only add requests.
+ */
+const PREWARM_INTERVAL_MS = 30_000;
+const PREWARM_TIMEOUT_MS = 10_000;
+
+const prewarmedAt = new Map<string, number>();
+
+/**
+ * Where a warm-up for {@link model} goes, or `undefined` when it must not be
+ * probed. First-party Anthropic resolves its effective endpoint (following
+ * `ANTHROPIC_BASE_URL`/Foundry reroutes) and TLS options up front. Every
+ * other model warms only the origin its last inference request actually
+ * reached, so credential endpoints (Copilot plans), env overrides
+ * (`MOONSHOT_BASE_URL`, `XAI_BASE_URL`), and regional hosts are never guessed
+ * from `baseUrl`; before its first request there is nothing to warm. That
+ * origin must also be the provider's own endpoint: a custom provider, or a
+ * catalog provider id routed to a gateway, proxy, or local server, is never
+ * probed.
+ */
+function resolvePrewarmTarget(model: Model<Api>): { origin: string; init: RequestInit } | undefined {
+	if (model.provider === "anthropic") {
+		const target = resolveAnthropicPrewarmTarget(model);
+		return target && { origin: new URL(target.url).origin, init: target.init };
+	}
+	const origin = lastDispatchOrigin(model);
+	if (!origin || !isCatalogEndpointUrl(model, origin)) return undefined;
+	return { origin, init: {} };
+}
+
+/**
+ * Opens, or keeps alive, a pooled connection to {@link model}'s API host so
+ * the next turn skips DNS + TCP + TLS. Sends a credential-less `HEAD` (nothing
+ * is billed; hosts answer 401/404/405) through the same transport — proxy,
+ * extra CA, Cowork profile, TLS options — as real requests, because sockets
+ * pool per transport configuration and a warm-up made any other way (e.g.
+ * `fetch.preconnect`, which also throws on Windows) is never reused.
+ * Throttled per origin; best effort, never throws.
+ */
+export async function prewarmModelConnection(model: Model<Api>, options?: { fetch?: FetchImpl }): Promise<void> {
+	let origin: string | undefined;
+	try {
+		// Inside the boundary: resolving Anthropic's TLS options throws on an
+		// unusable CA or client-certificate setup, which the real request reports.
+		const target = resolvePrewarmTarget(model);
+		if (!target) return;
+		origin = target.origin;
+		const now = Date.now();
+		const last = prewarmedAt.get(origin);
+		if (last !== undefined && now - last < PREWARM_INTERVAL_MS) return;
+		prewarmedAt.set(origin, now);
+		const response = await transportFetch(model, options?.fetch)(origin, {
+			...target.init,
+			method: "HEAD",
+			headers: {},
+			signal: AbortSignal.timeout(PREWARM_TIMEOUT_MS),
+		});
+		await response.body?.cancel();
+	} catch (error) {
+		logger.debug("Model connection prewarm failed", {
+			origin,
+			error: error instanceof Error ? error.message : String(error),
+		});
+	}
+}
+
+/** Test hook: forgets every warm-up so the next call is not throttled. */
+export function resetConnectionPrewarmForTesting(): void {
+	prewarmedAt.clear();
+}

package/src/providers/cowork-fetch.ts

@@ -198,7 +198,11 @@ async function sendCoworkRequest(
 	};
 	const abort = (): void => {
 		const reason = signal?.reason;
-		request?.destroy(reason instanceof Error ? reason : new DOMException("The operation was aborted.", "AbortError"));
+		const error = reason instanceof Error ? reason : new DOMException("The operation was aborted.", "AbortError");
+		request?.destroy(error);
+		// Bun before 1.4 emits 'close' but not 'error' for destroy(error), so the
+		// 'error' listener below never settles a request still waiting for headers.
+		result.reject(error);
 	};
 	if (signal?.aborted) {
 		release();

package/src/providers/cursor/exec-modern.ts

@@ -86,6 +86,7 @@ export {
 	piReadPath,
 	piReadPathHasRange,
 	piTimeout,
+	shellDeadlineSeconds,
 	shellTimeoutSeconds,
 } from "../cursor-pi-args";
 

package/src/providers/cursor-pi-args.ts

@@ -209,6 +209,25 @@ export function shellTimeoutSeconds(timeoutMs: number | undefined): number | und
 	return Math.max(1, Math.round(timeoutMs / 1000));
 }
 
+/** The bash tool's deadline when its `timeout` is omitted. */
+const BASH_DEFAULT_DEADLINE_SECONDS = 300;
+
+/**
+ * The bash-tool kill deadline, in seconds, for a Cursor `ShellArgs`/`ShellStreamArgs` frame.
+ *
+ * Cursor's `timeout` carries the model's `block_until_ms`, which Cursor's Shell tool documents as
+ * how long to block before moving the command to the background, not as a kill deadline; the kill
+ * deadline is `hard_timeout`. Without one, a short wait (`block_until_ms: 5000` on a build) must not
+ * kill the command: the deadline stays the bash default (`undefined`), raised to the wait only when
+ * the wait is longer.
+ */
+export function shellDeadlineSeconds(args: { timeout: number; hardTimeout?: number }): number | undefined {
+	const hardSeconds = shellTimeoutSeconds(args.hardTimeout);
+	if (hardSeconds !== undefined) return hardSeconds;
+	const waitSeconds = shellTimeoutSeconds(args.timeout);
+	return waitSeconds !== undefined && waitSeconds > BASH_DEFAULT_DEADLINE_SECONDS ? waitSeconds : undefined;
+}
+
 /**
  * Drop keys whose value is `undefined` so optional local-tool kwargs stay
  * absent rather than present-as-undefined.

package/src/providers/cursor.ts

@@ -261,7 +261,7 @@ import {
 	piReadDisplayPath,
 	piReadPathHasRange,
 	piTimeout,
-	shellTimeoutSeconds,
+	shellDeadlineSeconds,
 } from "./cursor/exec-modern";
 import { handleInteractionQuery, protoUnknownFields } from "./cursor/interaction-query";
 
@@ -348,6 +348,18 @@ function isCursorModelNotFound(error: unknown): boolean {
 	);
 }
 
+/**
+ * Failures that, before any token, mean the wire conversation is poisoned
+ * rather than the account: a bare gRPC `resource_exhausted` (#8345), or the
+ * structured PROVIDER_ERROR every resume of a turn cut mid-stream draws (#15830).
+ */
+function isCursorConversationRejected(error: unknown, message: string): boolean {
+	return (
+		(error instanceof AIError.ProviderHttpError && error.code === "PROVIDER_ERROR") ||
+		RESOURCE_EXHAUSTED_PATTERN.test(message)
+	);
+}
+
 const CURSOR_MAX_STREAM_RETRIES = 5;
 const CURSOR_RETRY_BASE_DELAY_MS = 500;
 const NOT_IMPLEMENTED = `Not implemented by this client`;
@@ -1814,13 +1826,14 @@ function streamCursorWithWireMode(
 				flushOpenToolCalls(output, stream, openBlockState);
 			}
 			const result = await AIError.finalize(error, { api: model.api, signal: options?.signal });
-			// #8345: a server-side per-conversation rejection surfaces as a bare
-			// resource_exhausted with zero tokens — the conversation is poisoned,
-			// not the account. Rotate the wire id and rebuild from `context` on
-			// the next attempt (the caller's retry loop). Do not migrate cached
-			// side-state: pendingToolCalls from a mid-turn checkpoint re-poison
-			// the new id. One rotation per failure streak; a new rotation is
-			// allowed only after the current rotated id completed a turn.
+			// #8345/#15830: a server-side per-conversation rejection (a bare
+			// resource_exhausted, or PROVIDER_ERROR after a mid-turn cut) with zero
+			// tokens means the conversation is poisoned, not the account. Rotate
+			// the wire id and rebuild from `context` on the next attempt (the
+			// caller's retry loop). Do not migrate cached side-state:
+			// pendingToolCalls from a mid-turn checkpoint re-poison the new id.
+			// One rotation per failure streak; a new rotation is allowed only
+			// after the current rotated id completed a turn.
 			const currentRotated =
 				baseConversationId === undefined ? undefined : rotatedConversationIds.get(baseConversationId);
 			const canRotate = currentRotated === undefined || successfulRotatedConversationIds.has(currentRotated);
@@ -1829,7 +1842,7 @@ function streamCursorWithWireMode(
 				baseConversationId !== undefined &&
 				usageState !== undefined &&
 				!usageState.sawTokenDelta &&
-				RESOURCE_EXHAUSTED_PATTERN.test(result.message) &&
+				isCursorConversationRejected(error, result.message) &&
 				canRotate
 			) {
 				const rotated = crypto.randomUUID();
@@ -2668,7 +2681,7 @@ async function handleExecServerMessage(
 			synthesizeCursorExecToolCall(output, stream, state, args.toolCallId, "bash", {
 				command: args.command,
 				cwd: args.workingDirectory || undefined,
-				timeout: shellTimeoutSeconds(args.timeout),
+				timeout: shellDeadlineSeconds(args),
 			});
 			const { execResult } = await resolveExecHandler(
 				args,
@@ -2689,7 +2702,7 @@ async function handleExecServerMessage(
 			synthesizeCursorExecToolCall(output, stream, state, args.toolCallId, "bash", {
 				command: args.command,
 				cwd: args.workingDirectory || undefined,
-				timeout: shellTimeoutSeconds(args.timeout),
+				timeout: shellDeadlineSeconds(args),
 			});
 			await handleShellStreamArgs(args, execMsg, runTransport, execHandlers, onToolResult);
 			return;
@@ -3167,7 +3180,7 @@ async function handleExecServerMessage(
 			synthesizeCursorExecToolCall(output, stream, state, args.toolCallId, "bash", {
 				command: args.command,
 				cwd: args.workingDirectory || undefined,
-				timeout: shellTimeoutSeconds(args.timeout),
+				timeout: shellDeadlineSeconds(args),
 			});
 			const { execResult } = await resolveExecHandler(
 				normalizedArgs,
@@ -5076,6 +5089,13 @@ function endCurrentThinkingBlock(
  * call handed to an external executor is only a handoff while the marker is
  * absent, and the consumer that runs it needs a runnable block.
  *
+ * A frame whose `toolCallId` already has a block in `output` is the server
+ * re-dispatching that call (a new `execId`, e.g. a `read` re-sent once a
+ * parallel shell created the file). It adds no block: a second block with the
+ * same id makes every rebuilt history replay the call twice, which Cursor
+ * rejects (issue #15749). The re-run's result supersedes the first one in the
+ * host's result buffer.
+ *
  * Exported for tests to exercise ordering with adjacent text/thinking blocks.
  */
 export function synthesizeCursorExecToolCall(
@@ -5087,6 +5107,7 @@ export function synthesizeCursorExecToolCall(
 	args: Record<string, unknown>,
 	{ executed = true }: { executed?: boolean } = {},
 ): void {
+	if (output.content.some(block => block.type === "toolCall" && block.id === toolCallId)) return;
 	endCurrentTextBlock(output, stream, state);
 	endCurrentThinkingBlock(output, stream, state);
 	// Exec-frame translators often write `optional: value || undefined`. A
@@ -5919,12 +5940,20 @@ interface CursorAssistantStep {
  * the text and reasoning that followed each result; a round ends at a call
  * followed by anything other than another call. Consecutive calls stay in one
  * round — they were issued together. Hidden reasoning still marks a boundary.
+ * A call id repeated within the message — a re-dispatched exec frame recorded
+ * before issue #15749 was fixed — is issued once; Cursor rejects a history that
+ * repeats it.
  */
 function buildCursorAssistantSteps(msg: AssistantMessage, targetModelId: string | undefined): CursorAssistantStep[] {
 	const steps: CursorAssistantStep[] = [];
 	let step: CursorAssistantStep = { content: [], callIds: [] };
 	const replayThinking = canReplayCursorThinking(msg, targetModelId);
+	const issuedCallIds = new Set<string>();
 	for (const item of msg.content) {
+		if (item.type === "toolCall") {
+			if (issuedCallIds.has(item.id)) continue;
+			issuedCallIds.add(item.id);
+		}
 		if (item.type !== "toolCall" && step.callIds.length > 0) {
 			steps.push(step);
 			step = { content: [], callIds: [] };
@@ -6147,7 +6176,14 @@ function buildRootPromptMessagesJson(
 				});
 				continue;
 			}
-			pushToolResult(msg);
+			// A re-dispatched call recorded two results in the same batch; the
+			// re-run's answer is the one the model saw.
+			let result = msg;
+			for (let j = i + 1; j < historyEnd && messages[j].role === "toolResult"; j++) {
+				const later = messages[j];
+				if (later.role === "toolResult" && later.toolCallId === msg.toolCallId) result = later;
+			}
+			pushToolResult(result);
 		}
 	}
 
@@ -6299,6 +6335,8 @@ function buildConversationTurns(
 		while (i < messages.length && messages[i].role !== "user" && messages[i].role !== "developer") {
 			const stepMsg = messages[i];
 			if (stepMsg.role === "assistant") {
+				// Mirrors `buildCursorAssistantSteps`: a repeated call id is issued once.
+				const issuedCallIds = new Set<string>();
 				for (const item of stepMsg.content) {
 					let step: ConversationStep;
 					if (item.type === "text") {
@@ -6322,6 +6360,8 @@ function buildConversationTurns(
 							},
 						});
 					} else if (item.type === "toolCall") {
+						if (issuedCallIds.has(item.id)) continue;
+						issuedCallIds.add(item.id);
 						step = createCursorToolCallStep(item, toolResults.get(item.id));
 					} else {
 						continue;

package/src/providers/devin.ts

@@ -61,7 +61,12 @@ import {
 	ConnectFrameDecoder,
 	frameConnectMessage,
 } from "./connect-frame";
-import { isResponsesFamilyApi, responsesCallComponent, transformMessages } from "./transform-messages";
+import {
+	isResponsesFamilyApi,
+	normalizeToolCallId,
+	responsesCallComponent,
+	transformMessages,
+} from "./transform-messages";
 
 /** Base host for Codeium/Windsurf's Cascade chat API (Connect protocol over HTTP/1.1). */
 export const DEVIN_API_URL = DEVIN_DEFAULT_BASE_URL;
@@ -244,9 +249,10 @@ export const streamDevin: StreamFunction<"devin-agent"> = (
 					context.messages,
 					model,
 					(id, _target, source) =>
-						(isResponsesFamilyApi(source.api) ? responsesCallComponent(id) : id)
-							.replace(/[^a-zA-Z0-9_-]/g, "_")
-							.slice(0, DEVIN_TOOL_CALL_ID_MAX_LENGTH),
+						normalizeToolCallId(
+							isResponsesFamilyApi(source.api) ? responsesCallComponent(id) : id,
+							DEVIN_TOOL_CALL_ID_MAX_LENGTH,
+						),
 					DEVIN_TOOL_CALL_ID_MAX_LENGTH,
 				),
 			};

package/src/providers/factory-droid/gemini.ts

@@ -118,6 +118,11 @@ const GOOGLE_APIS: Record<string, true> = {
  * everything else is DROPPED (never demoted to visible text). A text block
  * keeps its signature only when this model signed it.
  *
+ * Tool-call names are encoded to their wire form here, before
+ * `transformMessages` drops calls whose names no provider could declare: the
+ * proxy accepts any caller tool name once sanitized, so a declared
+ * `my.tool/name` call must survive replay.
+ *
  * Only Google-origin turns are stamped as the target, so `transformMessages`
  * keeps their surviving signatures verbatim instead of demoting/stripping them
  * as cross-model. Their ids are plain in either stamp, so pairing is
@@ -137,8 +142,9 @@ function adoptFactoryReplay(message: Message, model: Model<"factory-droid-agent"
 			if (googleOrigin && block.thinking.trim() && signature && signature !== SKIP_THOUGHT_SIGNATURE) {
 				content.push(block);
 			}
-		} else if (block.type === "toolCall" && !googleOrigin && block.thoughtSignature) {
-			content.push({ ...block, thoughtSignature: undefined });
+		} else if (block.type === "toolCall") {
+			const thoughtSignature = googleOrigin ? block.thoughtSignature : undefined;
+			content.push({ ...block, name: sanitizeFactoryDroidToolName(block.name), thoughtSignature });
 		} else if (block.type === "text" && !sameModel && block.textSignature) {
 			content.push({ ...block, textSignature: undefined });
 		} else {
@@ -204,7 +210,7 @@ function toGeminiContents(
 					parts.push({ text: block.thinking, thoughtSignature: block.thinkingSignature });
 				} else if (block.type === "toolCall") {
 					parts.push({
-						functionCall: { name: sanitizeFactoryDroidToolName(block.name), args: block.arguments },
+						functionCall: { name: block.name, args: block.arguments },
 						...(block.thoughtSignature ? { thoughtSignature: block.thoughtSignature } : {}),
 					});
 				}

package/src/providers/google-gemini-cli.ts

@@ -36,6 +36,7 @@ import { armPreResponseTimeout, getStreamFirstEventTimeoutMs, iterateWithIdleTim
 // the stream provider trusts the access token threaded through `options.apiKey`.
 import { normalizeSchemaForCCA } from "../utils/schema";
 import { StreamMarkupHealing, type StreamMarkupHealingEvent } from "../utils/stream-markup-healing";
+import { prepareAnthropicImageContext } from "./anthropic-images";
 import forcedToolDirective from "./google-antigravity-forced-tool.md" with { type: "text" };
 import type { Content, FunctionCallingConfigMode, ThinkingConfig } from "./google-shared";
 import {
@@ -573,7 +574,16 @@ export const streamGoogleGeminiCli: StreamFunction<"google-gemini-cli"> = (
 				endpoints = baseUrl ? [baseUrl] : [DEFAULT_ENDPOINT];
 			}
 
-			let requestBody = buildRequest(model, context, projectId, options, isAntigravity);
+			// A host that declares an image contract (Claude behind Antigravity)
+			// rejects oversized images, and a rejected image stays in context, so
+			// clamp before building; readers without one take images as sent. The
+			// cost is one pass over the context, as on `anthropic-messages`: images
+			// already within bounds hit the per-image cache and are not decoded.
+			const requestContext =
+				model.compat.maxImageDimension !== undefined || model.compat.maxImagePayloadBytes !== undefined
+					? await prepareAnthropicImageContext(context, model)
+					: context;
+			let requestBody = buildRequest(model, requestContext, projectId, options, isAntigravity);
 			const replacementPayload = await options?.onPayload?.(requestBody, model);
 			if (replacementPayload !== undefined) {
 				requestBody = replacementPayload as typeof requestBody;

package/src/providers/google-shared.ts

@@ -25,7 +25,7 @@ import type {
 	Usage,
 } from "../types";
 import { shouldSendServiceTier } from "../types";
-import { normalizeSystemPrompts } from "../utils";
+import { normalizeSystemPrompts, normalizeToolCallId } from "../utils";
 import { AssistantMessageEventStream } from "../utils/event-stream";
 import type { RawHttpRequestDump } from "../utils/http-inspector";
 import { normalizeSchemaForCCA, normalizeSchemaForGoogle, toolWireSchema } from "../utils/schema";
@@ -162,11 +162,7 @@ export function convertMessages<T extends GoogleApiType>(model: Model<T>, contex
 	const contents: Content[] = [];
 	const emittedToolCallNames = new Map<string, string>();
 
-	const normalizeToolCallId = (id: string): string => {
-		return id.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 64);
-	};
-
-	const transformedMessages = transformMessages(context.messages, model, normalizeToolCallId);
+	const transformedMessages = transformMessages(context.messages, model, id => normalizeToolCallId(id));
 
 	// Gemini < 3 image tool results go in a separate user turn, but parallel tool results must
 	// stay a single contiguous functionResponse turn ("number of function response parts is not

package/src/providers/images-server.ts

@@ -1,5 +1,6 @@
 import { type } from "@linxiraos/pi-omptype";
 import * as AIError from "../error";
+import { isDataUrlMimeType } from "../images/shared";
 import type { ImageGenerationRequest, ImageGenerationResult } from "../images/types";
 
 const imageJsonRequestSchema = type({
@@ -56,7 +57,11 @@ function decodeInputReference(value: unknown): { data: string; mimeType: string
 	}
 	if (typeof raw !== "string" || raw.length === 0) validation("input image must be base64 or a data URL");
 	const match = raw.match(/^data:([^;]+);base64,(.+)$/s);
-	if (match) return { data: match[2] ?? "", mimeType: match[1] ?? "image/png" };
+	if (match) {
+		const mimeType = match[1] ?? "image/png";
+		if (!isDataUrlMimeType(mimeType)) validation("data URL MIME type must not contain a '#' fragment marker");
+		return { data: match[2] ?? "", mimeType };
+	}
 	if (/^[A-Za-z0-9+/]+={0,2}$/.test(raw)) return { data: raw, mimeType: "image/png" };
 	validation("input image URLs are not supported; send a data URL or base64 bytes");
 }

package/src/providers/ollama.ts

@@ -68,6 +68,7 @@ type OllamaMessage = {
 };
 
 type OllamaChatChunk = {
+	error?: string;
 	message?: {
 		role?: string;
 		content?: string;
@@ -252,7 +253,10 @@ function convertMessages(model: Model<"ollama-chat">, context: Context): OllamaM
 		timestamp: Date.now(),
 	}));
 	const messages: Message[] = [...systemMessages, ...context.messages];
-	const isCloud = model.provider === "ollama-cloud";
+	// Model rows cached or bundled before Ollama had a compat record carry none;
+	// stripping is the replay-safe answer for them until they are rebuilt.
+	const compat: Partial<typeof model.compat> | undefined = model.compat;
+	const stripThinkingHistory = compat?.stripThinkingHistory ?? true;
 	const supportsImages = model.input.includes("image");
 	const converted = transformMessages(messages, model).map((msg, index) => {
 		// Real `systemPrompt` entries (always emitted first) stay on Ollama's
@@ -266,10 +270,9 @@ function convertMessages(model: Model<"ollama-chat">, context: Context): OllamaM
 		const developerRole =
 			msg.role === "developer" && (index < systemPrompts.length || msg.attribution !== "user") ? "system" : "user";
 		const converted = convertMessage(msg, supportsImages, developerRole);
-		// Ollama cloud rejects requests when assistant history messages contain the `thinking`
-		// field — it's valid in model responses but not accepted as a history input. Strip it
-		// to prevent HTTP 400 errors. Local Ollama instances are unaffected.
-		if (isCloud && converted.role === "assistant" && converted.thinking) {
+		// Some Ollama Cloud models historically rejected thinking in history (#1000).
+		// Preserve reasoning for the verified model without weakening that guard everywhere.
+		if (stripThinkingHistory && converted.role === "assistant" && converted.thinking) {
 			const { thinking: _t, ...rest } = converted;
 			return rest;
 		}
@@ -619,6 +622,13 @@ const streamOllamaOnce = (
 			}
 			stream.push({ type: "start", partial: output });
 			for await (const chunk of readJsonl<OllamaChatChunk>(response.body)) {
+				// Once HTTP 200 has started, Ollama reports failures as NDJSON error records.
+				if (chunk.error) {
+					throw new AIError.ProviderResponseError(`Ollama stream error: ${chunk.error}`, {
+						provider: model.provider,
+						kind: "runtime",
+					});
+				}
 				if (chunk.message?.thinking) {
 					suppressHealedThinking = true;
 					endActiveTextBlock();

package/src/providers/openai-anthropic-shim.ts

@@ -133,6 +133,7 @@ export function streamOpenAIAnthropicShim(
 					presencePenalty: options?.presencePenalty,
 					repetitionPenalty: options?.repetitionPenalty,
 					maxTokens: options?.maxTokens ?? model.maxTokens ?? undefined,
+					maxHttpAttempts: options?.maxHttpAttempts,
 					signal: options?.signal,
 					headers: mergedHeaders,
 					cacheRetention: config.forwardCacheOptions ? options?.cacheRetention : undefined,

package/src/providers/openai-chat-server.ts

@@ -531,6 +531,13 @@ function makeId(): string {
 // encodeStream (SSE)
 // ---------------------------------------------------------------------------
 
+// Keepalive cadence for the SSE encoder. Some upstreams go silent for minutes
+// mid-stream (e.g. xAI emits a large tool call's arguments only when complete);
+// without bytes on the wire the listener's idle timeout and client watchdogs
+// drop a healthy stream. SSE comment lines are ignored by spec-compliant clients.
+const STREAM_KEEPALIVE_INTERVAL_MS = 15_000;
+const SSE_KEEPALIVE = ": keepalive\n\n";
+
 export function encodeStream(
 	events: AssistantMessageEventStream,
 	requestedModelId: string,
@@ -546,6 +553,13 @@ export function encodeStream(
 		cancelled = true;
 	};
 	control?.signal?.addEventListener("abort", markCancelled, { once: true });
+	let keepaliveTimer: NodeJS.Timeout | undefined;
+	const stopKeepalive = () => {
+		if (keepaliveTimer !== undefined) {
+			clearInterval(keepaliveTimer);
+			keepaliveTimer = undefined;
+		}
+	};
 
 	const baseChunk = (delta: Record<string, unknown>, finishReason: string | null) => ({
 		id,
@@ -584,6 +598,19 @@ export function encodeStream(
 			let hasToolCalls = false;
 			let finishReason: string = "stop";
 
+			keepaliveTimer = setInterval(() => {
+				try {
+					if (cancelled) {
+						stopKeepalive();
+						return;
+					}
+					controller.enqueue(encoder.encode(SSE_KEEPALIVE));
+				} catch {
+					// Controller already closed/errored (client gone); stop the timer.
+					stopKeepalive();
+				}
+			}, STREAM_KEEPALIVE_INTERVAL_MS);
+
 			try {
 				if (cancelled) {
 					controller.close();
@@ -733,11 +760,13 @@ export function encodeStream(
 					controller.close();
 				}
 			} finally {
+				stopKeepalive();
 				control?.signal?.removeEventListener("abort", markCancelled);
 			}
 		},
 		cancel(reason) {
 			cancelled = true;
+			stopKeepalive();
 			control?.signal?.removeEventListener("abort", markCancelled);
 			control?.onCancel?.(reason);
 		},

package/src/providers/openai-codex/access-programs.ts

@@ -65,6 +65,7 @@ export function dropRejectedCodexAccessPrograms(
 function isAccessProgramRejection(error: unknown): boolean {
 	if (!(error instanceof Error)) return false;
 	const code = "code" in error && typeof error.code === "string" ? error.code : undefined;
-	if (code !== undefined && Object.hasOwn(REJECTION_CODES, code)) return true;
+	// HTTP parsing promotes generic error.type to code; only specific codes rule out message fallback.
+	if (code !== undefined && code !== "invalid_request_error") return Object.hasOwn(REJECTION_CODES, code);
 	return REJECTION_PATTERN.test(error.message);
 }