@oh-my-pi/pi-ai 15.9.1 → 15.9.3

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [15.9.2] - 2026-06-05
+
+### Added
+
+- Added an AES-256-GCM auth-broker snapshot cache module and `RemoteAuthCredentialStoreOptions.onSnapshot` so broker clients can persist broker-sourced full snapshots without blocking startup on every run.
+- Added `Model.omitMaxOutputTokens` so providers (notably Ollama proxies fronting cloud catalogs) can suppress `max_output_tokens` (Responses) and `max_tokens`/`max_completion_tokens` (Completions) on the wire while still using the catalog `maxTokens` for local budgeting. Without it, `applyCommonResponsesSamplingParams` unconditionally sent the catalog cap and HTTP-400'd against upstream APIs whose true output limit was unknown to OMP. ([#1881](https://github.com/can1357/oh-my-pi/issues/1881))
+
+### Changed
+
+- Changed usage-ranked OAuth credential selection to pick deterministic session-sticky weighted buckets instead of always choosing the top-ranked account, capping the best account at 2x the baseline session likelihood while keeping equal-priority accounts evenly balanced.
+
+### Fixed
+
+- Fixed parallel `function_call` items on the OpenAI Responses API losing arguments on every call except the last when the upstream server interleaves their stream events (observed against llama.cpp and other local Responses-compat hosts). `processResponsesStream` no longer routes `function_call_arguments.{delta,done}`, `output_item.done`, content_part/text/refusal/reasoning events through a singleton `currentItem`/`currentBlock` reference; it now tracks every open item in registries keyed by `output_index` and `item_id` so each event is folded into the matching block and the emitted `toolcall_end` carries the correct `contentIndex`. ([#1880](https://github.com/can1357/oh-my-pi/issues/1880))
+
 ## [15.9.1] - 2026-06-04
 
 ### Added

package/dist/types/auth-broker/index.d.ts

@@ -2,4 +2,5 @@ export * from "./client";
 export * from "./refresher";
 export * from "./remote-store";
 export * from "./server";
+export * from "./snapshot-cache";
 export * from "./types";

package/dist/types/auth-broker/remote-store.d.ts

@@ -16,6 +16,11 @@ export interface RemoteAuthCredentialStoreOptions {
      * to long-poll permanently when the broker returns 404. Default `true`.
      */
     streamSnapshots?: boolean;
+    /**
+     * Called after broker-sourced full snapshots are applied. The constructor's
+     * initial snapshot intentionally does not trigger this hook.
+     */
+    onSnapshot?: (snapshot: SnapshotResponse, generation: number) => void;
 }
 export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
     #private;

package/dist/types/auth-broker/snapshot-cache.d.ts

@@ -0,0 +1,17 @@
+import type { SnapshotResponse } from "./types";
+export interface ReadAuthBrokerSnapshotCacheOptions {
+    path: string;
+    token: string;
+    url: string;
+    ttlMs: number;
+    /** Override clock for deterministic tests. */
+    now?: () => number;
+}
+export interface WriteAuthBrokerSnapshotCacheOptions {
+    path: string;
+    token: string;
+    url: string;
+    snapshot: SnapshotResponse;
+}
+export declare function readAuthBrokerSnapshotCache(opts: ReadAuthBrokerSnapshotCacheOptions): Promise<SnapshotResponse | null>;
+export declare function writeAuthBrokerSnapshotCache(opts: WriteAuthBrokerSnapshotCacheOptions): Promise<void>;

package/dist/types/auth-broker/types.d.ts

@@ -96,6 +96,8 @@ export declare const DEFAULT_AUTH_BROKER_BIND = "127.0.0.1:8765";
 export declare const DEFAULT_REFRESH_SKEW_MS: number;
 /** Default broker refresh-loop cadence. */
 export declare const DEFAULT_REFRESH_INTERVAL_MS = 60000;
+/** Default freshness window for the encrypted local broker snapshot cache. */
+export declare const DEFAULT_SNAPSHOT_CACHE_TTL_MS: number;
 /** Keepalive cadence for `GET /v1/snapshot/stream` SSE comments. */
 export declare const DEFAULT_STREAM_KEEPALIVE_MS = 20000;
 /**

package/dist/types/auth-storage.d.ts

@@ -377,11 +377,25 @@ type AuthApiKeyOptions = {
  */
 export interface OAuthAccess {
     accessToken: string;
+    credentialId?: number;
     accountId?: string;
     email?: string;
     projectId?: string;
     enterpriseUrl?: string;
 }
+export interface OAuthAccessFailure {
+    credentialId?: number;
+    accountId?: string;
+    email?: string;
+    projectId?: string;
+    enterpriseUrl?: string;
+    error: string;
+}
+export type OAuthAccessResolution = ({
+    ok: true;
+} & OAuthAccess) | ({
+    ok: false;
+} & OAuthAccessFailure);
 export interface InvalidateCredentialMatchingOptions {
     signal?: AbortSignal;
     sessionId?: string;
@@ -622,6 +636,15 @@ export declare class AuthStorage {
      * OAuth with an explicit API key.
      */
     getOAuthAccess(provider: string, sessionId?: string, options?: AuthApiKeyOptions): Promise<OAuthAccess | undefined>;
+    /**
+     * Resolve every stored OAuth credential for `provider` independently.
+     *
+     * Refreshes credentials through the same broker/local path as
+     * {@link AuthStorage.getOAuthAccess}, but does not rank, round-robin, or
+     * stop after the first usable account. Intended for diagnostics that must
+     * exercise each stored account exactly once.
+     */
+    getOAuthAccesses(provider: string, options?: AuthApiKeyOptions): Promise<OAuthAccessResolution[]>;
     invalidateCredentialMatching(provider: string, apiKey: string, options?: InvalidateCredentialMatchingOptions): Promise<boolean>;
     invalidateCredentialMatching(provider: string, apiKey: string, signal?: AbortSignal): Promise<boolean>;
     /**

package/dist/types/providers/openai-responses-shared.d.ts

@@ -64,8 +64,13 @@ type CommonSamplingOptions = Pick<StreamOptions, "temperature" | "topP" | "topK"
 /**
  * Apply the common `StreamOptions` → Responses sampling-parameter mapping (max output tokens,
  * temperature, top-p/k, min-p, presence/repetition penalties, service tier). Mutates `params`.
+ *
+ * `max_output_tokens` is suppressed when {@link Model.omitMaxOutputTokens} is `true`, so
+ * proxies (notably Ollama) that forward to upstream APIs with an unknown output-token cap
+ * can let the upstream apply its own default instead of 400-ing on `maxTokens` values that
+ * reflect the model's context window rather than the upstream output limit.
  */
-export declare function applyCommonResponsesSamplingParams<P extends CommonResponsesParams>(params: P, options: CommonSamplingOptions | undefined, provider: string): void;
+export declare function applyCommonResponsesSamplingParams<P extends CommonResponsesParams>(params: P, options: CommonSamplingOptions | undefined, model: Pick<Model, "provider" | "omitMaxOutputTokens">): void;
 type ReasoningOptions = {
     reasoning?: string;
     reasoningSummary?: "auto" | "detailed" | "concise" | null;

package/dist/types/types.d.ts

@@ -763,6 +763,18 @@ export interface Model<TApi extends Api = any> {
     premiumMultiplier?: number;
     contextWindow: number;
     maxTokens: number;
+    /**
+     * When `true`, providers MUST omit `max_output_tokens` (Responses) /
+     * `max_tokens` / `max_completion_tokens` (Completions) from the outbound
+     * request and let the upstream API decide the per-response cap. `maxTokens`
+     * is still used locally for budgeting (compaction, context promotion); only
+     * the wire field is suppressed.
+     *
+     * Use this for proxies (notably Ollama) that forward to a backend whose true
+     * output limit OMP cannot discover — sending the wrong value triggers 400s
+     * from the upstream provider.
+     */
+    omitMaxOutputTokens?: boolean;
     headers?: Record<string, string>;
     /**
      * Streaming transport override. When `"pi-native"`, `streamSimple` routes

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "15.9.1",
+	"version": "15.9.3",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -39,7 +39,7 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.0",
-		"@oh-my-pi/pi-utils": "15.9.1",
+		"@oh-my-pi/pi-utils": "15.9.3",
 		"openai": "^6.39.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-broker/index.ts

@@ -2,4 +2,5 @@ export * from "./client";
 export * from "./refresher";
 export * from "./remote-store";
 export * from "./server";
+export * from "./snapshot-cache";
 export * from "./types";

package/src/auth-broker/remote-store.ts

@@ -73,11 +73,17 @@ export interface RemoteAuthCredentialStoreOptions {
 	 * to long-poll permanently when the broker returns 404. Default `true`.
 	 */
 	streamSnapshots?: boolean;
+	/**
+	 * Called after broker-sourced full snapshots are applied. The constructor's
+	 * initial snapshot intentionally does not trigger this hook.
+	 */
+	onSnapshot?: (snapshot: SnapshotResponse, generation: number) => void;
 }
 
 export class RemoteAuthCredentialStore implements AuthCredentialStore {
 	readonly #client: AuthBrokerClient;
 	readonly #streamSnapshots: boolean;
+	readonly #onSnapshot?: (snapshot: SnapshotResponse, generation: number) => void;
 	#snapshot: SnapshotResponse = emptySnapshot();
 	#snapshotReceivedAt = Date.now();
 	#generation = 0;
@@ -100,6 +106,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		this.#client = opts.client;
 		this.#streamSnapshots = opts.streamSnapshots ?? true;
 		this.#applySnapshot(opts.initialSnapshot ?? emptySnapshot(), opts.initialSnapshot?.generation ?? 0);
+		this.#onSnapshot = opts.onSnapshot;
 		void this.#runBackground();
 	}
 
@@ -115,6 +122,13 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		this.#snapshot = snapshot;
 		this.#generation = generation;
 		this.#snapshotReceivedAt = Date.now();
+		const onSnapshot = this.#onSnapshot;
+		if (!onSnapshot) return;
+		try {
+			onSnapshot(snapshot, generation);
+		} catch (error) {
+			logger.debug("auth-broker snapshot callback failed", { error: String(error) });
+		}
 	}
 
 	async #runBackground(): Promise<void> {

package/src/auth-broker/snapshot-cache.ts

@@ -0,0 +1,174 @@
+/**
+ * AES-GCM encrypted local cache for auth-broker snapshots.
+ *
+ * The cache is defense-in-depth for at-rest snapshots: a copied cache file is
+ * useless without the matching broker bearer token and URL. The token itself is
+ * still the trust boundary; a process that can read both the token and this file
+ * can decrypt the snapshot.
+ */
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { isEnoent, logger } from "@oh-my-pi/pi-utils";
+import type { SnapshotResponse } from "./types";
+import { snapshotResponseSchema } from "./wire-schemas";
+
+const MAGIC = new Uint8Array([0x4f, 0x4d, 0x50, 0x53]); // "OMPS"
+const VERSION = 1;
+const VERSION_OFFSET = MAGIC.byteLength;
+const IV_OFFSET = VERSION_OFFSET + 1;
+const IV_LENGTH = 12;
+const HEADER_LENGTH = IV_OFFSET + IV_LENGTH;
+const AES_ALGORITHM = "AES-GCM";
+const TEXT_ENCODER = new TextEncoder();
+const TEXT_DECODER = new TextDecoder();
+const HEX = "0123456789abcdef";
+
+export interface ReadAuthBrokerSnapshotCacheOptions {
+	path: string;
+	token: string;
+	url: string;
+	ttlMs: number;
+	/** Override clock for deterministic tests. */
+	now?: () => number;
+}
+
+export interface WriteAuthBrokerSnapshotCacheOptions {
+	path: string;
+	token: string;
+	url: string;
+	snapshot: SnapshotResponse;
+}
+
+export async function readAuthBrokerSnapshotCache(
+	opts: ReadAuthBrokerSnapshotCacheOptions,
+): Promise<SnapshotResponse | null> {
+	if (opts.ttlMs <= 0) return null;
+	let data: Uint8Array;
+	try {
+		data = await fs.readFile(opts.path);
+	} catch (error) {
+		if (isEnoent(error)) return null;
+		throw error;
+	}
+
+	try {
+		const plaintext = await decryptCachePayload(data, opts.token, opts.url);
+		if (!plaintext) return null;
+		const parsed: unknown = JSON.parse(TEXT_DECODER.decode(plaintext));
+		const result = snapshotResponseSchema.safeParse(parsed);
+		if (!result.success) {
+			logger.debug("auth-broker snapshot cache schema invalid", { path: opts.path });
+			return null;
+		}
+		const snapshot = result.data;
+		const now = opts.now?.() ?? Date.now();
+		if (now - snapshot.generatedAt > opts.ttlMs) return null;
+		return snapshot;
+	} catch (error) {
+		logger.debug("auth-broker snapshot cache read failed", { path: opts.path, error: String(error) });
+		return null;
+	}
+}
+
+export async function writeAuthBrokerSnapshotCache(opts: WriteAuthBrokerSnapshotCacheOptions): Promise<void> {
+	const payload = await encryptCachePayload(opts.snapshot, opts.token, opts.url);
+	await fs.mkdir(path.dirname(opts.path), { recursive: true });
+	const tmpPath = `${opts.path}.${process.pid}.${randomHex(8)}.tmp`;
+	let removeTemp = false;
+	try {
+		const handle = await fs.open(tmpPath, "wx", 0o600);
+		removeTemp = true;
+		try {
+			await handle.writeFile(payload);
+		} finally {
+			await handle.close();
+		}
+		await fs.chmod(tmpPath, 0o600);
+		await fs.rename(tmpPath, opts.path);
+		removeTemp = false;
+	} finally {
+		if (removeTemp) await fs.rm(tmpPath, { force: true }).catch(() => {});
+	}
+}
+
+async function encryptCachePayload(snapshot: SnapshotResponse, token: string, url: string): Promise<Uint8Array> {
+	const key = await deriveAesKey(token, ["encrypt"]);
+	const iv = new Uint8Array(IV_LENGTH);
+	globalThis.crypto.getRandomValues(iv);
+	const plaintext = TEXT_ENCODER.encode(JSON.stringify(snapshot));
+	const ciphertext = new Uint8Array(
+		await globalThis.crypto.subtle.encrypt(
+			{
+				name: AES_ALGORITHM,
+				iv,
+				additionalData: TEXT_ENCODER.encode(url),
+			},
+			key,
+			plaintext,
+		),
+	);
+	const payload = new Uint8Array(HEADER_LENGTH + ciphertext.byteLength);
+	payload.set(MAGIC, 0);
+	payload[VERSION_OFFSET] = VERSION;
+	payload.set(iv, IV_OFFSET);
+	payload.set(ciphertext, HEADER_LENGTH);
+	return payload;
+}
+
+async function decryptCachePayload(data: Uint8Array, token: string, url: string): Promise<Uint8Array | null> {
+	if (data.byteLength <= HEADER_LENGTH) {
+		logger.debug("auth-broker snapshot cache file too short");
+		return null;
+	}
+	for (let i = 0; i < MAGIC.byteLength; i++) {
+		if (data[i] !== MAGIC[i]) {
+			logger.debug("auth-broker snapshot cache magic mismatch");
+			return null;
+		}
+	}
+	if (data[VERSION_OFFSET] !== VERSION) {
+		logger.debug("auth-broker snapshot cache version mismatch", { version: data[VERSION_OFFSET] });
+		return null;
+	}
+	const key = await deriveAesKey(token, ["decrypt"]);
+	const iv = asStrict(data.subarray(IV_OFFSET, HEADER_LENGTH));
+	const ciphertext = asStrict(data.subarray(HEADER_LENGTH));
+	try {
+		return new Uint8Array(
+			await globalThis.crypto.subtle.decrypt(
+				{
+					name: AES_ALGORITHM,
+					iv,
+					additionalData: TEXT_ENCODER.encode(url),
+				},
+				key,
+				ciphertext,
+			),
+		);
+	} catch (error) {
+		logger.debug("auth-broker snapshot cache decrypt failed", { error: String(error) });
+		return null;
+	}
+}
+
+async function deriveAesKey(token: string, usages: Array<"encrypt" | "decrypt">): Promise<CryptoKey> {
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", TEXT_ENCODER.encode(token));
+	return globalThis.crypto.subtle.importKey("raw", digest, AES_ALGORITHM, false, usages);
+}
+
+function asStrict(bytes: Uint8Array): Uint8Array<ArrayBuffer> {
+	if (bytes.buffer instanceof ArrayBuffer && bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength) {
+		return bytes as Uint8Array<ArrayBuffer>;
+	}
+	const copy = new Uint8Array(bytes.byteLength);
+	copy.set(bytes);
+	return copy;
+}
+
+function randomHex(byteLength: number): string {
+	const bytes = new Uint8Array(byteLength);
+	globalThis.crypto.getRandomValues(bytes);
+	let out = "";
+	for (const byte of bytes) out += HEX[byte >> 4] + HEX[byte & 15];
+	return out;
+}

package/src/auth-broker/types.ts

@@ -117,6 +117,9 @@ export const DEFAULT_REFRESH_SKEW_MS = 5 * 60_000;
 /** Default broker refresh-loop cadence. */
 export const DEFAULT_REFRESH_INTERVAL_MS = 60_000;
 
+/** Default freshness window for the encrypted local broker snapshot cache. */
+export const DEFAULT_SNAPSHOT_CACHE_TTL_MS = 60 * 60_000;
+
 /** Keepalive cadence for `GET /v1/snapshot/stream` SSE comments. */
 export const DEFAULT_STREAM_KEEPALIVE_MS = 20_000;
 

package/src/auth-storage.ts

@@ -557,11 +557,23 @@ type OAuthResolutionResult = { apiKey: string; credential: OAuthCredential };
  */
 export interface OAuthAccess {
 	accessToken: string;
+	credentialId?: number;
 	accountId?: string;
 	email?: string;
 	projectId?: string;
 	enterpriseUrl?: string;
 }
+
+export interface OAuthAccessFailure {
+	credentialId?: number;
+	accountId?: string;
+	email?: string;
+	projectId?: string;
+	enterpriseUrl?: string;
+	error: string;
+}
+
+export type OAuthAccessResolution = ({ ok: true } & OAuthAccess) | ({ ok: false } & OAuthAccessFailure);
 export interface InvalidateCredentialMatchingOptions {
 	signal?: AbortSignal;
 	sessionId?: string;
@@ -725,6 +737,25 @@ class AuthStorageUsageCache implements UsageCache {
 // ─────────────────────────────────────────────────────────────────────────────
 
 type StoredCredential = { id: number; credential: AuthCredential };
+type OAuthSelection = { credential: OAuthCredential; index: number };
+
+type OAuthCandidate = {
+	selection: OAuthSelection;
+	usage: UsageReport | null;
+	usageChecked: boolean;
+};
+
+type RankedOAuthCandidate = OAuthCandidate & {
+	blocked: boolean;
+	blockedUntil?: number;
+	hasPriorityBoost: boolean;
+	planPriority: number;
+	secondaryUsed: number;
+	secondaryDrainRate: number;
+	primaryUsed: number;
+	primaryDrainRate: number;
+	orderPos: number;
+};
 
 // ─────────────────────────────────────────────────────────────────────────────
 // AuthStorage Class
@@ -2733,35 +2764,126 @@ export class AuthStorage {
 		return usedFraction / elapsedHours;
 	}
 
+	#compareRankedOAuthCandidatePriority(
+		left: RankedOAuthCandidate,
+		right: RankedOAuthCandidate,
+		provider: string,
+		modelId: string | undefined,
+	): number {
+		if (left.blocked !== right.blocked) return left.blocked ? 1 : -1;
+		if (left.blocked && right.blocked) {
+			const leftBlockedUntil = left.blockedUntil ?? Number.POSITIVE_INFINITY;
+			const rightBlockedUntil = right.blockedUntil ?? Number.POSITIVE_INFINITY;
+			if (leftBlockedUntil !== rightBlockedUntil) return leftBlockedUntil - rightBlockedUntil;
+			return 0;
+		}
+		if (requiresOpenAICodexProModel(provider, modelId) && left.planPriority !== right.planPriority) {
+			return left.planPriority - right.planPriority;
+		}
+		if (left.hasPriorityBoost !== right.hasPriorityBoost) return left.hasPriorityBoost ? -1 : 1;
+		if (left.secondaryDrainRate !== right.secondaryDrainRate) {
+			return left.secondaryDrainRate - right.secondaryDrainRate;
+		}
+		if (left.secondaryUsed !== right.secondaryUsed) return left.secondaryUsed - right.secondaryUsed;
+		if (left.primaryDrainRate !== right.primaryDrainRate) return left.primaryDrainRate - right.primaryDrainRate;
+		if (left.primaryUsed !== right.primaryUsed) return left.primaryUsed - right.primaryUsed;
+		return 0;
+	}
+
+	#compareRankedOAuthCandidates(
+		left: RankedOAuthCandidate,
+		right: RankedOAuthCandidate,
+		provider: string,
+		modelId: string | undefined,
+	): number {
+		const priority = this.#compareRankedOAuthCandidatePriority(left, right, provider, modelId);
+		return priority !== 0 ? priority : left.orderPos - right.orderPos;
+	}
+
+	#orderRankedOAuthCandidates(
+		candidates: RankedOAuthCandidate[],
+		sessionId: string | undefined,
+		provider: string,
+		modelId: string | undefined,
+	): OAuthCandidate[] {
+		candidates.sort((left, right) => this.#compareRankedOAuthCandidates(left, right, provider, modelId));
+		if (!sessionId) {
+			return candidates.map(candidate => ({
+				selection: candidate.selection,
+				usage: candidate.usage,
+				usageChecked: candidate.usageChecked,
+			}));
+		}
+
+		const unblocked = candidates.filter(candidate => !candidate.blocked);
+		if (unblocked.length <= 1) {
+			return candidates.map(candidate => ({
+				selection: candidate.selection,
+				usage: candidate.usage,
+				usageChecked: candidate.usageChecked,
+			}));
+		}
+
+		const priorityByCandidate = new Map<RankedOAuthCandidate, number>();
+		let bucketIndex = 0;
+		let previous = unblocked[0];
+		const bucketByCandidate = new Map<RankedOAuthCandidate, number>();
+		for (const candidate of unblocked) {
+			if (
+				candidate !== previous &&
+				this.#compareRankedOAuthCandidatePriority(previous, candidate, provider, modelId) !== 0
+			) {
+				bucketIndex += 1;
+			}
+			bucketByCandidate.set(candidate, bucketIndex);
+			previous = candidate;
+		}
+		const maxBucket = bucketIndex;
+		for (const candidate of unblocked) {
+			const bucket = bucketByCandidate.get(candidate) ?? 0;
+			priorityByCandidate.set(candidate, maxBucket === 0 ? 0 : 1 - bucket / maxBucket);
+		}
+
+		let totalWeight = 0;
+		for (const candidate of unblocked) {
+			totalWeight += 1 + (priorityByCandidate.get(candidate) ?? 0);
+		}
+
+		const hit = ((Bun.hash.xxHash32(sessionId) >>> 0) / 2 ** 32) * totalWeight;
+		let cursor = 0;
+		let selected = unblocked[unblocked.length - 1];
+		for (const candidate of unblocked) {
+			cursor += 1 + (priorityByCandidate.get(candidate) ?? 0);
+			if (hit < cursor) {
+				selected = candidate;
+				break;
+			}
+		}
+
+		const ordered = [
+			selected,
+			...unblocked.filter(candidate => candidate !== selected),
+			...candidates.filter(candidate => candidate.blocked),
+		];
+		return ordered.map(candidate => ({
+			selection: candidate.selection,
+			usage: candidate.usage,
+			usageChecked: candidate.usageChecked,
+		}));
+	}
+
 	async #rankOAuthSelections(args: {
 		providerKey: string;
 		provider: string;
 		order: number[];
-		credentials: Array<{ credential: OAuthCredential; index: number }>;
+		credentials: OAuthSelection[];
 		options?: AuthApiKeyOptions;
+		sessionId?: string;
 		strategy: CredentialRankingStrategy;
-	}): Promise<
-		Array<{
-			selection: { credential: OAuthCredential; index: number };
-			usage: UsageReport | null;
-			usageChecked: boolean;
-		}>
-	> {
+	}): Promise<OAuthCandidate[]> {
 		const nowMs = Date.now();
 		const { strategy } = args;
-		const ranked: Array<{
-			selection: { credential: OAuthCredential; index: number };
-			usage: UsageReport | null;
-			usageChecked: boolean;
-			blocked: boolean;
-			blockedUntil?: number;
-			hasPriorityBoost: boolean;
-			secondaryUsed: number;
-			secondaryDrainRate: number;
-			primaryUsed: number;
-			primaryDrainRate: number;
-			orderPos: number;
-		}> = [];
+		const ranked: RankedOAuthCandidate[] = [];
 		// Pre-fetch usage reports in parallel for non-blocked credentials.
 		// Wrap with a timeout so slow/429'd fetches don't indefinitely block
 		// credential selection — better to pick a credential without usage data
@@ -2821,6 +2943,7 @@ export class AuthStorage {
 				blocked,
 				blockedUntil,
 				hasPriorityBoost: strategy.hasPriorityBoost?.(primary) ?? false,
+				planPriority: getOpenAICodexPlanPriority(usage),
 				secondaryUsed: this.#normalizeUsageFraction(secondaryTarget),
 				secondaryDrainRate: this.#computeWindowDrainRate(
 					secondaryTarget,
@@ -2832,32 +2955,7 @@ export class AuthStorage {
 				orderPos,
 			});
 		}
-		ranked.sort((left, right) => {
-			if (left.blocked !== right.blocked) return left.blocked ? 1 : -1;
-			if (left.blocked && right.blocked) {
-				const leftBlockedUntil = left.blockedUntil ?? Number.POSITIVE_INFINITY;
-				const rightBlockedUntil = right.blockedUntil ?? Number.POSITIVE_INFINITY;
-				if (leftBlockedUntil !== rightBlockedUntil) return leftBlockedUntil - rightBlockedUntil;
-				return left.orderPos - right.orderPos;
-			}
-			if (requiresOpenAICodexProModel(args.provider, args.options?.modelId)) {
-				const leftPlanPriority = getOpenAICodexPlanPriority(left.usage);
-				const rightPlanPriority = getOpenAICodexPlanPriority(right.usage);
-				if (leftPlanPriority !== rightPlanPriority) return leftPlanPriority - rightPlanPriority;
-			}
-			if (left.hasPriorityBoost !== right.hasPriorityBoost) return left.hasPriorityBoost ? -1 : 1;
-			if (left.secondaryDrainRate !== right.secondaryDrainRate)
-				return left.secondaryDrainRate - right.secondaryDrainRate;
-			if (left.secondaryUsed !== right.secondaryUsed) return left.secondaryUsed - right.secondaryUsed;
-			if (left.primaryDrainRate !== right.primaryDrainRate) return left.primaryDrainRate - right.primaryDrainRate;
-			if (left.primaryUsed !== right.primaryUsed) return left.primaryUsed - right.primaryUsed;
-			return left.orderPos - right.orderPos;
-		});
-		return ranked.map(candidate => ({
-			selection: candidate.selection,
-			usage: candidate.usage,
-			usageChecked: candidate.usageChecked,
-		}));
+		return this.#orderRankedOAuthCandidates(ranked, args.sessionId, args.provider, args.options?.modelId);
 	}
 
 	/**
@@ -2894,8 +2992,17 @@ export class AuthStorage {
 		const sessionPreferredIsAvailable =
 			sessionPreferredIndex !== undefined && !this.#isCredentialBlocked(providerKey, sessionPreferredIndex);
 		const shouldRank = checkUsage && (!sessionPreferredIsAvailable || requiresProModel);
+		const rankingOrder = shouldRank && sessionId ? credentials.map((_credential, index) => index) : order;
 		const candidates = shouldRank
-			? await this.#rankOAuthSelections({ providerKey, provider, order, credentials, options, strategy: strategy! })
+			? await this.#rankOAuthSelections({
+					providerKey,
+					provider,
+					order: rankingOrder,
+					credentials,
+					options,
+					sessionId,
+					strategy: strategy!,
+				})
 			: order
 					.map(idx => credentials[idx])
 					.filter((selection): selection is { credential: OAuthCredential; index: number } => Boolean(selection))
@@ -3399,6 +3506,75 @@ export class AuthStorage {
 		};
 	}
 
+	/**
+	 * Resolve every stored OAuth credential for `provider` independently.
+	 *
+	 * Refreshes credentials through the same broker/local path as
+	 * {@link AuthStorage.getOAuthAccess}, but does not rank, round-robin, or
+	 * stop after the first usable account. Intended for diagnostics that must
+	 * exercise each stored account exactly once.
+	 */
+	async getOAuthAccesses(provider: string, options?: AuthApiKeyOptions): Promise<OAuthAccessResolution[]> {
+		if (this.#runtimeOverrides.has(provider) || this.#configOverrides.has(provider)) {
+			return [];
+		}
+		const providerKey = this.#getProviderTypeKey(provider, "oauth");
+		const selections = this.#getStoredCredentials(provider)
+			.map((entry, index) => ({ credentialId: entry.id, credential: entry.credential, index }))
+			.filter(
+				(entry): entry is { credentialId: number; credential: OAuthCredential; index: number } =>
+					entry.credential.type === "oauth",
+			);
+		return Promise.all(
+			selections.map(async (selection): Promise<OAuthAccessResolution> => {
+				try {
+					const resolved = await this.#tryOAuthCredential(
+						provider,
+						{ credential: selection.credential, index: selection.index },
+						providerKey,
+						undefined,
+						options,
+						{
+							checkUsage: false,
+							allowBlocked: true,
+						},
+					);
+					if (!resolved) {
+						return {
+							ok: false,
+							credentialId: selection.credentialId,
+							accountId: selection.credential.accountId,
+							email: selection.credential.email,
+							projectId: selection.credential.projectId,
+							enterpriseUrl: selection.credential.enterpriseUrl,
+							error: "OAuth access unavailable",
+						};
+					}
+					const { credential } = resolved;
+					return {
+						ok: true,
+						credentialId: selection.credentialId,
+						accessToken: credential.access,
+						accountId: credential.accountId,
+						email: credential.email,
+						projectId: credential.projectId,
+						enterpriseUrl: credential.enterpriseUrl,
+					};
+				} catch (error) {
+					return {
+						ok: false,
+						credentialId: selection.credentialId,
+						accountId: selection.credential.accountId,
+						email: selection.credential.email,
+						projectId: selection.credential.projectId,
+						enterpriseUrl: selection.credential.enterpriseUrl,
+						error: error instanceof Error ? error.message : String(error),
+					};
+				}
+			}),
+		);
+	}
+
 	#extractStructuredApiKeyToken(apiKey: string): string | undefined {
 		if (!apiKey.startsWith("{")) return undefined;
 		try {

package/src/providers/azure-openai-responses.ts

@@ -296,7 +296,7 @@ function buildParams(
 		prompt_cache_key: normalizeOpenAIResponsesPromptCacheKey(options?.promptCacheKey ?? options?.sessionId),
 	};
 
-	applyCommonResponsesSamplingParams(params, options, model.provider);
+	applyCommonResponsesSamplingParams(params, options, model);
 
 	if (context.tools) {
 		params.tools = convertTools(context.tools);

package/src/providers/openai-completions.ts

@@ -1180,7 +1180,7 @@ function buildParams(
 		params.store = false;
 	}
 
-	if (effectiveMaxTokens) {
+	if (effectiveMaxTokens && !model.omitMaxOutputTokens) {
 		if (compat.maxTokensField === "max_tokens") {
 			params.max_tokens = effectiveMaxTokens;
 		} else {

package/src/providers/openai-responses-shared.ts

@@ -395,19 +395,54 @@ export async function processResponsesStream<TApi extends Api>(
 	model: Model<TApi>,
 	options?: ProcessResponsesStreamOptions,
 ): Promise<void> {
-	let currentItem:
-		| ResponseReasoningItem
-		| ResponseOutputMessage
-		| ResponseFunctionToolCall
-		| ResponseCustomToolCall
-		| null = null;
-	let currentBlock:
-		| ThinkingContent
-		| TextContent
-		| (ToolCall & { partialJson: string; lastParseLen?: number })
-		| null = null;
-	const blocks = output.content;
-	const blockIndex = () => blocks.length - 1;
+	type StreamingToolCallBlock = ToolCall & { partialJson: string; lastParseLen?: number };
+	interface StreamingItem {
+		item: ResponseReasoningItem | ResponseOutputMessage | ResponseFunctionToolCall | ResponseCustomToolCall;
+		block: ThinkingContent | TextContent | StreamingToolCallBlock;
+	}
+
+	// Multiple items (parallel function_calls in particular) can be open at the same
+	// time. OpenAI's spec routes every per-item event by `output_index`/`item_id`;
+	// see https://github.com/can1357/oh-my-pi/issues/1880 — llama.cpp emits parallel
+	// function_call deltas interleaved, and a singleton `current` reference would
+	// fold them into the wrong block and drop arguments on every call but the last.
+	const openItemsByOutputIndex = new Map<number, StreamingItem>();
+	const openItemsByItemId = new Map<string, StreamingItem>();
+	let lastOpenItem: StreamingItem | null = null;
+
+	const registerOpenItem = (
+		outputIndex: number | undefined,
+		itemId: string | undefined,
+		entry: StreamingItem,
+	): void => {
+		if (typeof outputIndex === "number") openItemsByOutputIndex.set(outputIndex, entry);
+		if (itemId) openItemsByItemId.set(itemId, entry);
+		lastOpenItem = entry;
+	};
+	const lookupOpenItem = (event: { output_index?: number; item_id?: string }): StreamingItem | undefined => {
+		if (typeof event.output_index === "number") {
+			const found = openItemsByOutputIndex.get(event.output_index);
+			if (found) return found;
+		}
+		if (event.item_id) {
+			const found = openItemsByItemId.get(event.item_id);
+			if (found) return found;
+		}
+		// Fallback for tests / mock providers that omit identifiers on stream events.
+		return lastOpenItem ?? undefined;
+	};
+	const closeOpenItem = (
+		outputIndex: number | undefined,
+		itemId: string | undefined,
+		entry: StreamingItem | undefined,
+	): void => {
+		if (typeof outputIndex === "number") openItemsByOutputIndex.delete(outputIndex);
+		if (itemId) openItemsByItemId.delete(itemId);
+		if (entry && lastOpenItem === entry) lastOpenItem = null;
+	};
+	const contentIndexOf = (block: ThinkingContent | TextContent | StreamingToolCallBlock): number =>
+		output.content.indexOf(block);
+
 	let sawFirstToken = false;
 
 	for await (const event of openaiStream) {
@@ -420,29 +455,28 @@ export async function processResponsesStream<TApi extends Api>(
 			}
 			const item = event.item;
 			if (item.type === "reasoning") {
-				currentItem = item;
-				currentBlock = { type: "thinking", thinking: "", itemId: item.id };
-				output.content.push(currentBlock);
-				stream.push({ type: "thinking_start", contentIndex: blockIndex(), partial: output });
+				const block: ThinkingContent = { type: "thinking", thinking: "", itemId: item.id };
+				output.content.push(block);
+				registerOpenItem(event.output_index, item.id, { item, block });
+				stream.push({ type: "thinking_start", contentIndex: contentIndexOf(block), partial: output });
 			} else if (item.type === "message") {
-				currentItem = item;
-				currentBlock = { type: "text", text: "" };
-				output.content.push(currentBlock);
-				stream.push({ type: "text_start", contentIndex: blockIndex(), partial: output });
+				const block: TextContent = { type: "text", text: "" };
+				output.content.push(block);
+				registerOpenItem(event.output_index, item.id, { item, block });
+				stream.push({ type: "text_start", contentIndex: contentIndexOf(block), partial: output });
 			} else if (item.type === "function_call") {
-				currentItem = item;
-				currentBlock = {
+				const block: StreamingToolCallBlock = {
 					type: "toolCall",
 					id: encodeResponsesToolCallId(item.call_id, item.id),
 					name: item.name,
 					arguments: {},
 					partialJson: item.arguments || "",
 				};
-				output.content.push(currentBlock);
-				stream.push({ type: "toolcall_start", contentIndex: blockIndex(), partial: output });
+				output.content.push(block);
+				registerOpenItem(event.output_index, item.id, { item, block });
+				stream.push({ type: "toolcall_start", contentIndex: contentIndexOf(block), partial: output });
 			} else if (item.type === "custom_tool_call") {
-				currentItem = item;
-				currentBlock = {
+				const block: StreamingToolCallBlock = {
 					type: "toolCall",
 					id: encodeResponsesToolCallId(item.call_id, item.id),
 					// Preserve the raw wire name (e.g. `apply_patch`). The agent-loop
@@ -456,39 +490,43 @@ export async function processResponsesStream<TApi extends Api>(
 					// accumulation buffer so later code that inspects the field still works.
 					partialJson: item.input ?? "",
 				};
-				output.content.push(currentBlock);
-				stream.push({ type: "toolcall_start", contentIndex: blockIndex(), partial: output });
+				output.content.push(block);
+				registerOpenItem(event.output_index, item.id, { item, block });
+				stream.push({ type: "toolcall_start", contentIndex: contentIndexOf(block), partial: output });
 			}
 		} else if (event.type === "response.reasoning_summary_part.added") {
-			if (currentItem?.type === "reasoning") {
-				currentItem.summary = currentItem.summary || [];
-				currentItem.summary.push(event.part);
+			const entry = lookupOpenItem(event);
+			if (entry?.item.type === "reasoning") {
+				entry.item.summary = entry.item.summary || [];
+				entry.item.summary.push(event.part);
 			}
 		} else if (event.type === "response.reasoning_summary_text.delta") {
-			if (currentItem?.type === "reasoning" && currentBlock?.type === "thinking") {
-				currentItem.summary = currentItem.summary || [];
-				const lastPart = currentItem.summary[currentItem.summary.length - 1];
+			const entry = lookupOpenItem(event);
+			if (entry?.item.type === "reasoning" && entry.block.type === "thinking") {
+				entry.item.summary = entry.item.summary || [];
+				const lastPart = entry.item.summary[entry.item.summary.length - 1];
 				if (lastPart) {
-					currentBlock.thinking += event.delta;
+					entry.block.thinking += event.delta;
 					lastPart.text += event.delta;
 					stream.push({
 						type: "thinking_delta",
-						contentIndex: blockIndex(),
+						contentIndex: contentIndexOf(entry.block),
 						delta: event.delta,
 						partial: output,
 					});
 				}
 			}
 		} else if (event.type === "response.reasoning_summary_part.done") {
-			if (currentItem?.type === "reasoning" && currentBlock?.type === "thinking") {
-				currentItem.summary = currentItem.summary || [];
-				const lastPart = currentItem.summary[currentItem.summary.length - 1];
+			const entry = lookupOpenItem(event);
+			if (entry?.item.type === "reasoning" && entry.block.type === "thinking") {
+				entry.item.summary = entry.item.summary || [];
+				const lastPart = entry.item.summary[entry.item.summary.length - 1];
 				if (lastPart) {
-					currentBlock.thinking += "\n\n";
+					entry.block.thinking += "\n\n";
 					lastPart.text += "\n\n";
 					stream.push({
 						type: "thinking_delta",
-						contentIndex: blockIndex(),
+						contentIndex: contentIndexOf(entry.block),
 						delta: "\n\n",
 						partial: output,
 					});
@@ -497,91 +535,103 @@ export async function processResponsesStream<TApi extends Api>(
 		} else if (event.type === "response.reasoning_text.delta") {
 			// Raw reasoning text delta from local providers that stream thinking
 			// directly rather than via the OpenAI summary tracking protocol.
-			if (currentItem?.type === "reasoning" && currentBlock?.type === "thinking") {
-				currentBlock.thinking += event.delta;
+			const entry = lookupOpenItem(event);
+			if (entry?.item.type === "reasoning" && entry.block.type === "thinking") {
+				entry.block.thinking += event.delta;
 				stream.push({
 					type: "thinking_delta",
-					contentIndex: blockIndex(),
+					contentIndex: contentIndexOf(entry.block),
 					delta: event.delta,
 					partial: output,
 				});
 			}
 		} else if (event.type === "response.content_part.added") {
-			if (currentItem?.type === "message") {
-				currentItem.content = currentItem.content || [];
+			const entry = lookupOpenItem(event);
+			if (entry?.item.type === "message") {
+				entry.item.content = entry.item.content || [];
 				if (event.part.type === "output_text" || event.part.type === "refusal") {
-					currentItem.content.push(event.part);
+					entry.item.content.push(event.part);
 				}
 			}
 		} else if (event.type === "response.output_text.delta") {
-			if (currentItem?.type === "message" && currentBlock?.type === "text") {
-				const lastPart = currentItem.content?.[currentItem.content.length - 1];
+			const entry = lookupOpenItem(event);
+			if (entry?.item.type === "message" && entry.block.type === "text") {
+				const lastPart = entry.item.content?.[entry.item.content.length - 1];
 				if (lastPart?.type === "output_text") {
-					currentBlock.text += event.delta;
+					entry.block.text += event.delta;
 					lastPart.text += event.delta;
 					stream.push({
 						type: "text_delta",
-						contentIndex: blockIndex(),
+						contentIndex: contentIndexOf(entry.block),
 						delta: event.delta,
 						partial: output,
 					});
 				}
 			}
 		} else if (event.type === "response.refusal.delta") {
-			if (currentItem?.type === "message" && currentBlock?.type === "text") {
-				const lastPart = currentItem.content?.[currentItem.content.length - 1];
+			const entry = lookupOpenItem(event);
+			if (entry?.item.type === "message" && entry.block.type === "text") {
+				const lastPart = entry.item.content?.[entry.item.content.length - 1];
 				if (lastPart?.type === "refusal") {
-					currentBlock.text += event.delta;
+					entry.block.text += event.delta;
 					lastPart.refusal += event.delta;
 					stream.push({
 						type: "text_delta",
-						contentIndex: blockIndex(),
+						contentIndex: contentIndexOf(entry.block),
 						delta: event.delta,
 						partial: output,
 					});
 				}
 			}
 		} else if (event.type === "response.function_call_arguments.delta") {
-			if (currentItem?.type === "function_call" && currentBlock?.type === "toolCall") {
-				currentBlock.partialJson += event.delta;
-				const throttled = parseStreamingJsonThrottled(currentBlock.partialJson, currentBlock.lastParseLen ?? 0);
+			const entry = lookupOpenItem(event);
+			if (entry?.item.type === "function_call" && entry.block.type === "toolCall") {
+				const block = entry.block;
+				block.partialJson += event.delta;
+				const throttled = parseStreamingJsonThrottled(block.partialJson, block.lastParseLen ?? 0);
 				if (throttled) {
-					currentBlock.arguments = throttled.value;
-					currentBlock.lastParseLen = throttled.parsedLen;
+					block.arguments = throttled.value;
+					block.lastParseLen = throttled.parsedLen;
 				}
 				stream.push({
 					type: "toolcall_delta",
-					contentIndex: blockIndex(),
+					contentIndex: contentIndexOf(block),
 					delta: event.delta,
 					partial: output,
 				});
 			}
 		} else if (event.type === "response.function_call_arguments.done") {
-			if (currentItem?.type === "function_call" && currentBlock?.type === "toolCall") {
-				currentBlock.partialJson = event.arguments;
-				currentBlock.arguments = parseStreamingJson(currentBlock.partialJson);
-				delete (currentBlock as { partialJson?: string }).partialJson;
-				delete (currentBlock as { lastParseLen?: number }).lastParseLen;
+			const entry = lookupOpenItem(event);
+			if (entry?.item.type === "function_call" && entry.block.type === "toolCall") {
+				const block = entry.block;
+				block.partialJson = event.arguments;
+				block.arguments = parseStreamingJson(block.partialJson);
+				delete (block as { partialJson?: string }).partialJson;
+				delete (block as { lastParseLen?: number }).lastParseLen;
 			}
 		} else if (event.type === "response.custom_tool_call_input.delta") {
-			if (currentItem?.type === "custom_tool_call" && currentBlock?.type === "toolCall") {
-				currentBlock.partialJson += event.delta;
-				currentBlock.arguments = { input: currentBlock.partialJson };
+			const entry = lookupOpenItem(event);
+			if (entry?.item.type === "custom_tool_call" && entry.block.type === "toolCall") {
+				const block = entry.block;
+				block.partialJson += event.delta;
+				block.arguments = { input: block.partialJson };
 				stream.push({
 					type: "toolcall_delta",
-					contentIndex: blockIndex(),
+					contentIndex: contentIndexOf(block),
 					delta: event.delta,
 					partial: output,
 				});
 			}
 		} else if (event.type === "response.custom_tool_call_input.done") {
-			if (currentItem?.type === "custom_tool_call" && currentBlock?.type === "toolCall") {
-				currentBlock.partialJson = event.input;
-				currentBlock.arguments = { input: event.input };
+			const entry = lookupOpenItem(event);
+			if (entry?.item.type === "custom_tool_call" && entry.block.type === "toolCall") {
+				entry.block.partialJson = event.input;
+				entry.block.arguments = { input: event.input };
 			}
 		} else if (event.type === "response.output_item.done") {
 			const item = structuredCloneJSON(event.item);
 			options?.onOutputItemDone?.(item);
+			const entry = lookupOpenItem({ output_index: event.output_index, item_id: item.id });
 			if (item.type === "reasoning") {
 				const thinking =
 					item.summary?.length > 0
@@ -595,54 +645,53 @@ export async function processResponsesStream<TApi extends Api>(
 				if (reasoningBlock) {
 					reasoningBlock.thinking = thinking;
 					reasoningBlock.thinkingSignature = JSON.stringify(item);
-					const reasoningBlockIndex = output.content.indexOf(reasoningBlock);
 					stream.push({
 						type: "thinking_end",
-						contentIndex: reasoningBlockIndex,
+						contentIndex: contentIndexOf(reasoningBlock),
 						content: thinking,
 						partial: output,
 					});
 				}
-				if ((currentBlock as ThinkingContent | null)?.itemId === item.id) currentBlock = null;
-			} else if (item.type === "message" && currentBlock?.type === "text") {
-				currentBlock.text = item.content
+				closeOpenItem(event.output_index, item.id, entry);
+			} else if (item.type === "message" && entry?.block.type === "text") {
+				const block = entry.block;
+				block.text = item.content
 					.map(part => (part.type === "output_text" ? (part.text ?? "") : (part.refusal ?? "")))
 					.join("");
-				currentBlock.textSignature = encodeTextSignatureV1(item.id, item.phase ?? undefined);
+				block.textSignature = encodeTextSignatureV1(item.id, item.phase ?? undefined);
 				stream.push({
 					type: "text_end",
-					contentIndex: blockIndex(),
-					content: currentBlock.text,
+					contentIndex: contentIndexOf(block),
+					content: block.text,
 					partial: output,
 				});
-				currentBlock = null;
+				closeOpenItem(event.output_index, item.id, entry);
 			} else if (item.type === "function_call") {
-				const args =
-					currentBlock?.type === "toolCall" && currentBlock.partialJson
-						? parseStreamingJson(currentBlock.partialJson)
-						: parseStreamingJson(item.arguments || "{}");
+				const block = entry?.block.type === "toolCall" ? entry.block : undefined;
+				const args = block?.partialJson
+					? parseStreamingJson(block.partialJson)
+					: parseStreamingJson(item.arguments || "{}");
 				const toolCall: ToolCall = {
 					type: "toolCall",
 					id: encodeResponsesToolCallId(item.call_id, item.id),
 					name: item.name,
 					arguments: args,
 				};
-				if (currentBlock?.type === "toolCall") {
+				if (block) {
 					// Persist the authoritative final args on the stored block. The
 					// throttled delta parser may have skipped the last partial parse,
-					// leaving currentBlock.arguments stale (often `{}`); the emitted
-					// toolCall and the persisted block must agree.
-					currentBlock.arguments = args;
-					delete (currentBlock as { partialJson?: string }).partialJson;
-					delete (currentBlock as { lastParseLen?: number }).lastParseLen;
+					// leaving block.arguments stale (often `{}`); the emitted toolCall
+					// and the persisted block must agree.
+					block.arguments = args;
+					delete (block as { partialJson?: string }).partialJson;
+					delete (block as { lastParseLen?: number }).lastParseLen;
 				}
-				currentBlock = null;
-				stream.push({ type: "toolcall_end", contentIndex: blockIndex(), toolCall, partial: output });
+				const contentIndex = block ? contentIndexOf(block) : output.content.length - 1;
+				closeOpenItem(event.output_index, item.id, entry);
+				stream.push({ type: "toolcall_end", contentIndex, toolCall, partial: output });
 			} else if (item.type === "custom_tool_call") {
-				const rawInput =
-					currentBlock?.type === "toolCall" && currentBlock.partialJson
-						? currentBlock.partialJson
-						: (item.input ?? "");
+				const block = entry?.block.type === "toolCall" ? entry.block : undefined;
+				const rawInput = block?.partialJson ? block.partialJson : (item.input ?? "");
 				const toolCall: ToolCall = {
 					type: "toolCall",
 					id: encodeResponsesToolCallId(item.call_id, item.id),
@@ -650,8 +699,9 @@ export async function processResponsesStream<TApi extends Api>(
 					arguments: { input: rawInput },
 					customWireName: item.name,
 				};
-				currentBlock = null;
-				stream.push({ type: "toolcall_end", contentIndex: blockIndex(), toolCall, partial: output });
+				const contentIndex = block ? contentIndexOf(block) : output.content.length - 1;
+				closeOpenItem(event.output_index, item.id, entry);
+				stream.push({ type: "toolcall_end", contentIndex, toolCall, partial: output });
 			}
 		} else if (event.type === "response.completed") {
 			const response = event.response;
@@ -752,21 +802,26 @@ type CommonSamplingOptions = Pick<
 /**
  * Apply the common `StreamOptions` → Responses sampling-parameter mapping (max output tokens,
  * temperature, top-p/k, min-p, presence/repetition penalties, service tier). Mutates `params`.
+ *
+ * `max_output_tokens` is suppressed when {@link Model.omitMaxOutputTokens} is `true`, so
+ * proxies (notably Ollama) that forward to upstream APIs with an unknown output-token cap
+ * can let the upstream apply its own default instead of 400-ing on `maxTokens` values that
+ * reflect the model's context window rather than the upstream output limit.
  */
 export function applyCommonResponsesSamplingParams<P extends CommonResponsesParams>(
 	params: P,
 	options: CommonSamplingOptions | undefined,
-	provider: string,
+	model: Pick<Model, "provider" | "omitMaxOutputTokens">,
 ): void {
-	if (options?.maxTokens) params.max_output_tokens = options.maxTokens;
+	if (options?.maxTokens && !model.omitMaxOutputTokens) params.max_output_tokens = options.maxTokens;
 	if (options?.temperature !== undefined) params.temperature = options.temperature;
 	if (options?.topP !== undefined) params.top_p = options.topP;
 	if (options?.topK !== undefined) params.top_k = options.topK;
 	if (options?.minP !== undefined) params.min_p = options.minP;
 	if (options?.presencePenalty !== undefined) params.presence_penalty = options.presencePenalty;
 	if (options?.repetitionPenalty !== undefined) params.repetition_penalty = options.repetitionPenalty;
-	if (shouldSendServiceTier(options?.serviceTier, provider)) {
-		const resolved = resolveServiceTier(options?.serviceTier, provider);
+	if (shouldSendServiceTier(options?.serviceTier, model.provider)) {
+		const resolved = resolveServiceTier(options?.serviceTier, model.provider);
 		if (resolved === "flex" || resolved === "scale" || resolved === "priority") {
 			params.service_tier = resolved;
 		}

package/src/providers/openai-responses.ts

@@ -463,7 +463,7 @@ function buildParams(
 		stream_options: model.provider === "openai" ? { include_obfuscation: false } : undefined,
 	};
 
-	applyCommonResponsesSamplingParams(params, options, model.provider);
+	applyCommonResponsesSamplingParams(params, options, model);
 	// TODO: openai responses has no top-level `stop`/`stop_sequences`; surface via reasoning.stop?
 	// `StreamOptions.stopSequences` is intentionally dropped for this provider.
 	// TODO: openai responses has no top-level `frequency_penalty` field as of the current SDK;

package/src/types.ts

@@ -905,6 +905,18 @@ export interface Model<TApi extends Api = any> {
 	premiumMultiplier?: number;
 	contextWindow: number;
 	maxTokens: number;
+	/**
+	 * When `true`, providers MUST omit `max_output_tokens` (Responses) /
+	 * `max_tokens` / `max_completion_tokens` (Completions) from the outbound
+	 * request and let the upstream API decide the per-response cap. `maxTokens`
+	 * is still used locally for budgeting (compaction, context promotion); only
+	 * the wire field is suppressed.
+	 *
+	 * Use this for proxies (notably Ollama) that forward to a backend whose true
+	 * output limit OMP cannot discover — sending the wrong value triggers 400s
+	 * from the upstream provider.
+	 */
+	omitMaxOutputTokens?: boolean;
 	headers?: Record<string, string>;
 	/**
 	 * Streaming transport override. When `"pi-native"`, `streamSimple` routes