@oh-my-pi/pi-ai 15.9.67 → 15.10.1

package/CHANGELOG.md

@@ -2,6 +2,49 @@
 
 ## [Unreleased]
 
+## [15.10.1] - 2026-06-07
+
+### Breaking Changes
+
+- Removed the `onAuthError` option from stream request options and shifted auth retry handling to resolver-based `apiKey` behavior, requiring callers using custom auth-retry hooks to migrate
+
+### Added
+
+- Added `ApiKeyResolver` and `ApiKey` auth helpers, including `isApiKeyResolver`, `isAuthRetryableError`, `resolveApiKeyOnce`, and `withAuth`, and exported them from the package root
+- Added support for a function-valued `apiKey` in `SimpleStreamOptions` so a single stream request can refresh or rotate credentials during retry
+- Added `forceRefresh` credential option to `AuthStorage.getApiKey` and `rotateSessionCredential` support for session-level credential rotation after auth failures
+- Added `AuthStorage.resolver(provider, options)` method that builds an `ApiKeyResolver` implementing the a/b/c auth-retry policy directly on the storage instance
+
+### Changed
+
+- Changed gateway and stream auth flows to share the a/b/c retry policy, refreshing the same session credential first and then switching to a sibling credential on repeated auth failures
+
+### Fixed
+
+- Fixed streaming auth retries to handle `401` and usage-limit errors before replay-unsafe content is emitted, including failures surfaced only via `errorStatus`
+- Fixed tool argument validation to coerce singleton non-string values into arrays when the schema expects an array, preventing Anthropic-compatible models that emit `todo.ops` as an object from getting stuck in repeated validation-error loops. ([#2026](https://github.com/can1357/oh-my-pi/issues/2026))
+- Fixed streaming retries to buffer and suppress partial `start` events from failed auth attempts so only clean retried events are delivered
+- Fixed the HTTP 400 raw-request dumper (`appendRawHttpRequestDumpFor400`) littering the real `~/.omp/logs/http-400-requests` directory during tests. Provider suites exercise the 400 error path with mocked `fetch` responses, which the dumper could not distinguish from genuine failures; it now skips persistence under the Bun test runner (`isBunTestRuntime()`).
+- Fixed Anthropic Opus requests unnecessarily forcing `tool_choice.disable_parallel_tool_use`, allowing Claude Opus to use the provider's default parallel tool-calling behavior again.
+- Fixed parallel `function_call` items losing arguments against llama.cpp's OpenAI Responses endpoint (`/v1/responses`), where every call but the last finalized with `{}` and the agent rejected them with `path: Invalid input: expected string, received undefined`. llama.cpp's `to_json_oaicompat_resp` emits `output_item.added` with only `item.call_id` (no `item.id`, no `output_index`) while the matching `function_call_arguments.delta` carries `item_id: "fc_<call_id>"`. `processResponsesStream` now registers function-call and custom-tool-call items under `item.call_id` as a secondary lookup key (alongside `item.id`/`output_index`) so identifier-deviant hosts route deltas and done events to the right block. ([#2015](https://github.com/can1357/oh-my-pi/issues/2015))
+- Fixed `PI_REQ_DEBUG` response recording truncating the captured body when a streamed response was cancelled mid-flight. The response tee in `wrapResponse` could call `FileRequestDebugResponseLog.close()` from both the `cancel` callback and the resumed `pull` (which observes `done` once the source reader is cancelled); the second caller saw the handle already nulled and returned before the first caller's pending write flushed, so the `.res.log` lost the already-buffered chunk. `close()` now memoizes its flush-and-close promise so every caller awaits the same completion.
+
+## [15.10.0] - 2026-06-06
+
+### Added
+
+- Added a dependency-free `@oh-my-pi/pi-ai/effort` module exporting the `Effort` enum and `THINKING_EFFORTS`, split out of `model-thinking` so hot-path consumers can import the thinking levels without pulling in `model-thinking` and its provider-compat dependency graph. The package barrel still re-exports both names, so existing imports are unaffected.
+
+### Fixed
+
+- Fixed Antigravity usage provider emitting one bar per model instead of deduplicating by tier — a single account's 15+ model entries now collapse to one bar per tier, matching the shared-quota reality of the upstream API.
+- Fixed Antigravity usage reports missing `email` and `accountId` in metadata, so the `/usage` display and the deduplicator can associate reports with their credentials.
+- Fixed usage-report dedup ignoring `projectId` for Google Cloud providers, preventing duplicate credential entries from being recognized as the same account.
+
+- Fixed Cloud Code Assist (Antigravity / Gemini CLI) rejecting the `github` tool with HTTP 400 when the `pr` parameter schema contained `anyOf: [string, array]`. The CCA mixed-type combiner collapse picked the first non-null type (`string`) but indiscriminately copied type-specific keys from variant branches — `items` from the array variant leaked onto the string-typed result, producing `{type: "string", items: {...}}` which Google's API rejects as invalid. The collapse now filters merged variant fields against the winning type's allowed key set. ([#2002](https://github.com/can1357/oh-my-pi/pull/2002))
+- Fixed OpenAI Responses-family providers (Codex, OpenAI Responses, Azure Responses) rejecting requests with `400 No tool output found for function call …` after the user branched/navigated the session tree to a node that ends on a tool call (the tool-result child is dropped from the reconstructed history) or after a turn was aborted/crashed between the call streaming and its result persisting. The converters now synthesize a placeholder `function_call_output`/`custom_tool_call_output` immediately after any unpaired `function_call`/`custom_tool_call`, symmetric to the existing orphan-output repair, so the model still sees the call and can recover instead of the whole request 400ing.
+- Fixed Anthropic-compatible reasoning endpoints losing prior-turn reasoning on continuation requests when they emit unsigned `thinking` blocks. `convertAnthropicMessages` treated unknown endpoints as signature-enforcing and demoted unsigned reasoning to `type: "text"`, which destabilized tool-call argument serialization on the next turn — the upstream symptom behind the `args?.ops?.map is not a function` crash reported against the `todo` tool. Official `api.anthropic.com` keeps the conservative text fallback; non-official `anthropic-messages` reasoning models now replay unsigned reasoning as native `type: "thinking"` ([#2005](https://github.com/can1357/oh-my-pi/issues/2005)).
+
 ## [15.9.67] - 2026-06-06
 
 ### Fixed

package/dist/types/auth-gateway/types.d.ts

@@ -1,4 +1,4 @@
-import type { Effort } from "../model-thinking";
+import type { Effort } from "../effort";
 import type { AssistantMessage, AssistantMessageEventStream, CacheRetention, Context, ServiceTier, TokenTaskBudget } from "../types";
 /**
  * Wire types for the omp auth-gateway.

package/dist/types/auth-retry.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Context passed to an {@link ApiKeyResolver} on each resolution attempt.
+ *
+ * The `error`/`lastChance` pair drives the central a/b/c retry policy shared by
+ * the streaming ({@link streamSimple}) and non-streaming ({@link withAuth})
+ * drivers:
+ * - `error === undefined` → **initial resolve** (no force-refresh; cheap, may
+ *   return a locally-cached not-yet-expired token).
+ * - `error !== undefined && !lastChance` → **step (b): refresh the SAME
+ *   account** (force a token re-mint / await an in-flight broker refresh).
+ * - `error !== undefined && lastChance` → **step (c): switch account**
+ *   (invalidate/usage-limit the current credential and rotate to a sibling).
+ *
+ * The resolver returns the bearer to send, or `undefined` to stop retrying and
+ * surface the last error to the caller.
+ */
+export interface ApiKeyResolveContext {
+    /** True on the final retry step — the resolver should rotate to a sibling credential. */
+    lastChance: boolean;
+    /** The auth error that triggered this re-resolution, or `undefined` on the initial resolve. */
+    error: unknown;
+    /** Caller cancel signal, threaded into any credential refresh / rotation work. */
+    signal?: AbortSignal;
+}
+/**
+ * Resolves the API key to send for a request, retried through the a/b/c policy
+ * described on {@link ApiKeyResolveContext}.
+ */
+export type ApiKeyResolver = (ctx: ApiKeyResolveContext) => Promise<string | undefined> | string | undefined;
+/** A static bearer string, or a {@link ApiKeyResolver} that mints/rotates one. */
+export type ApiKey = string | ApiKeyResolver;
+/** Narrows {@link ApiKey} to its resolver form. */
+export declare function isApiKeyResolver(key: ApiKey | undefined): key is ApiKeyResolver;
+/**
+ * Performs the initial resolve of an {@link ApiKey} (`error: undefined`,
+ * `lastChance: false`). Static keys pass through unchanged.
+ */
+export declare function resolveApiKeyOnce(key: ApiKey | undefined, signal?: AbortSignal): Promise<string | undefined>;
+/**
+ * Classifies whether an error should trigger a credential refresh/rotation
+ * retry: a hard `401`, or a rotatable usage-limit ("usage_limit_reached",
+ * Codex's "you have hit your ChatGPT usage limit", etc.).
+ */
+export declare function isAuthRetryableError(error: unknown): boolean;
+/**
+ * The ordered `lastChance` values for the retry steps after the initial
+ * attempt fails: `false` → step (b) refresh-same, `true` → step (c) switch.
+ * Shared by {@link withAuth} and the streaming retry driver so both run the
+ * same policy.
+ */
+export declare const AUTH_RETRY_STEPS: readonly boolean[];
+/** Resolve a single retry step, swallowing resolver failures into `undefined`. */
+export declare function resolveRetryKey(resolver: ApiKeyResolver, lastChance: boolean, error: unknown, signal?: AbortSignal): Promise<string | undefined>;
+/**
+ * Runs an auth-protected operation through the central a/b/c retry policy.
+ *
+ * - A static string key (or any non-resolver) → a single `attempt` with no
+ *   retry (identical to the legacy static-key path).
+ * - A resolver → initial `attempt`, then on a retryable auth error up to two
+ *   more attempts (refresh-same, then switch). A step is skipped when the
+ *   resolver returns the same key it just tried or `undefined`; non-auth errors
+ *   propagate immediately.
+ *
+ * Used by non-streaming consumers (image generation, web search, completion
+ * helpers). The streaming driver in `stream.ts` implements the same policy with
+ * its replay-safe buffering machinery.
+ */
+export declare function withAuth<T>(key: ApiKey | undefined, attempt: (key: string) => Promise<T>, opts?: {
+    isAuthError?: (error: unknown) => boolean;
+    signal?: AbortSignal;
+    missingKeyMessage?: string;
+}): Promise<T>;

package/dist/types/auth-storage.d.ts

@@ -8,6 +8,7 @@
  * - `SqliteAuthCredentialStore`: concrete SQLite-backed implementation
  */
 import { Database } from "bun:sqlite";
+import type { ApiKeyResolver } from "./auth-retry";
 import type { Provider } from "./types";
 import type { CredentialRankingStrategy, UsageLogger, UsageProvider, UsageReport } from "./usage";
 import type { OAuthController, OAuthCredentials, OAuthProviderId } from "./utils/oauth/types";
@@ -366,6 +367,13 @@ type AuthApiKeyOptions = {
      * stranding the caller for `timeoutMs * (maxRetries + 1)`.
      */
     signal?: AbortSignal;
+    /**
+     * Force a re-mint of the session-preferred OAuth credential's access token,
+     * bypassing the not-yet-expired short-circuit. Powers step (b) of the
+     * auth-retry policy ("refresh the SAME account") so a locally-cached token
+     * that a peer/broker rotated out from under us is replaced before retrying.
+     */
+    forceRefresh?: boolean;
 };
 /**
  * Refreshed OAuth access plus identity metadata returned by
@@ -647,6 +655,41 @@ export declare class AuthStorage {
     getOAuthAccesses(provider: string, options?: AuthApiKeyOptions): Promise<OAuthAccessResolution[]>;
     invalidateCredentialMatching(provider: string, apiKey: string, options?: InvalidateCredentialMatchingOptions): Promise<boolean>;
     invalidateCredentialMatching(provider: string, apiKey: string, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Rotate away from the session's current credential after a retryable auth
+     * error — step (c) of the auth-retry policy. Stateless: looks up the
+     * session-sticky credential (no API-key matching needed), applies the
+     * storage action for the error class, then clears the sticky so the next
+     * {@link AuthStorage.getApiKey} for this session picks a sibling.
+     *
+     * - usage-limit / account-rate-limit error → {@link AuthStorage.markUsageLimitReached}
+     *   (temporary block via its own backoff — default plus server usage-report
+     *   reset; sticky left intact so the next resolve re-ranks around the block).
+     * - otherwise (hard 401 / auth failure) → mark the credential suspect (or
+     *   reload when no broker hook is wired) and block it, then drop the sticky.
+     *
+     * Returns whether another usable credential of the same type remains.
+     */
+    rotateSessionCredential(provider: string, sessionId: string | undefined, options?: {
+        error?: unknown;
+        signal?: AbortSignal;
+    }): Promise<boolean>;
+    /**
+     * Build an {@link ApiKeyResolver} backed by this storage, implementing the
+     * central a/b/c auth-retry policy:
+     *
+     * - initial (`error: undefined`) → resolve the session credential.
+     * - step (b) `!lastChance` → force-refresh the SAME session-sticky credential.
+     * - step (c) `lastChance` → rotate to a sibling credential, then re-resolve.
+     *
+     * Used by web-search providers and other consumers that hold an AuthStorage
+     * directly (no ModelRegistry in scope).
+     */
+    resolver(provider: string, options?: {
+        sessionId?: string;
+        baseUrl?: string;
+        modelId?: string;
+    }): ApiKeyResolver;
     /**
      * Build a redacted snapshot of all loaded credentials for the auth-broker
      * wire. OAuth refresh tokens are replaced with {@link REMOTE_REFRESH_SENTINEL}

package/dist/types/effort.d.ts

@@ -0,0 +1,9 @@
+/** User-facing thinking levels, ordered least to most intensive. */
+export declare const enum Effort {
+    Minimal = "minimal",
+    Low = "low",
+    Medium = "medium",
+    High = "high",
+    XHigh = "xhigh"
+}
+export declare const THINKING_EFFORTS: readonly Effort[];

package/dist/types/index.d.ts

@@ -3,7 +3,9 @@ export * from "./api-registry";
 export * from "./auth-broker";
 export { type AuthGatewayBootOptions, type ModelResolver, startAuthGateway } from "./auth-gateway/server";
 export * from "./auth-gateway/types";
+export * from "./auth-retry";
 export * from "./auth-storage";
+export * from "./effort";
 export * from "./model-cache";
 export * from "./model-manager";
 export * from "./model-thinking";

package/dist/types/model-thinking.d.ts

@@ -1,13 +1,5 @@
+import { Effort } from "./effort";
 import type { Api, Model as ApiModel } from "./types";
-/** User-facing thinking levels, ordered least to most intensive. */
-export declare const enum Effort {
-    Minimal = "minimal",
-    Low = "low",
-    Medium = "medium",
-    High = "high",
-    XHigh = "xhigh"
-}
-export declare const THINKING_EFFORTS: readonly Effort[];
 /**
  * Static fallback model injected when Cloudflare AI Gateway discovery
  * returns no results. Ensures the provider always has at least one usable
@@ -91,10 +83,3 @@ export declare function hasOpus47ApiRestrictions(modelId: string): boolean;
  * @see https://platform.claude.com/docs/en/build-with-claude/mid-conversation-system-messages
  */
 export declare function supportsMidConversationSystemMessages(modelId: string): boolean;
-/**
- * Claude Opus 4.8 must emit at most one tool call per turn: the Anthropic
- * Messages provider sends `tool_choice.disable_parallel_tool_use = true` for
- * this model. Scoped to exactly 4.8 — earlier and later Opus versions keep
- * Anthropic's default parallel tool-calling.
- */
-export declare function disablesParallelToolUse(modelId: string): boolean;

package/dist/types/provider-models/openai-compat.d.ts

@@ -131,6 +131,11 @@ export declare function isFireworksKimiK2ModelId(modelId: string): boolean;
  * on Fireworks-backed providers, leaving every other model untouched.
  */
 export declare function clampFireworksKimiMaxTokens(modelId: string, candidate: number): number;
+/**
+ * Fireworks DeepSeek V4 accepts effort via `reasoning_effort` but rejects the
+ * DeepSeek-native binary `thinking` toggle when both are present.
+ */
+export declare function stripFireworksDeepSeekThinkingToggle(model: Model<"openai-completions">, publicModelId: string): Model<"openai-completions">;
 export interface FireworksModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;

package/dist/types/providers/amazon-bedrock.d.ts

@@ -6,7 +6,7 @@
  * No `@aws-sdk/*`, no `@smithy/*`, no `proxy-agent`. Proxies are honored via
  * Bun's native `HTTPS_PROXY` support.
  */
-import type { Effort } from "../model-thinking";
+import type { Effort } from "../effort";
 import type { StreamFunction, StreamOptions, ThinkingBudgets } from "../types";
 export type BedrockThinkingDisplay = "summarized" | "omitted";
 export interface BedrockOptions extends StreamOptions {

package/dist/types/providers/openai-responses-shared.d.ts

@@ -38,6 +38,21 @@ export declare function collectCustomCallIds(messages: ResponseInput): Set<strin
  * codex provider — issue #1351 / regression of #472.
  */
 export declare function repairOrphanResponsesToolOutputs(input: ResponseInput): ResponseInput;
+/**
+ * Synthesize a placeholder `function_call_output` / `custom_tool_call_output`
+ * for every `function_call` / `custom_tool_call` whose `call_id` has no matching
+ * output later in the same input. The Responses API rejects an unpaired call
+ * with `400 No tool output found for function call …`.
+ *
+ * Orphan calls surface when the user branches/navigates the session tree to a
+ * node that ends on a tool call (the tool-result child is excluded from the
+ * reconstructed history) or when a turn is aborted/crashes after the call
+ * streamed but before its result persisted. Dropping the call would erase the
+ * assistant's action; a placeholder output keeps the call visible so the model
+ * can recover (e.g. re-issue the call). Symmetric to
+ * {@link repairOrphanResponsesToolOutputs}.
+ */
+export declare function repairOrphanResponsesToolCalls(input: ResponseInput): ResponseInput;
 export declare function convertResponsesInputContent(content: string | Array<TextContent | ImageContent>, supportsImages: boolean): ResponseInputContent[] | undefined;
 export declare function convertResponsesAssistantMessage<TApi extends Api>(assistantMsg: AssistantMessage, model: Model<TApi>, msgIndex: number, knownCallIds: Set<string>, includeThinkingSignatures?: boolean, customCallIds?: Set<string>): ResponseInput;
 export declare function appendResponsesToolResultMessages<TApi extends Api>(messages: ResponseInput, toolResult: ToolResultMessage, model: Model<TApi>, strictResponsesPairing: boolean, knownCallIds: ReadonlySet<string>, customCallIds?: ReadonlySet<string>): void;

package/dist/types/stream.d.ts

@@ -1,4 +1,4 @@
-import type { Effort } from "./model-thinking";
+import type { Effort } from "./effort";
 import type { AnthropicOptions } from "./providers/anthropic";
 import type { GoogleOptions } from "./providers/google";
 import type { GoogleGeminiCliOptions } from "./providers/google-gemini-cli";

package/dist/types/types.d.ts

@@ -1,4 +1,5 @@
 import type { ZodType, z } from "zod/v4";
+import type { ApiKey } from "./auth-retry";
 import type { BedrockOptions } from "./providers/amazon-bedrock";
 import type { AnthropicOptions } from "./providers/anthropic";
 import type { AzureOpenAIResponsesOptions } from "./providers/azure-openai-responses";
@@ -50,7 +51,7 @@ export interface ThinkingConfig {
 }
 export type KnownProvider = "alibaba-coding-plan" | "amazon-bedrock" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "gitlab-duo" | "cursor" | "deepseek" | "xai" | "xai-oauth" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "zhipu-coding-plan" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "wafer-pass" | "wafer-serverless" | "zenmux" | "lm-studio";
 export type Provider = KnownProvider | string;
-import type { Effort } from "./model-thinking";
+import type { Effort } from "./effort";
 /** Token budgets for each thinking level (token-based providers only) */
 export type ThinkingBudgets = {
     [key in Effort]?: number;
@@ -159,12 +160,6 @@ export interface StreamOptions {
     maxTokens?: number;
     signal?: AbortSignal;
     apiKey?: string;
-    /**
-     * Called when a provider returns 401 before any replay-unsafe assistant
-     * event has been emitted. Returning a different key retries the provider
-     * request once.
-     */
-    onAuthError?: (provider: string, apiKey: string, error: unknown) => Promise<string | undefined>;
     cacheRetention?: CacheRetention;
     /**
      * Additional headers to include in provider requests.
@@ -274,7 +269,15 @@ export interface StreamOptions {
     /** Cursor exec/MCP tool handlers (cursor-agent only). */
     execHandlers?: CursorExecHandlers;
 }
-export interface SimpleStreamOptions extends StreamOptions {
+export interface SimpleStreamOptions extends Omit<StreamOptions, "apiKey"> {
+    /**
+     * API key for the request: either a static bearer string, or an
+     * {@link ApiKeyResolver} that mints/rotates the key across the central
+     * a/b/c auth-retry policy. `streamSimple`/`completeSimple` resolve a
+     * resolver to a string before per-provider dispatch, so providers only
+     * ever see the resolved {@link StreamOptions.apiKey} string.
+     */
+    apiKey?: ApiKey;
     reasoning?: Effort;
     /**
      * Force-disable reasoning for the request even when the model supports it.

package/dist/types/utils/schema/fields.d.ts

@@ -30,6 +30,11 @@ export declare const NON_STRUCTURAL_SCHEMA_KEYS: Record<string, true>;
  * Used when collapsing mixed-type combiner variants for CCA Claude.
  */
 export declare const CLOUD_CODE_ASSIST_TYPE_SPECIFIC_KEYS: Record<string, Record<string, true>>;
+/**
+ * Flat set of every type-specific key across all CCA types.
+ * Used to identify sibling keys that need filtering during mixed-type collapse.
+ */
+export declare const ALL_CCA_TYPE_SPECIFIC_KEYS: Record<string, true>;
 /**
  * Cloud Code Assist shared schema keys allowed on any type.
  * Used alongside CLOUD_CODE_ASSIST_TYPE_SPECIFIC_KEYS for CCA combiner collapsing.

package/dist/types/utils/schema/json-schema-validator.d.ts

@@ -3,6 +3,14 @@ export interface JsonSchemaValidationIssue {
     message: string;
     expectedTypes?: string[];
     keyword?: string;
+    /**
+     * Marks issues that originate inside a failed `anyOf` / `oneOf` branch.
+     * Consumers such as the tool-argument coercion layer use this to avoid
+     * applying type repairs (e.g. singleton-array wrapping) that would be
+     * authoritative outside of a combinator but are only one candidate
+     * branch's expectation here.
+     */
+    fromUnionBranch?: boolean;
 }
 export interface JsonSchemaValidationResult {
     success: boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "15.9.67",
+	"version": "15.10.1",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -39,7 +39,7 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.0",
-		"@oh-my-pi/pi-utils": "15.9.67",
+		"@oh-my-pi/pi-utils": "15.10.1",
 		"openai": "^6.39.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-gateway/server.ts

@@ -18,8 +18,9 @@
  *   POST /v1/responses                     → OpenAI Responses in/out
  */
 import { extractRetryHint, logger } from "@oh-my-pi/pi-utils";
+import type { ApiKeyResolver } from "../auth-retry";
 import type { AuthStorage } from "../auth-storage";
-import { Effort } from "../model-thinking";
+import { Effort } from "../effort";
 import * as anthropicMessages from "../providers/anthropic-messages-server";
 import * as openaiChat from "../providers/openai-chat-server";
 import * as openaiResponses from "../providers/openai-responses-server";
@@ -340,6 +341,60 @@ async function refreshGatewayApiKeyAfterAuthError(
 	return storage.getApiKey(provider, sessionId, { modelId: model.id, signal });
 }
 
+/**
+ * Build the {@link ApiKeyResolver} handed to `streamSimple` for a gateway
+ * request. Drives the central a/b/c auth-retry policy server-side:
+ *
+ * - initial resolve → the credential already resolved for this request.
+ * - step (b) `!lastChance` → force-refresh the SAME session-sticky credential
+ *   (a peer/broker may have rotated its token out from under our cached copy).
+ * - step (c) `lastChance` → {@link refreshGatewayApiKeyAfterAuthError} switches
+ *   to a sibling (usage-limit block vs credential invalidation by error class).
+ *
+ * `lastKey` tracks the most recent bearer so the switch step invalidates the
+ * credential that actually failed.
+ */
+function buildGatewayApiKeyResolver(
+	storage: AuthStorage,
+	model: Model<Api>,
+	sessionId: string,
+	initialKey: string,
+	requestSignal: AbortSignal,
+	format: string,
+	peer: string,
+): ApiKeyResolver {
+	let lastKey = initialKey;
+	return async ({ lastChance, error, signal }) => {
+		const sig = signal ?? requestSignal;
+		if (error === undefined) {
+			lastKey = initialKey;
+			return initialKey;
+		}
+		if (!lastChance) {
+			const refreshed = await storage.getApiKey(model.provider, sessionId, {
+				modelId: model.id,
+				signal: sig,
+				forceRefresh: true,
+			});
+			lastKey = refreshed ?? lastKey;
+			return refreshed;
+		}
+		const next = await refreshGatewayApiKeyAfterAuthError(
+			storage,
+			model,
+			sessionId,
+			model.provider,
+			lastKey,
+			error,
+			sig,
+			format,
+			peer,
+		);
+		lastKey = next ?? lastKey;
+		return next;
+	};
+}
+
 function clientClosedResponse(route: { module: FormatModule }): Response {
 	return route.module.formatError(499, "request_aborted", "client closed request");
 }
@@ -447,19 +502,15 @@ async function handleFormatEndpoint(
 	}
 
 	const streamOpts = buildStreamOptions(parsed, model.api, controller.signal);
-	streamOpts.apiKey = apiKey;
-	streamOpts.onAuthError = (provider, oldKey, error) =>
-		refreshGatewayApiKeyAfterAuthError(
-			bootOpts.storage,
-			model,
-			sessionId,
-			provider,
-			oldKey,
-			error,
-			controller.signal,
-			route.label,
-			peer,
-		);
+	streamOpts.apiKey = buildGatewayApiKeyResolver(
+		bootOpts.storage,
+		model,
+		sessionId,
+		apiKey,
+		controller.signal,
+		route.label,
+		peer,
+	);
 
 	logger.info("auth-gateway request", {
 		format: route.label,
@@ -604,18 +655,15 @@ async function handlePiNative(bootOpts: AuthGatewayBootOptions, req: Request, pe
 	// only inject server-controlled fields. The codex temperature/topP strip
 	// matches `buildStreamOptions` — Codex rejects them with a 400.
 	const streamOpts: SimpleStreamOptions = { ...parsed.options, apiKey, signal: controller.signal };
-	streamOpts.onAuthError = (provider, oldKey, error) =>
-		refreshGatewayApiKeyAfterAuthError(
-			bootOpts.storage,
-			model,
-			sessionId,
-			provider,
-			oldKey,
-			error,
-			controller.signal,
-			"pi-native",
-			peer,
-		);
+	streamOpts.apiKey = buildGatewayApiKeyResolver(
+		bootOpts.storage,
+		model,
+		sessionId,
+		apiKey,
+		controller.signal,
+		"pi-native",
+		peer,
+	);
 	if (model.api === "openai-codex-responses") {
 		delete streamOpts.temperature;
 		delete streamOpts.topP;

package/src/auth-gateway/types.ts

@@ -1,4 +1,4 @@
-import type { Effort } from "../model-thinking";
+import type { Effort } from "../effort";
 import type {
 	AssistantMessage,
 	AssistantMessageEventStream,