@oh-my-pi/pi-ai 16.1.12 → 16.1.14

package/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 ## [Unreleased]
 
+## [16.1.14] - 2026-06-22
+
+### Added
+
+- Added proxy support for model providers via `PI_PROXY` and `PI_PROXY_<PROVIDER>` variables
+- Added `NO_PROXY` environment variable support for bypassing proxy configuration
+- Added support for Sakana AI provider
+- Added Sakana AI login and request base URL support for `SAKANA_*` / `FUGU_*` environment variables
+
+### Changed
+
+- Consolidated API key authentication logic across registry providers
+- Disabled parallel tool calls for Devin provider requests
+
+### Fixed
+
+- Improved proxy bypass logic to correctly handle private IP ranges and local metadata services
+- Enhanced memoization for proxy environment variable lookups to improve performance
+
+## [16.1.13] - 2026-06-22
+
+### Added
+
+- Added support for Devin as a provider
+
+### Changed
+
+- Updated tool call arguments to use `Record<string, unknown>` and `unknown` for tool results
+
+### Fixed
+
+- Fixed OpenAI Responses native history replay dropping failed/incomplete image generation calls instead of resending their transient `ig_...` item IDs, preventing follow-up requests from failing with `404 Item with id ... not found`. ([#3225](https://github.com/can1357/oh-my-pi/issues/3225))
+- Fixed `/login fireworks` rejecting valid `fw_…` keys with `Fireworks API key validation failed (500): Error listing deployed models`. The validator pinged `/inference/v1/models`, which Fireworks serves from the per-account deployment registry and 500s for accounts without active deployments. Login now hits the static control-plane `List Models` catalog (`GET /v1/accounts/fireworks/models?filter=supports_serverless=true&pageSize=1`) — the same endpoint discovery already uses — so authentication no longer depends on the caller's deployment state. ([#3219](https://github.com/can1357/oh-my-pi/issues/3219))
+
 ## [16.1.11] - 2026-06-21
 
 ### Fixed

package/dist/types/providers/aws-credentials.d.ts

@@ -18,6 +18,7 @@
  * Resolved credentials are cached process-wide per profile and refreshed
  * 60 s before `Expiration` to absorb clock skew.
  */
+import type { FetchImpl } from "../types";
 import type { AwsCredentials } from "./aws-sigv4";
 export interface ResolvedCredentials extends AwsCredentials {
     /** Absolute expiration timestamp in ms. `undefined` for non-expiring static creds. */
@@ -29,6 +30,7 @@ export interface CredentialResolveOptions {
     /** Falls back to env (`AWS_REGION` / `AWS_DEFAULT_REGION`) and finally `us-east-1`. */
     region?: string;
     signal?: AbortSignal;
+    fetch?: FetchImpl;
 }
 export declare function resolveAwsCredentials(opts?: CredentialResolveOptions): Promise<ResolvedCredentials>;
 /** POSIX-shell-style tokenizer used by the AWS CLI for `credential_process`.

package/dist/types/providers/devin.d.ts

@@ -0,0 +1,12 @@
+import type { StreamFunction, StreamOptions } from "../types";
+/** Base host for Codeium/Windsurf's Cascade chat API (Connect protocol over HTTP/1.1). */
+export declare const DEVIN_API_URL = "https://server.codeium.com";
+export interface DevinOptions extends StreamOptions {
+    /** Cascade conversation id; reused as `cascade_id` so the server threads turns. */
+    conversationId?: string;
+    /** Falls back to `cascade_id` when no `conversationId` is supplied. */
+    sessionId?: string;
+    /** Wire model uid selected after thinking-effort routing. */
+    chatModelUid?: string;
+}
+export declare const streamDevin: StreamFunction<"devin-agent">;

package/dist/types/providers/register-builtins.d.ts

@@ -26,6 +26,7 @@ export declare const streamOpenAICodexResponses: (model: Model<"openai-codex-res
 export declare const streamOpenAICompletions: (model: Model<"openai-completions">, context: Context, options: OptionsForApi<"openai-completions">) => EventStreamImpl;
 export declare const streamOpenAIResponses: (model: Model<"openai-responses">, context: Context, options: OptionsForApi<"openai-responses">) => EventStreamImpl;
 export declare const streamCursor: (model: Model<"cursor-agent">, context: Context, options: OptionsForApi<"cursor-agent">) => EventStreamImpl;
+export declare const streamDevin: (model: Model<"devin-agent">, context: Context, options: OptionsForApi<"devin-agent">) => EventStreamImpl;
 export declare const streamOllama: (model: Model<"ollama-chat">, context: Context, options: OptionsForApi<"ollama-chat">) => EventStreamImpl;
 export declare const streamBedrock: (model: Model<"bedrock-converse-stream">, context: Context, options: OptionsForApi<"bedrock-converse-stream">) => EventStreamImpl;
 export {};

package/dist/types/registry/devin.d.ts

@@ -0,0 +1,8 @@
+import type { OAuthLoginCallbacks } from "./oauth/types";
+export declare const devinProvider: {
+    readonly id: "devin";
+    readonly name: "Devin";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+    readonly callbackPort: 59653;
+    readonly pasteCodeFlow: true;
+};

package/dist/types/registry/huggingface.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
-export declare function loginHuggingface(options: OAuthController): Promise<string>;
+import type { OAuthLoginCallbacks } from "./oauth/types";
+export declare const loginHuggingface: (options: import("./oauth").OAuthController) => Promise<string>;
 export declare const huggingfaceProvider: {
     readonly id: "huggingface";
     readonly name: "Hugging Face Inference";

package/dist/types/registry/oauth/devin.d.ts

@@ -0,0 +1,5 @@
+import type { OAuthController, OAuthCredentials } from "./types";
+type FetchFunction = NonNullable<OAuthController["fetch"]>;
+export declare function loginDevin(ctrl: OAuthController): Promise<OAuthCredentials>;
+export declare function exchangeDevinCliToken(authorizationCode: string, codeVerifier: string, fetchImpl?: FetchFunction): Promise<string>;
+export {};

package/dist/types/registry/oauth/minimax-code.d.ts

@@ -12,17 +12,16 @@
  * International: https://api.minimax.io/v1
  * China: https://api.minimaxi.com/v1
  */
-import type { OAuthController } from "./types";
 /**
  * Login to MiniMax Token Plan (international).
  *
  * Opens browser to subscription page, prompts user to paste their API key.
  * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
  */
-export declare function loginMiniMaxCode(options: OAuthController): Promise<string>;
+export declare const loginMiniMaxCode: (options: import("./types").OAuthController) => Promise<string>;
 /**
  * Login to MiniMax Token Plan (China).
  *
  * Same flow as international but uses China endpoint.
  */
-export declare function loginMiniMaxCodeCn(options: OAuthController): Promise<string>;
+export declare const loginMiniMaxCodeCn: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/registry/qianfan.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
-export declare function loginQianfan(options: OAuthController): Promise<string>;
+import type { OAuthLoginCallbacks } from "./oauth/types";
+export declare const loginQianfan: (options: import("./oauth").OAuthController) => Promise<string>;
 export declare const qianfanProvider: {
     readonly id: "qianfan";
     readonly name: "Qianfan";

package/dist/types/registry/registry.d.ts

@@ -46,6 +46,12 @@ declare const ALL: ({
     readonly id: "deepseek";
     readonly name: "DeepSeek";
     readonly login: (cb: import("./oauth").OAuthLoginCallbacks) => Promise<string>;
+} | {
+    readonly id: "devin";
+    readonly name: "Devin";
+    readonly login: (cb: import("./oauth").OAuthLoginCallbacks) => Promise<string>;
+    readonly callbackPort: 59653;
+    readonly pasteCodeFlow: true;
 } | {
     readonly id: "firepass";
     readonly name: "Fire Pass (Fireworks Kimi K2.6 Turbo subscription)";
@@ -202,6 +208,10 @@ declare const ALL: ({
     readonly id: "qwen-portal";
     readonly name: "Qwen Portal";
     readonly login: (cb: import("./oauth").OAuthLoginCallbacks) => Promise<string>;
+} | {
+    readonly id: "sakana";
+    readonly name: "Sakana AI";
+    readonly login: (cb: import("./oauth").OAuthLoginCallbacks) => Promise<string>;
 } | {
     readonly id: "synthetic";
     readonly name: "Synthetic";

package/dist/types/registry/sakana.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types";
+export declare const loginSakana: (options: import("./oauth").OAuthController) => Promise<string>;
+export declare const sakanaProvider: {
+    readonly id: "sakana";
+    readonly name: "Sakana AI";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/venice.d.ts

@@ -1,11 +1,11 @@
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import type { OAuthLoginCallbacks } from "./oauth/types";
 /**
  * Login to Venice.
  *
  * Opens browser to API keys page, prompts user to paste their API key.
  * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
  */
-export declare function loginVenice(options: OAuthController): Promise<string>;
+export declare const loginVenice: (options: import("./oauth").OAuthController) => Promise<string>;
 export declare const veniceProvider: {
     readonly id: "venice";
     readonly name: "Venice";

package/dist/types/registry/zai.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
-export declare function loginZai(options: OAuthController): Promise<string>;
+import type { OAuthLoginCallbacks } from "./oauth/types";
+export declare const loginZai: (options: import("./oauth").OAuthController) => Promise<string>;
 export declare const zaiProvider: {
     readonly id: "zai";
     readonly name: "Z.AI (GLM Coding Plan)";

package/dist/types/registry/zhipu-coding-plan.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
-export declare function loginZhipuCodingPlan(options: OAuthController): Promise<string>;
+import type { OAuthLoginCallbacks } from "./oauth/types";
+export declare const loginZhipuCodingPlan: (options: import("./oauth").OAuthController) => Promise<string>;
 export declare const zhipuCodingPlanProvider: {
     readonly id: "zhipu-coding-plan";
     readonly name: "Zhipu Coding Plan (智谱)";

package/dist/types/types.d.ts

@@ -11,6 +11,7 @@ import type { AnthropicOptions } from "./providers/anthropic";
 import type { StopDetails } from "./providers/anthropic-wire";
 import type { AzureOpenAIResponsesOptions } from "./providers/azure-openai-responses";
 import type { CursorOptions } from "./providers/cursor";
+import type { DevinOptions } from "./providers/devin";
 import type { GoogleOptions } from "./providers/google";
 import type { GoogleGeminiCliOptions } from "./providers/google-gemini-cli";
 import type { GoogleVertexOptions } from "./providers/google-vertex";
@@ -46,6 +47,7 @@ export interface ApiOptionsMap {
     "google-vertex": GoogleVertexOptions;
     "ollama-chat": OllamaChatOptions;
     "cursor-agent": CursorOptions;
+    "devin-agent": DevinOptions;
 }
 export type OptionsForApi<TApi extends Api> = StreamOptions | (TApi extends keyof ApiOptionsMap ? ApiOptionsMap[TApi] : never);
 export interface TokenTaskBudget {
@@ -354,7 +356,7 @@ export interface ToolCall {
     type: "toolCall";
     id: string;
     name: string;
-    arguments: Record<string, any>;
+    arguments: Record<string, unknown>;
     thoughtSignature?: string;
     intent?: string;
     /**
@@ -442,7 +444,7 @@ export interface AssistantMessage {
     duration?: number;
     ttft?: number;
 }
-export interface ToolResultMessage<TDetails = any> {
+export interface ToolResultMessage<TDetails = unknown> {
     role: "toolResult";
     toolCallId: string;
     toolName: string;

package/dist/types/utils/deterministic-id.d.ts

@@ -0,0 +1,16 @@
+/**
+ * A UUID-shaped string: five hex groups in the canonical 8-4-4-4-12 layout.
+ *
+ * NOT a spec-compliant RFC 4122 UUID — the version/variant nibbles are left as
+ * raw hash output — but the shape passes everywhere a UUID string is expected.
+ */
+export type DeterministicUuid = `${string}-${string}-${string}-${string}-${string}`;
+/**
+ * Format the leading 128 bits of `seed`'s SHA-256 digest as a v4-shape UUID
+ * (8-4-4-4-12 hex groups).
+ *
+ * Deterministic: identical seeds always map to the same id, so callers get
+ * stable ids across requests / conversation turns (reusing message-blob ids,
+ * keying prompt caches) without persisting a seed→id mapping.
+ */
+export declare function deterministicUuid(seed: string): DeterministicUuid;

package/dist/types/utils/proxy.d.ts

@@ -0,0 +1,29 @@
+import * as tls from "node:tls";
+import type { FetchImpl } from "../types";
+/**
+ * Checks if a host is local or cloud metadata, which should always bypass the proxy
+ * (e.g. localhost, 127/8, ::1, 169.254.169.254, metadata.google.internal).
+ */
+export declare function isLocalOrMetadataHost(host: string): boolean;
+/**
+ * Check if the url should bypass the proxy due to hard-coded localhost/metadata checks
+ * or custom NO_PROXY/no_proxy environment variables rules.
+ */
+export declare function shouldBypassProxy(urlObj: URL): boolean;
+/** Test seam: clears the provider proxy cache. */
+export declare function __resetProxyCache(): void;
+/**
+ * Normalizes provider id (e.g. github-copilot -> PI_PROXY_GITHUB_COPILOT) and looks it up.
+ * If not found, falls back to PI_PROXY. Results are memoized because env values are static
+ * for the lifetime of the process and this function is called for every outgoing request.
+ */
+export declare function getProxyForProvider(provider: string): string | undefined;
+/**
+ * Wraps a fetch implementation to inject proxy options for non-local hosts.
+ */
+export declare function wrapFetchForProxy(fetchImpl: FetchImpl, provider: string): FetchImpl;
+/**
+ * Tunnel a socket connection through an HTTP CONNECT proxy.
+ * This is used specifically to wrap Node's `http2.connect(baseUrl, { createConnection })` for Cursor.
+ */
+export declare function connectProxiedSocket(proxyUrlStr: string, targetUrlStr: string): Promise<tls.TLSSocket>;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "16.1.12",
+	"version": "16.1.14",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,13 +38,14 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.0",
-		"@oh-my-pi/pi-catalog": "16.1.12",
-		"@oh-my-pi/pi-utils": "16.1.12",
-		"@oh-my-pi/pi-wire": "16.1.12",
+		"@oh-my-pi/pi-catalog": "16.1.14",
+		"@oh-my-pi/pi-utils": "16.1.14",
+		"@oh-my-pi/pi-wire": "16.1.14",
 		"arktype": "^2.2.0",
 		"zod": "^4"
 	},
 	"devDependencies": {
+		"@bufbuild/protoc-gen-es": "^2.12.0",
 		"@types/bun": "^1.3.14"
 	},
 	"engines": {

package/src/api-registry.ts

@@ -14,9 +14,10 @@ import type {
 	StreamOptions,
 } from "./types";
 
-const BUILTIN_APIS = new Set<KnownApi>([
+const BUILTIN_API_IDS = [
 	"openai-completions",
 	"openai-responses",
+	"openrouter",
 	"openai-codex-responses",
 	"azure-openai-responses",
 	"anthropic-messages",
@@ -26,7 +27,16 @@ const BUILTIN_APIS = new Set<KnownApi>([
 	"google-vertex",
 	"ollama-chat",
 	"cursor-agent",
-]);
+	"devin-agent",
+] as const satisfies readonly KnownApi[];
+
+type _MissingBuiltinApis = Exclude<KnownApi, (typeof BUILTIN_API_IDS)[number]>;
+type _CheckBuiltinApis = _MissingBuiltinApis extends never
+	? true
+	: ["BUILTIN_APIS is missing KnownApi values", _MissingBuiltinApis];
+true satisfies _CheckBuiltinApis;
+
+const BUILTIN_APIS = new Set<KnownApi>(BUILTIN_API_IDS);
 
 export type CustomStreamFn = (
 	model: Model<Api>,

package/src/auth-gateway/server.ts

@@ -29,6 +29,7 @@ import * as piNative from "../providers/pi-native-server";
 import { isUsageLimitError } from "../rate-limit-utils";
 import { streamSimple } from "../stream";
 import type { Api, AssistantMessageEventStream, Context, Model, SimpleStreamOptions } from "../types";
+import { deterministicUuid } from "../utils/deterministic-id";
 import { parseBind } from "../utils/parse-bind";
 import { captureRequestHeaders, corsHeaders, isAuthorized, json, resolvePeer, withCors } from "./http";
 import type {
@@ -110,11 +111,9 @@ function deriveSessionId(modelId: string, context: Context): string {
 		parts.push(JSON.stringify({ role: first.role, content: first.content }));
 	}
 	const seed = parts.join("\u0000");
-	const hex = new Bun.CryptoHasher("sha256").update(seed).digest("hex");
-	// Format the leading 128 bits as a v4-shape UUID (8-4-4-4-12). Codex's
-	// `normalizeOpenAIResponsesPromptCacheKey` accepts ≤64 chars verbatim, so
-	// the 36-char UUID flows through unchanged.
-	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+	// The 36-char UUID flows through unchanged: Codex's
+	// `normalizeOpenAIResponsesPromptCacheKey` accepts ≤64 chars verbatim.
+	return deterministicUuid(seed);
 }
 
 function buildStreamOptions(parsed: ParsedFormatRequest, api: Api, signal: AbortSignal): SimpleStreamOptions {

package/src/providers/amazon-bedrock.ts

@@ -302,6 +302,7 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 						profile: options.profile,
 						region,
 						signal: options.signal,
+						fetch: options.fetch,
 					});
 				}
 				const signed = await signRequest({

package/src/providers/anthropic-messages-server.ts

@@ -204,7 +204,10 @@ function walkAssistantContent(
 					type: "toolCall",
 					id: block.id,
 					name: block.name,
-					arguments: block.input ?? {},
+					arguments:
+						block.input && typeof block.input === "object" && !Array.isArray(block.input)
+							? (block.input as Record<string, unknown>)
+							: {},
 				});
 				break;
 			default: {

package/src/providers/aws-credentials.ts

@@ -23,6 +23,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { $env, isEnoent, logger } from "@oh-my-pi/pi-utils";
+import type { FetchImpl } from "../types";
 import { raceWithSignal } from "../utils/abort";
 import type { AwsCredentials } from "./aws-sigv4";
 
@@ -37,6 +38,7 @@ export interface CredentialResolveOptions {
 	/** Falls back to env (`AWS_REGION` / `AWS_DEFAULT_REGION`) and finally `us-east-1`. */
 	region?: string;
 	signal?: AbortSignal;
+	fetch?: FetchImpl;
 }
 
 const REFRESH_SKEW_MS = 60_000;
@@ -75,9 +77,10 @@ export async function resolveAwsCredentials(opts: CredentialResolveOptions = {})
 	const existing = inflight.get(cacheKey);
 	if (existing) return raceWithSignal(existing, opts.signal);
 
+	const fetchImpl = opts.fetch ?? (globalThis.fetch as FetchImpl);
 	const promise = (async () => {
 		try {
-			const creds = await resolveFresh(profile, region, AbortSignal.timeout(SHARED_RESOLVE_TIMEOUT_MS));
+			const creds = await resolveFresh(profile, region, AbortSignal.timeout(SHARED_RESOLVE_TIMEOUT_MS), fetchImpl);
 			cache.set(cacheKey, { creds, expiresAt: creds.expiresAt ?? Number.POSITIVE_INFINITY });
 			return creds;
 		} finally {
@@ -88,18 +91,23 @@ export async function resolveAwsCredentials(opts: CredentialResolveOptions = {})
 	return raceWithSignal(promise, opts.signal);
 }
 
-async function resolveFresh(profile: string, region: string, signal?: AbortSignal): Promise<ResolvedCredentials> {
+async function resolveFresh(
+	profile: string,
+	region: string,
+	signal?: AbortSignal,
+	fetchImpl: FetchImpl = globalThis.fetch as FetchImpl,
+): Promise<ResolvedCredentials> {
 	// 1. Environment first — matches the AWS SDK chain order.
 	const envCreds = readEnvCredentials();
 	if (envCreds) return envCreds;
 
 	// 2. Profile (static or SSO).
-	const profileCreds = await readProfileCredentials(profile, region, signal);
+	const profileCreds = await readProfileCredentials(profile, region, signal, fetchImpl);
 	if (profileCreds) return profileCreds;
 
 	// 3. EC2 IMDSv2.
 	if ($env.AWS_EC2_METADATA_DISABLED?.toLowerCase() !== "true") {
-		const imdsCreds = await readImdsCredentials(signal);
+		const imdsCreds = await readImdsCredentials(signal, fetchImpl);
 		if (imdsCreds) return imdsCreds;
 	}
 
@@ -167,6 +175,7 @@ async function readProfileCredentials(
 	profile: string,
 	region: string,
 	signal: AbortSignal | undefined,
+	fetchImpl: FetchImpl,
 ): Promise<ResolvedCredentials | undefined> {
 	const home = os.homedir();
 	const credentialsPath = $env.AWS_SHARED_CREDENTIALS_FILE || path.join(home, ".aws", "credentials");
@@ -195,7 +204,7 @@ async function readProfileCredentials(
 	}
 
 	if (merged.sso_account_id && merged.sso_role_name) {
-		return readSsoCredentials(merged, configIni, region, signal);
+		return readSsoCredentials(merged, configIni, region, signal, fetchImpl);
 	}
 
 	if (merged.credential_process) {
@@ -217,6 +226,7 @@ async function readSsoCredentials(
 	configIni: IniFile | undefined,
 	defaultRegion: string,
 	signal: AbortSignal | undefined,
+	fetchImpl: FetchImpl,
 ): Promise<ResolvedCredentials | undefined> {
 	// Two SSO profile shapes:
 	//   - legacy: `sso_start_url` + `sso_region` directly on the profile
@@ -246,7 +256,7 @@ async function readSsoCredentials(
 		`https://portal.sso.${ssoRegion}.amazonaws.com/federation/credentials` +
 		`?account_id=${encodeURIComponent(profileCfg.sso_account_id)}` +
 		`&role_name=${encodeURIComponent(profileCfg.sso_role_name)}`;
-	const response = await fetch(url, {
+	const response = await fetchImpl(url, {
 		method: "GET",
 		headers: { "x-amz-sso_bearer_token": token.accessToken },
 		signal,
@@ -480,11 +490,14 @@ export function tokenizeCredentialProcessCommand(cmd: string): string[] {
 const IMDS_HOST = "169.254.169.254";
 const IMDS_TIMEOUT_MS = 1000;
 
-async function readImdsCredentials(parentSignal: AbortSignal | undefined): Promise<ResolvedCredentials | undefined> {
+async function readImdsCredentials(
+	parentSignal: AbortSignal | undefined,
+	fetchImpl: FetchImpl,
+): Promise<ResolvedCredentials | undefined> {
 	const timeout = AbortSignal.timeout(IMDS_TIMEOUT_MS);
 	const signal = parentSignal ? AbortSignal.any([parentSignal, timeout]) : timeout;
 	try {
-		const tokenRes = await fetch(`http://${IMDS_HOST}/latest/api/token`, {
+		const tokenRes = await fetchImpl(`http://${IMDS_HOST}/latest/api/token`, {
 			method: "PUT",
 			headers: { "x-aws-ec2-metadata-token-ttl-seconds": "21600" },
 			signal,
@@ -492,7 +505,7 @@ async function readImdsCredentials(parentSignal: AbortSignal | undefined): Promi
 		if (!tokenRes.ok) return undefined;
 		const token = await tokenRes.text();
 
-		const roleRes = await fetch(`http://${IMDS_HOST}/latest/meta-data/iam/security-credentials/`, {
+		const roleRes = await fetchImpl(`http://${IMDS_HOST}/latest/meta-data/iam/security-credentials/`, {
 			headers: { "x-aws-ec2-metadata-token": token },
 			signal,
 		});
@@ -500,7 +513,7 @@ async function readImdsCredentials(parentSignal: AbortSignal | undefined): Promi
 		const role = (await roleRes.text()).trim();
 		if (!role) return undefined;
 
-		const credsRes = await fetch(
+		const credsRes = await fetchImpl(
 			`http://${IMDS_HOST}/latest/meta-data/iam/security-credentials/${encodeURIComponent(role)}`,
 			{
 				headers: { "x-aws-ec2-metadata-token": token },

package/src/providers/cursor.ts

@@ -124,8 +124,10 @@ import type {
 	ToolResultMessage,
 } from "../types";
 import { normalizeSystemPrompts } from "../utils";
+import { deterministicUuid } from "../utils/deterministic-id";
 import { AssistantMessageEventStream } from "../utils/event-stream";
 import { parseJsonWithRepair, parseStreamingJson } from "../utils/json-parse";
+import { connectProxiedSocket, getProxyForProvider, shouldBypassProxy } from "../utils/proxy";
 import { createRequestDebugSession, isRequestDebugEnabled, type RequestDebugResponseLog } from "../utils/request-debug";
 import { formatErrorMessageWithRetryAfter } from "../utils/retry-after";
 import { toolWireSchema } from "../utils/schema/wire";
@@ -376,7 +378,15 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 					})
 				: undefined;
 
-			h2Client = http2.connect(baseUrl);
+			const proxyUrl = shouldBypassProxy(new URL(baseUrl)) ? undefined : getProxyForProvider(model.provider);
+			if (proxyUrl) {
+				const tlsSocket = await connectProxiedSocket(proxyUrl, baseUrl);
+				h2Client = http2.connect(baseUrl, {
+					createConnection: () => tlsSocket,
+				});
+			} else {
+				h2Client = http2.connect(baseUrl);
+			}
 
 			h2Request = h2Client.request(requestHeaders);
 
@@ -2258,19 +2268,6 @@ function extractAssistantMessageText(msg: Message): string {
 		.join("\n");
 }
 
-/**
- * Derive a stable, UUID-formatted `message_id` from a content key.
- * Ensures identical historical messages hash to the same blob IDs across
- * requests, so `conversationBlobStores` does not grow unboundedly and
- * unchanged history reuses existing blob IDs.
- */
-type CursorMessageId = `${string}-${string}-${string}-${string}-${string}`;
-
-function deterministicMessageId(key: string): CursorMessageId {
-	const hex = createHash("sha256").update(key).digest("hex");
-	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
-}
-
 /**
  * Index of the last user/developer message in `messages`, or -1 if none.
  * Used to exclude the current user turn from history builders — it goes in
@@ -2394,7 +2391,7 @@ function buildConversationTurns(
 		const userMessage = createCursorUserMessage(
 			msg.content,
 			userText,
-			deterministicMessageId(`u:${turns.length}:${cursorUserContentKey(msg.content)}`),
+			deterministicUuid(`u:${turns.length}:${cursorUserContentKey(msg.content)}`),
 		);
 		const userMessageBytes = toBinary(UserMessageSchema, userMessage);
 		const userMessageBlobId = storeCursorBlob(blobStore, userMessageBytes);