@oh-my-pi/pi-ai 16.1.14 → 16.1.15

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [16.1.15] - 2026-06-22
+
+### Fixed
+
+- Fixed API-key `/login` providers replacing sibling credentials instead of appending new keys for the same provider. ([#3265](https://github.com/can1357/oh-my-pi/issues/3265))
+- Fixed OpenAI Codex OAuth account rotation for quota failures that surface as bare HTTP 429 or `insufficient_quota`, so pre-content failures temporarily block only the exhausted credential and retry a healthy sibling. The 429 status-only fallback applies only to absent/opaque bodies; informative transient bodies (`Too many requests`, `Service overloaded 529`, `Please retry in 5s`, …) defer to `parseRateLimitReason` and stay in the provider's own backoff layer instead of burning sibling credentials. ([#3231](https://github.com/can1357/oh-my-pi/issues/3231))
+
 ## [16.1.14] - 2026-06-22
 
 ### Added

package/dist/types/auth-retry.d.ts

@@ -48,8 +48,12 @@ export declare function resolveApiKeyOnce(key: ApiKey | undefined, signal?: Abor
 export declare function seedApiKeyResolver(seed: string | undefined, resolver: ApiKeyResolver): ApiKeyResolver;
 /**
  * Classifies whether an error should trigger a credential refresh/rotation
- * retry: a hard `401`, or a rotatable usage-limit ("usage_limit_reached",
- * Codex's "you have hit your ChatGPT usage limit", etc.).
+ * retry: a hard `401`, body-classified usage limit (Codex
+ * `usage_limit_reached`, Anthropic account rate-limit, Google
+ * `resource_exhausted`, OpenAI `insufficient_quota`, …), or a bare `429`
+ * whose payload did not preserve a richer quota code. Transient 429s
+ * (`Too many requests`, per-minute caps) classify as `RATE_LIMIT_EXCEEDED`
+ * via {@link parseRateLimitReason} and stay in the upstream-backoff lane.
  */
 export declare function isAuthRetryableError(error: unknown): boolean;
 /**

package/dist/types/providers/openai-shared.d.ts

@@ -475,9 +475,12 @@ export declare function populateResponsesUsageFromResponse(output: AssistantMess
     input_tokens_details?: {
         cached_tokens?: number | null;
         cache_write_tokens?: number | null;
+        orchestration_input_tokens?: number | null;
+        orchestration_input_cached_tokens?: number | null;
     } | null;
     output_tokens_details?: {
         reasoning_tokens?: number | null;
+        orchestration_output_tokens?: number | null;
     } | null;
 } | null | undefined): void;
 /**

package/dist/types/rate-limit-utils.d.ts

@@ -17,4 +17,30 @@ export declare function parseRateLimitReason(errorMessage: string): RateLimitRea
  * MODEL_CAPACITY gets jitter to prevent thundering herd.
  */
 export declare function calculateRateLimitBackoffMs(reason: RateLimitReason): number;
+/**
+ * HTTP status codes that, absent richer body classification, represent an
+ * account-local usage cap rather than a bad credential or a transient blip.
+ * Always combine with {@link isUsageLimitOutcome} when a message is available
+ * — a 429 carrying transient rate-limit wording is NOT a usage cap.
+ */
+export declare function isUsageLimitStatus(status: number | undefined): boolean;
+/**
+ * Returns true for failures that should burn one credential and rotate to a
+ * sibling account. Decision tree:
+ *
+ *  1. Body matches {@link isUsageLimitError} (Codex `usage_limit_reached`,
+ *     Anthropic account rate-limit, Google `resource_exhausted`, OpenAI
+ *     `insufficient_quota`, …) → rotate.
+ *  2. Status is not 429 → backoff (caller's domain).
+ *  3. Body is absent or {@link isOpaqueStatusBody opaque} (just the status,
+ *     empty JSON, HTTP framing only) → rotate conservatively: the server
+ *     gave us nothing else to go on.
+ *  4. Body has content → defer to {@link parseRateLimitReason}. Only
+ *     `QUOTA_EXHAUSTED` rotates; `RATE_LIMIT_EXCEEDED` (`Too many requests`,
+ *     per-minute caps), `MODEL_CAPACITY_EXHAUSTED` (`Service overloaded`),
+ *     `SERVER_ERROR`, and `UNKNOWN` (`Please retry in 5s`) stay in the
+ *     provider's own backoff layer so transient 429s don't burn sibling
+ *     credentials.
+ */
+export declare function isUsageLimitOutcome(status: number | undefined, message: string | undefined): boolean;
 export declare function isUsageLimitError(errorMessage: string): boolean;

package/dist/types/registry/nvidia.d.ts

@@ -4,5 +4,4 @@ export declare const nvidiaProvider: {
     readonly id: "nvidia";
     readonly name: "NVIDIA";
     readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
-    readonly appendApiKeyLogin: true;
 };

package/dist/types/registry/registry.d.ts

@@ -153,7 +153,6 @@ declare const ALL: ({
     readonly id: "nvidia";
     readonly name: "NVIDIA";
     readonly login: (cb: import("./oauth").OAuthLoginCallbacks) => Promise<string>;
-    readonly appendApiKeyLogin: true;
 } | {
     readonly id: "ollama";
     readonly name: "Ollama (Local OpenAI-compatible)";

package/dist/types/registry/types.d.ts

@@ -40,8 +40,6 @@ export interface ProviderDefinition {
     readonly showInLoginList?: boolean;
     readonly envKeys?: KeyResolver;
     readonly login?: (callbacks: OAuthLoginCallbacks) => Promise<OAuthCredentials | string>;
-    /** String-returning login appends API keys instead of replacing the provider's existing key. */
-    readonly appendApiKeyLogin?: boolean;
     readonly refreshToken?: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
     readonly getApiKey?: (credentials: OAuthCredentials) => string;
     /** Store OAuth credentials under a different provider id (e.g. `openai-codex-device` ⇒ `openai-codex`). */

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "16.1.14",
+	"version": "16.1.15",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.0",
-		"@oh-my-pi/pi-catalog": "16.1.14",
-		"@oh-my-pi/pi-utils": "16.1.14",
-		"@oh-my-pi/pi-wire": "16.1.14",
+		"@oh-my-pi/pi-catalog": "16.1.15",
+		"@oh-my-pi/pi-utils": "16.1.15",
+		"@oh-my-pi/pi-wire": "16.1.15",
 		"arktype": "^2.2.0",
 		"zod": "^4"
 	},

package/src/auth-gateway/server.ts

@@ -19,14 +19,14 @@
  */
 
 import { Effort } from "@oh-my-pi/pi-catalog/effort";
-import { extractRetryHint, logger } from "@oh-my-pi/pi-utils";
+import { extractHttpStatusFromError, extractRetryHint, logger } from "@oh-my-pi/pi-utils";
 import type { ApiKeyResolver } from "../auth-retry";
 import type { AuthStorage } from "../auth-storage";
 import * as anthropicMessages from "../providers/anthropic-messages-server";
 import * as openaiChat from "../providers/openai-chat-server";
 import * as openaiResponses from "../providers/openai-responses-server";
 import * as piNative from "../providers/pi-native-server";
-import { isUsageLimitError } from "../rate-limit-utils";
+import { isUsageLimitError, isUsageLimitOutcome } from "../rate-limit-utils";
 import { streamSimple } from "../stream";
 import type { Api, AssistantMessageEventStream, Context, Model, SimpleStreamOptions } from "../types";
 import { deterministicUuid } from "../utils/deterministic-id";
@@ -315,7 +315,7 @@ async function refreshGatewayApiKeyAfterAuthError(
 	peer: string,
 ): Promise<string | undefined> {
 	const message = error instanceof Error ? error.message : String(error);
-	if (isUsageLimitError(message)) {
+	if (isUsageLimitOutcome(extractHttpStatusFromError(error), message)) {
 		const retryAfterMs = extractRetryHint(undefined, message);
 		const { switched, retryAtMs } = await storage.markUsageLimitReached(provider, sessionId, {
 			retryAfterMs,

package/src/auth-retry.ts

@@ -1,6 +1,6 @@
 import { extractHttpStatusFromError } from "@oh-my-pi/pi-utils";
 import type { OAuthAccess } from "./auth-storage";
-import { isUsageLimitError } from "./rate-limit-utils";
+import { isUsageLimitOutcome } from "./rate-limit-utils";
 
 /**
  * Context passed to an {@link ApiKeyResolver} on each resolution attempt.
@@ -72,15 +72,20 @@ export function seedApiKeyResolver(seed: string | undefined, resolver: ApiKeyRes
 
 /**
  * Classifies whether an error should trigger a credential refresh/rotation
- * retry: a hard `401`, or a rotatable usage-limit ("usage_limit_reached",
- * Codex's "you have hit your ChatGPT usage limit", etc.).
+ * retry: a hard `401`, body-classified usage limit (Codex
+ * `usage_limit_reached`, Anthropic account rate-limit, Google
+ * `resource_exhausted`, OpenAI `insufficient_quota`, …), or a bare `429`
+ * whose payload did not preserve a richer quota code. Transient 429s
+ * (`Too many requests`, per-minute caps) classify as `RATE_LIMIT_EXCEEDED`
+ * via {@link parseRateLimitReason} and stay in the upstream-backoff lane.
  */
 export function isAuthRetryableError(error: unknown): boolean {
-	if (extractHttpStatusFromError(error) === 401) return true;
+	const status = extractHttpStatusFromError(error);
+	if (status === 401) return true;
 	const message = error instanceof Error ? error.message : typeof error === "string" ? error : undefined;
-	if (!message) return false;
-	if (extractHttpStatusFromError({ message }) === 401) return true;
-	return isUsageLimitError(message);
+	const embeddedStatus = message ? extractHttpStatusFromError({ message }) : undefined;
+	if (embeddedStatus === 401) return true;
+	return isUsageLimitOutcome(status ?? embeddedStatus, message);
 }
 
 /**

package/src/auth-storage.ts

@@ -10,9 +10,9 @@
 import { Database, type Statement } from "bun:sqlite";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { getAgentDbPath, logger } from "@oh-my-pi/pi-utils";
+import { extractHttpStatusFromError, getAgentDbPath, logger } from "@oh-my-pi/pi-utils";
 import type { ApiKeyResolver } from "./auth-retry";
-import { isUsageLimitError } from "./rate-limit-utils";
+import { isUsageLimitOutcome } from "./rate-limit-utils";
 import { getProviderDefinition } from "./registry";
 import { getOAuthApiKey, getOAuthProvider, refreshOAuthToken } from "./registry/oauth";
 import type { OAuthController, OAuthCredentials, OAuthProvider, OAuthProviderId } from "./registry/oauth/types";
@@ -1845,14 +1845,9 @@ export class AuthStorage {
 				return;
 			}
 			const newCredential: ApiKeyCredential = { type: "api_key", key: result };
-			const appendApiKeyLogin = "appendApiKeyLogin" in def && def.appendApiKeyLogin === true;
-			const stored = appendApiKeyLogin
-				? this.#store.upsertAuthCredentialRemote
-					? await this.#store.upsertAuthCredentialRemote(provider, newCredential)
-					: this.#store.upsertAuthCredentialForProvider(provider, newCredential)
-				: this.#store.replaceAuthCredentialsRemote
-					? await this.#store.replaceAuthCredentialsRemote(provider, [newCredential])
-					: this.#store.replaceAuthCredentialsForProvider(provider, [newCredential]);
+			const stored = this.#store.upsertAuthCredentialRemote
+				? await this.#store.upsertAuthCredentialRemote(provider, newCredential)
+				: this.#store.upsertAuthCredentialForProvider(provider, newCredential);
 			this.#setStoredCredentials(
 				provider,
 				stored.map(entry => ({ id: entry.id, credential: entry.credential })),
@@ -4089,8 +4084,9 @@ export class AuthStorage {
 		if (!sessionCredential) return false;
 
 		const error = options?.error;
+		const status = extractHttpStatusFromError(error);
 		const message = error instanceof Error ? error.message : typeof error === "string" ? error : undefined;
-		if (message && isUsageLimitError(message)) {
+		if (isUsageLimitOutcome(status, message)) {
 			return (
 				await this.markUsageLimitReached(provider, sessionId, {
 					modelId: options?.modelId,

package/src/providers/openai-shared.ts

@@ -2401,19 +2401,29 @@ export function populateResponsesUsageFromResponse(
 				input_tokens_details?: {
 					cached_tokens?: number | null;
 					cache_write_tokens?: number | null;
+					orchestration_input_tokens?: number | null;
+					orchestration_input_cached_tokens?: number | null;
+				} | null;
+				output_tokens_details?: {
+					reasoning_tokens?: number | null;
+					orchestration_output_tokens?: number | null;
 				} | null;
-				output_tokens_details?: { reasoning_tokens?: number | null } | null;
 		  }
 		| null
 		| undefined,
 ): void {
 	if (!usage) return;
+	const details = usage.input_tokens_details;
+	const outputDetails = usage.output_tokens_details;
+	const orchestrationInputTokens = details?.orchestration_input_tokens ?? 0;
+	const orchestrationInputCachedTokens = details?.orchestration_input_cached_tokens ?? 0;
+	const orchestrationOutputTokens = outputDetails?.orchestration_output_tokens ?? 0;
 	const accounting = calculateOpenAIUsageAccounting({
-		promptTokens: usage.input_tokens ?? 0,
-		outputTokens: usage.output_tokens ?? 0,
-		cachedTokens: usage.input_tokens_details?.cached_tokens ?? usage.prompt_cache_hit_tokens ?? 0,
-		reasoningTokens: usage.output_tokens_details?.reasoning_tokens ?? 0,
-		cacheWriteOpenRouter: usage.input_tokens_details?.cache_write_tokens ?? undefined,
+		promptTokens: (usage.input_tokens ?? 0) + orchestrationInputTokens,
+		outputTokens: (usage.output_tokens ?? 0) + orchestrationOutputTokens,
+		cachedTokens: (details?.cached_tokens ?? usage.prompt_cache_hit_tokens ?? 0) + orchestrationInputCachedTokens,
+		reasoningTokens: outputDetails?.reasoning_tokens ?? 0,
+		cacheWriteOpenRouter: details?.cache_write_tokens ?? undefined,
 		cacheWriteDeepSeek: usage.prompt_cache_miss_tokens ?? undefined,
 		hasDeepSeekCacheHitAndMiss:
 			usage.prompt_cache_hit_tokens !== undefined && usage.prompt_cache_miss_tokens !== undefined,

package/src/rate-limit-utils.ts

@@ -100,7 +100,55 @@ export function calculateRateLimitBackoffMs(reason: RateLimitReason): number {
 
 /** Detect usage/quota limit errors in error messages (persistent, requires credential switch). */
 const USAGE_LIMIT_PATTERN =
-	/usage.?limit|usage_limit_reached|usage_not_included|limit_reached|quota.?exceeded|quota.?reached|resource.?exhausted|exhausted your capacity|quota will reset|insufficient.?balance/i;
+	/usage.?limit|usage_limit_reached|usage_not_included|limit_reached|quota.?exceeded|quota.?reached|resource.?exhausted|exhausted your capacity|quota will reset|insufficient.?(?:balance|quota)/i;
+
+/**
+ * HTTP status codes that, absent richer body classification, represent an
+ * account-local usage cap rather than a bad credential or a transient blip.
+ * Always combine with {@link isUsageLimitOutcome} when a message is available
+ * — a 429 carrying transient rate-limit wording is NOT a usage cap.
+ */
+export function isUsageLimitStatus(status: number | undefined): boolean {
+	return status === 429;
+}
+
+/**
+ * Returns true for failures that should burn one credential and rotate to a
+ * sibling account. Decision tree:
+ *
+ *  1. Body matches {@link isUsageLimitError} (Codex `usage_limit_reached`,
+ *     Anthropic account rate-limit, Google `resource_exhausted`, OpenAI
+ *     `insufficient_quota`, …) → rotate.
+ *  2. Status is not 429 → backoff (caller's domain).
+ *  3. Body is absent or {@link isOpaqueStatusBody opaque} (just the status,
+ *     empty JSON, HTTP framing only) → rotate conservatively: the server
+ *     gave us nothing else to go on.
+ *  4. Body has content → defer to {@link parseRateLimitReason}. Only
+ *     `QUOTA_EXHAUSTED` rotates; `RATE_LIMIT_EXCEEDED` (`Too many requests`,
+ *     per-minute caps), `MODEL_CAPACITY_EXHAUSTED` (`Service overloaded`),
+ *     `SERVER_ERROR`, and `UNKNOWN` (`Please retry in 5s`) stay in the
+ *     provider's own backoff layer so transient 429s don't burn sibling
+ *     credentials.
+ */
+export function isUsageLimitOutcome(status: number | undefined, message: string | undefined): boolean {
+	if (message && isUsageLimitError(message)) return true;
+	if (!isUsageLimitStatus(status)) return false;
+	if (!message || isOpaqueStatusBody(message)) return true;
+	return parseRateLimitReason(message) === "QUOTA_EXHAUSTED";
+}
+
+/**
+ * A 429 body is opaque when it carries no signal beyond the status itself —
+ * empty, whitespace-only, the status digits with HTTP/JSON framing, or
+ * generic punctuation. Anything else (retry hints, capacity wording, error
+ * descriptions) is informative enough to defer to the classifier.
+ */
+function isOpaqueStatusBody(message: string): boolean {
+	const cleaned = message
+		.replace(/\b429\b/g, "")
+		.replace(/\b(?:http|https|status|error|code|response|message)\b/gi, "");
+	return !/[a-z\d]{3,}/i.test(cleaned);
+}
 
 export function isUsageLimitError(errorMessage: string): boolean {
 	return USAGE_LIMIT_PATTERN.test(errorMessage) || ACCOUNT_RATE_LIMIT_PATTERN.test(errorMessage);

package/src/registry/nvidia.ts

@@ -58,5 +58,4 @@ export const nvidiaProvider = {
 	id: "nvidia",
 	name: "NVIDIA",
 	login: (cb: OAuthLoginCallbacks) => loginNvidia(cb),
-	appendApiKeyLogin: true,
 } as const satisfies ProviderDefinition;

package/src/registry/types.ts

@@ -44,8 +44,6 @@ export interface ProviderDefinition {
 	readonly envKeys?: KeyResolver;
 	// --- interactive login (OAuthProviderInterface-compatible) ---
 	readonly login?: (callbacks: OAuthLoginCallbacks) => Promise<OAuthCredentials | string>;
-	/** String-returning login appends API keys instead of replacing the provider's existing key. */
-	readonly appendApiKeyLogin?: boolean;
 	readonly refreshToken?: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
 	readonly getApiKey?: (credentials: OAuthCredentials) => string;
 	/** Store OAuth credentials under a different provider id (e.g. `openai-codex-device` ⇒ `openai-codex`). */

package/src/stream.ts

@@ -48,7 +48,7 @@ import {
 	streamOpenAIResponses,
 } from "./providers/register-builtins";
 import { isSyntheticModel, streamSynthetic } from "./providers/synthetic";
-import { isUsageLimitError } from "./rate-limit-utils";
+import { isUsageLimitOutcome } from "./rate-limit-utils";
 import { PROVIDER_REGISTRY } from "./registry";
 import type {
 	Api,
@@ -384,13 +384,18 @@ function extractStatusFromAssistantError(message: AssistantMessage): number | un
 function isRetryableUpstreamError(error: unknown, status: number | undefined, message: string | undefined): boolean {
 	// 401 means the credential is bad. Usage-limit phrasing (Codex's
 	// "You have hit your ChatGPT usage limit", Anthropic's "usage_limit_reached",
-	// Google's "resource_exhausted") means this account is parked but a
-	// sibling credential can usually pick the request up. Both are
-	// rotatable via `onAuthError` — the auth-gateway maps the former to
-	// `invalidateCredentialMatching` and the latter to `markUsageLimitReached`.
+	// Google's "resource_exhausted", OpenAI's "insufficient_quota") and 429s
+	// without transient rate-limit wording mean this account is parked but a
+	// sibling credential can usually pick the request up. Both are rotatable
+	// via `onAuthError` — the auth-gateway maps the former to
+	// `invalidateCredentialMatching` and the latter to
+	// `markUsageLimitReached`. Transient 429s ("Too many requests",
+	// per-minute caps) classify as RATE_LIMIT_EXCEEDED in
+	// `parseRateLimitReason` and stay in the provider's own backoff layer
+	// instead of burning siblings.
 	if (status === 401) return true;
 	void error;
-	return !!message && isUsageLimitError(message);
+	return isUsageLimitOutcome(status, message);
 }
 
 function createAssistantAuthError(message: AssistantMessage): Error {