@oh-my-pi/pi-ai 16.1.7 → 16.1.8

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## [Unreleased]
 
+## [16.1.8] - 2026-06-20
+
+### Changed
+
+- Changed OpenAI Responses and Codex Responses custom grammar tool requests to leave `parallel_tool_calls` unset instead of forcing serial tool calls; Codex `responsesLite` still disables parallel tool calls when tools are present.
+
+### Fixed
+
+- Fixed Bedrock `/btw` and other no-tool ephemeral turns failing after prior tool calls by sending the required sentinel `toolConfig` whenever replayed history contains `toolUse`/`toolResult` blocks. ([#3124](https://github.com/can1357/oh-my-pi/issues/3124))
+- Fixed Anthropic Messages pre-content TLS `bad record MAC` server transport errors surfacing before the provider retry loop exhausts its budget. ([#3134](https://github.com/can1357/oh-my-pi/issues/3134))
+- Fixed API-key login flows replacing existing stored keys for the same provider, so providers such as NVIDIA NIM can keep multiple active keys available for session-level rotation. ([#2923](https://github.com/can1357/oh-my-pi/issues/2923))
+- Fixed `openai-codex-responses` forwarding sampling controls (`temperature`, `top_p`, `top_k`, `min_p`, `presence_penalty`, `repetition_penalty`) into the Codex request body — the ChatGPT-subscription Codex backend rejects each of them with a 400 `{"detail":"Unsupported parameter: temperature"}`, so any caller setting non-default `StreamOptions` saw every turn fail. The provider now drops the full sampling set (matching codex-rs), and the auth-gateway's defensive strip on both `buildStreamOptions` and the pi-native path was widened from `{temperature, topP}` to the same set plus `stopSequences`/`frequencyPenalty`. ([#3117](https://github.com/can1357/oh-my-pi/issues/3117))
+- Fixed Anthropic Messages retry classification for transient TLS/server-error failures such as `tls: bad record MAC (type=server_error)`. These pre-content transport blips are now retried inside the provider loop before the session sees an error banner.
+
 ## [16.1.4] - 2026-06-19
 
 ### Added

package/dist/types/providers/openai-codex/request-transformer.d.ts

@@ -34,12 +34,6 @@ export interface RequestBody {
     input?: InputItem[];
     tools?: unknown;
     tool_choice?: unknown;
-    temperature?: number;
-    top_p?: number;
-    top_k?: number;
-    min_p?: number;
-    presence_penalty?: number;
-    repetition_penalty?: number;
     reasoning?: Partial<ReasoningConfig>;
     text?: {
         verbosity?: "low" | "medium" | "high";

package/dist/types/providers/openai-codex-responses.d.ts

@@ -1,5 +1,5 @@
 import type { Context, Model, ProviderSessionState, ServiceTier, StreamFunction, StreamOptions, Tool, ToolChoice } from "../types";
-import { type CodexReasoningContext } from "./openai-codex/request-transformer";
+import { type CodexReasoningContext, type RequestBody } from "./openai-codex/request-transformer";
 import type { ResponseInput } from "./openai-responses-wire";
 export interface OpenAICodexResponsesOptions extends StreamOptions {
     reasoning?: "none" | "minimal" | "low" | "medium" | "high" | "xhigh";
@@ -49,6 +49,8 @@ export interface OpenAICodexWebSocketDebugStats {
 }
 /** @internal Exported for tests. */
 export declare function normalizeCodexToolChoice(choice: ToolChoice | undefined, tools?: Tool[], model?: Model<"openai-codex-responses">): string | Record<string, unknown> | undefined;
+/** @internal Exported for tests. */
+export declare function buildTransformedCodexRequestBody(model: Model<"openai-codex-responses">, context: Context, options: OpenAICodexResponsesOptions | undefined, promptCacheKey?: string | undefined): Promise<RequestBody>;
 export declare const streamOpenAICodexResponses: StreamFunction<"openai-codex-responses">;
 export declare function prewarmOpenAICodexResponses(model: Model<"openai-codex-responses">, options?: Pick<OpenAICodexResponsesOptions, "apiKey" | "headers" | "sessionId" | "signal" | "preferWebsockets" | "providerSessionState" | "responsesLite">): Promise<void>;
 export interface OpenAICodexTransportDetails {

package/dist/types/registry/nvidia.d.ts

@@ -4,4 +4,5 @@ export declare const nvidiaProvider: {
     readonly id: "nvidia";
     readonly name: "NVIDIA";
     readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+    readonly appendApiKeyLogin: true;
 };

package/dist/types/registry/registry.d.ts

@@ -142,6 +142,7 @@ declare const ALL: ({
     readonly id: "nvidia";
     readonly name: "NVIDIA";
     readonly login: (cb: import("./oauth").OAuthLoginCallbacks) => Promise<string>;
+    readonly appendApiKeyLogin: true;
 } | {
     readonly id: "ollama";
     readonly name: "Ollama (Local OpenAI-compatible)";

package/dist/types/registry/types.d.ts

@@ -40,6 +40,8 @@ export interface ProviderDefinition {
     readonly showInLoginList?: boolean;
     readonly envKeys?: KeyResolver;
     readonly login?: (callbacks: OAuthLoginCallbacks) => Promise<OAuthCredentials | string>;
+    /** String-returning login appends API keys instead of replacing the provider's existing key. */
+    readonly appendApiKeyLogin?: boolean;
     readonly refreshToken?: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
     readonly getApiKey?: (credentials: OAuthCredentials) => string;
     /** Store OAuth credentials under a different provider id (e.g. `openai-codex-device` ⇒ `openai-codex`). */

package/dist/types/types.d.ts

@@ -93,10 +93,12 @@ export type ResolvedServiceTier = Exclude<ServiceTier, "openai-only" | "claude-o
  */
 export declare function resolveServiceTier(serviceTier: ServiceTier | null | undefined, provider: Provider | undefined): ResolvedServiceTier | undefined;
 /**
- * True when the (possibly scoped) tier should be sent as OpenAI's
- * `service_tier` request field for the given provider. Non-OpenAI
- * providers, unsupported tiers (`"auto"`, `"default"`), and scope
- * mismatches all return false.
+ * True when the (possibly scoped) tier should be sent on the wire as the
+ * `service_tier` request field for the given provider. OpenAI / OpenAI-Codex
+ * accept `flex`/`scale`/`priority`; Fireworks Serverless realizes only its
+ * Priority serving path (`service_tier: "priority"`) on the OpenAI-compatible
+ * chat-completions endpoint. Unsupported tiers (`"auto"`, `"default"`), other
+ * providers, and scope mismatches all return false.
  */
 export declare function shouldSendServiceTier(serviceTier: ServiceTier | null | undefined, provider: Provider | undefined): boolean;
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "16.1.7",
+	"version": "16.1.8",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.0",
-		"@oh-my-pi/pi-catalog": "16.1.7",
-		"@oh-my-pi/pi-utils": "16.1.7",
-		"@oh-my-pi/pi-wire": "16.1.7",
+		"@oh-my-pi/pi-catalog": "16.1.8",
+		"@oh-my-pi/pi-utils": "16.1.8",
+		"@oh-my-pi/pi-wire": "16.1.8",
 		"arktype": "^2.2.0",
 		"partial-json": "^0.1.7",
 		"zod": "^4"

package/src/auth-gateway/server.ts

@@ -120,20 +120,20 @@ function deriveSessionId(modelId: string, context: Context): string {
 function buildStreamOptions(parsed: ParsedFormatRequest, api: Api, signal: AbortSignal): SimpleStreamOptions {
 	const opts: SimpleStreamOptions = { signal };
 	const { options } = parsed;
-	// Codex backend rejects `temperature` / `top_p` (per-model defaults only),
-	// so we drop them silently for that one provider. Every other unsupported
-	// option is just ignored by `streamSimple` if the underlying provider
-	// doesn't honour it.
+	// Codex backend rejects every sampling control with
+	// `Unsupported parameter: …` (#3117). Strip the full set for that one
+	// provider; everything else is harmless to forward — `streamSimple` ignores
+	// what the underlying provider doesn't honour.
 	const isCodex = api === "openai-codex-responses";
 	if (options.maxOutputTokens !== undefined) opts.maxTokens = options.maxOutputTokens;
 	if (options.temperature !== undefined && !isCodex) opts.temperature = options.temperature;
 	if (options.topP !== undefined && !isCodex) opts.topP = options.topP;
-	if (options.topK !== undefined) opts.topK = options.topK;
-	if (options.minP !== undefined) opts.minP = options.minP;
-	if (options.stopSequences !== undefined) opts.stopSequences = options.stopSequences;
-	if (options.presencePenalty !== undefined) opts.presencePenalty = options.presencePenalty;
-	if (options.frequencyPenalty !== undefined) opts.frequencyPenalty = options.frequencyPenalty;
-	if (options.repetitionPenalty !== undefined) opts.repetitionPenalty = options.repetitionPenalty;
+	if (options.topK !== undefined && !isCodex) opts.topK = options.topK;
+	if (options.minP !== undefined && !isCodex) opts.minP = options.minP;
+	if (options.stopSequences !== undefined && !isCodex) opts.stopSequences = options.stopSequences;
+	if (options.presencePenalty !== undefined && !isCodex) opts.presencePenalty = options.presencePenalty;
+	if (options.frequencyPenalty !== undefined && !isCodex) opts.frequencyPenalty = options.frequencyPenalty;
+	if (options.repetitionPenalty !== undefined && !isCodex) opts.repetitionPenalty = options.repetitionPenalty;
 	if (options.metadata !== undefined) opts.metadata = options.metadata;
 	if (options.headers !== undefined) opts.headers = { ...(opts.headers ?? {}), ...options.headers };
 	if (options.toolChoice !== undefined) {
@@ -662,8 +662,8 @@ async function handlePiNative(bootOpts: AuthGatewayBootOptions, req: Request, pe
 
 	// Build the SimpleStreamOptions actually handed to `streamSimple`. We
 	// trust the client's options (already allow-listed by `parseRequest`) and
-	// only inject server-controlled fields. The codex temperature/topP strip
-	// matches `buildStreamOptions` — Codex rejects them with a 400.
+	// only inject server-controlled fields. The codex sampling strip mirrors
+	// `buildStreamOptions` — Codex rejects every one with a 400 (#3117).
 	const streamOpts: SimpleStreamOptions = { ...parsed.options, apiKey, signal: controller.signal };
 	streamOpts.apiKey = buildGatewayApiKeyResolver(
 		bootOpts.storage,
@@ -677,6 +677,12 @@ async function handlePiNative(bootOpts: AuthGatewayBootOptions, req: Request, pe
 	if (model.api === "openai-codex-responses") {
 		delete streamOpts.temperature;
 		delete streamOpts.topP;
+		delete streamOpts.topK;
+		delete streamOpts.minP;
+		delete streamOpts.stopSequences;
+		delete streamOpts.presencePenalty;
+		delete streamOpts.frequencyPenalty;
+		delete streamOpts.repetitionPenalty;
 	}
 	// Merge gateway-captured passthrough headers under the client's own
 	// headers — the client's values win when they collide.

package/src/auth-storage.ts

@@ -1825,10 +1825,6 @@ export class AuthStorage {
 			onPrompt: (prompt: { message: string; placeholder?: string }) => Promise<string>;
 		},
 	): Promise<void> {
-		const saveApiKeyCredential = async (apiKey: string): Promise<void> => {
-			const newCredential: ApiKeyCredential = { type: "api_key", key: apiKey };
-			await this.set(provider, newCredential);
-		};
 		const manualCodeInput = () => ctrl.onPrompt({ message: "Paste the authorization code (or full redirect URL):" });
 		// Built-in registry first, then runtime-registered extension providers.
 		const def = getProviderDefinition(provider) ?? getOAuthProvider(provider);
@@ -1848,7 +1844,20 @@ export class AuthStorage {
 			if (!result) {
 				return;
 			}
-			await saveApiKeyCredential(result);
+			const newCredential: ApiKeyCredential = { type: "api_key", key: result };
+			const appendApiKeyLogin = "appendApiKeyLogin" in def && def.appendApiKeyLogin === true;
+			const stored = appendApiKeyLogin
+				? this.#store.upsertAuthCredentialRemote
+					? await this.#store.upsertAuthCredentialRemote(provider, newCredential)
+					: this.#store.upsertAuthCredentialForProvider(provider, newCredential)
+				: this.#store.replaceAuthCredentialsRemote
+					? await this.#store.replaceAuthCredentialsRemote(provider, [newCredential])
+					: this.#store.replaceAuthCredentialsForProvider(provider, [newCredential]);
+			this.#setStoredCredentials(
+				provider,
+				stored.map(entry => ({ id: entry.id, credential: entry.credential })),
+			);
+			this.#resetProviderAssignments(provider);
 			return;
 		}
 		const newCredential: OAuthCredential = { type: "oauth", ...result };

package/src/providers/amazon-bedrock.ts

@@ -142,6 +142,28 @@ interface WireToolConfig {
 	toolChoice?: WireToolChoice;
 }
 
+/**
+ * Bedrock validates that requests carrying any `toolUse`/`toolResult` history
+ * include a `toolConfig`. For no-tool ephemeral turns (`/btw`, IRC auto-replies)
+ * we have nothing real to send, so we inject this placeholder. Its presence is
+ * tracked by a per-request flag — never the wire name — so callers who happen
+ * to register a real tool literally called `__no_tools__` are not affected.
+ */
+const NO_TOOLS_SENTINEL_NAME = "__no_tools__";
+
+const NO_TOOLS_SENTINEL: WireToolSpec = {
+	toolSpec: {
+		name: NO_TOOLS_SENTINEL_NAME,
+		description: "Placeholder required by Bedrock validation. Do not call; answer with text.",
+		inputSchema: { json: { type: "object", properties: {} } },
+	},
+};
+
+interface BedrockToolPlan {
+	toolConfig: WireToolConfig | undefined;
+	sentinelInjected: boolean;
+}
+
 interface ConverseStreamRequest {
 	messages: WireMessage[];
 	system?: SystemContent[];
@@ -222,10 +244,10 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 
 		try {
 			const cacheRetention = resolveCacheRetention(options.cacheRetention);
-			const historyHasToolBlocks = context.messages.some(
-				m => m.role === "toolResult" || (m.role === "assistant" && m.content.some(b => b.type === "toolCall")),
-			);
-			const toolConfig = convertToolConfig(context.tools, options.toolChoice, historyHasToolBlocks);
+			const convertedMessages = convertMessages(context, model, cacheRetention);
+			const toolPlan = planToolConfig(context.tools, options.toolChoice, convertedMessages);
+			const toolConfig = toolPlan.toolConfig;
+			const sentinelInjected = toolPlan.sentinelInjected;
 			let additionalModelRequestFields = buildAdditionalModelRequestFields(model, options);
 
 			// Bedrock rejects thinking + forced tool_choice ("any" or specific tool).
@@ -236,7 +258,7 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 			}
 
 			const commandInput: ConverseStreamRequest = {
-				messages: convertMessages(context, model, cacheRetention),
+				messages: convertedMessages,
 				system: buildSystemPrompt(context.systemPrompt, model, cacheRetention),
 				inferenceConfig: {
 					maxTokens: options.maxTokens,
@@ -369,7 +391,7 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 					}
 					case "contentBlockStart": {
 						if (!firstTokenTime) firstTokenTime = Date.now();
-						handleContentBlockStart(payload as ContentBlockStartEvent, blocks, output, stream);
+						handleContentBlockStart(payload as ContentBlockStartEvent, blocks, output, stream, sentinelInjected);
 						break;
 					}
 					case "contentBlockDelta": {
@@ -383,7 +405,10 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 					}
 					case "messageStop": {
 						const ev = payload as MessageStopEvent;
-						output.stopReason = mapStopReason(ev.stopReason);
+						// A sentinel-only request must never surface a tool-use stop:
+						// no real tool exists for the agent to dispatch.
+						output.stopReason =
+							sentinelInjected && ev.stopReason === "tool_use" ? "stop" : mapStopReason(ev.stopReason);
 						if (output.stopReason === "error") {
 							output.errorMessage = `Generation failed with stop reason: ${ev.stopReason ?? "unknown"}`;
 						}
@@ -462,10 +487,16 @@ function handleContentBlockStart(
 	blocks: Block[],
 	output: AssistantMessage,
 	stream: AssistantMessageEventStream,
+	sentinelInjected: boolean,
 ): void {
 	const index = event.contentBlockIndex;
 	const start = event.start;
 
+	// Drop the sentinel call only when we injected it ourselves. A caller that
+	// registers a real tool named `__no_tools__` would otherwise lose its
+	// legitimate tool-use events on normal turns.
+	if (sentinelInjected && start?.toolUse?.name === NO_TOOLS_SENTINEL_NAME) return;
+
 	if (start?.toolUse) {
 		const block: Block = {
 			type: "toolCall",
@@ -784,28 +815,48 @@ function convertMessages(
 	return result;
 }
 
-function convertToolConfig(
-	tools: Tool[] | undefined,
-	toolChoice: BedrockOptions["toolChoice"],
-	historyHasToolBlocks: boolean,
-): WireToolConfig | undefined {
-	if (!tools?.length) return undefined;
+function messagesHaveToolBlocks(messages: WireMessage[]): boolean {
+	for (const message of messages) {
+		for (const block of message.content) {
+			if ("toolUse" in block || "toolResult" in block) return true;
+		}
+	}
+	return false;
+}
 
-	const bedrockTools: WireToolSpec[] = tools.map(tool => ({
+function convertToolSpec(tool: Tool): WireToolSpec {
+	return {
 		toolSpec: {
 			name: tool.name,
 			description: tool.description || "",
 			inputSchema: { json: toolWireSchema(tool) },
 		},
-	}));
+	};
+}
+
+function planToolConfig(
+	tools: Tool[] | undefined,
+	toolChoice: BedrockOptions["toolChoice"],
+	messages: WireMessage[],
+): BedrockToolPlan {
+	const activeTools = tools ?? [];
+	const hasTools = activeTools.length > 0;
+	const historyHasToolBlocks = messagesHaveToolBlocks(messages);
 
-	// Bedrock rejects requests whose history contains toolUse/toolResult blocks without a
-	// toolConfig. With prior tool use we must keep the tool specs and merely omit the choice
-	// (there is no "none" choice on Converse); dropping toolConfig entirely would 400.
 	if (toolChoice === "none") {
-		return historyHasToolBlocks ? { tools: bedrockTools } : undefined;
+		if (!historyHasToolBlocks) return { toolConfig: undefined, sentinelInjected: false };
+		if (!hasTools) {
+			return {
+				toolConfig: { tools: [NO_TOOLS_SENTINEL], toolChoice: { auto: {} } },
+				sentinelInjected: true,
+			};
+		}
+		return { toolConfig: { tools: activeTools.map(convertToolSpec) }, sentinelInjected: false };
 	}
 
+	if (!hasTools) return { toolConfig: undefined, sentinelInjected: false };
+
+	const bedrockTools = activeTools.map(convertToolSpec);
 	let bedrockToolChoice: WireToolChoice | undefined;
 	switch (toolChoice) {
 		case "auto":
@@ -820,7 +871,7 @@ function convertToolConfig(
 			}
 	}
 
-	return { tools: bedrockTools, toolChoice: bedrockToolChoice };
+	return { toolConfig: { tools: bedrockTools, toolChoice: bedrockToolChoice }, sentinelInjected: false };
 }
 
 function mapStopReason(reason: string | undefined): StopReason {

package/src/providers/anthropic.ts

@@ -1485,6 +1485,10 @@ function isProviderRetryableStreamEnvelopeError(error: unknown): boolean {
 	return /stream event order|before message_start/i.test(error.message);
 }
 
+function isAnthropicTransientTransportMessage(message: string): boolean {
+	return message.includes("tls: bad record mac") || message.includes("type=server_error");
+}
+
 export function isProviderRetryableError(error: unknown, provider?: string): boolean {
 	if (!(error instanceof Error)) return false;
 	if (provider === "github-copilot" && isCopilotTransientModelError(error)) return true;
@@ -1501,7 +1505,8 @@ export function isProviderRetryableError(error: unknown, provider?: string): boo
 	const msg = error.message.toLowerCase();
 	if (
 		isUnexpectedSocketCloseMessage(msg) ||
-		/rate.?limit|too many requests|overloaded|service.?unavailable|internal_error|stream error.*received from peer|1302|timed?\s*out while waiting for the first event|timeout waiting for first/i.test(
+		isAnthropicTransientTransportMessage(msg) ||
+		/rate.?limit|too many requests|overloaded|service.?unavailable|internal_error|server_error|bad record mac|stream error.*received from peer|1302|timed?\s*out while waiting for the first event|timeout waiting for first/i.test(
 			msg,
 		) ||
 		isTransientStreamParseError(error) ||

package/src/providers/openai-codex/request-transformer.ts

@@ -41,12 +41,10 @@ export interface RequestBody {
 	input?: InputItem[];
 	tools?: unknown;
 	tool_choice?: unknown;
-	temperature?: number;
-	top_p?: number;
-	top_k?: number;
-	min_p?: number;
-	presence_penalty?: number;
-	repetition_penalty?: number;
+	// Sampling controls (temperature/top_p/top_k/min_p/presence_penalty/
+	// repetition_penalty/frequency_penalty/stop) are intentionally absent: the
+	// Codex backend rejects every one with a 400 `Unsupported parameter`, so
+	// the transformer never sets them (#3117).
 	reasoning?: Partial<ReasoningConfig>;
 	text?: {
 		verbosity?: "low" | "medium" | "high";

package/src/providers/openai-codex-responses.ts

@@ -714,7 +714,8 @@ async function buildCodexRequestContext(
 	};
 }
 
-async function buildTransformedCodexRequestBody(
+/** @internal Exported for tests. */
+export async function buildTransformedCodexRequestBody(
 	model: Model<"openai-codex-responses">,
 	context: Context,
 	options: OpenAICodexResponsesOptions | undefined,
@@ -729,25 +730,12 @@ async function buildTransformedCodexRequestBody(
 
 	// `maxTokens` is intentionally not forwarded: transformRequestBody strips
 	// `max_output_tokens`/`max_completion_tokens` (the Codex backend rejects
-	// caller-supplied output caps).
-	if (options?.temperature !== undefined) {
-		params.temperature = options.temperature;
-	}
-	if (options?.topP !== undefined) {
-		params.top_p = options.topP;
-	}
-	if (options?.topK !== undefined) {
-		params.top_k = options.topK;
-	}
-	if (options?.minP !== undefined) {
-		params.min_p = options.minP;
-	}
-	if (options?.presencePenalty !== undefined) {
-		params.presence_penalty = options.presencePenalty;
-	}
-	if (options?.repetitionPenalty !== undefined) {
-		params.repetition_penalty = options.repetitionPenalty;
-	}
+	// caller-supplied output caps). Sampling controls (`temperature`, `top_p`,
+	// `top_k`, `min_p`, `presence_penalty`, `repetition_penalty`,
+	// `frequency_penalty`, `stop`) are likewise refused with
+	// `{"detail":"Unsupported parameter: temperature"}` etc., so we drop
+	// everything from `StreamOptions` rather than forwarding any of them.
+	// (#3117 — codex-rs sends none of these either.)
 	applyOpenAIServiceTier(params, options?.serviceTier, model.provider);
 	if (context.tools && context.tools.length > 0) {
 		params.tools = convertOpenAICodexResponsesTools(context.tools, model);
@@ -757,16 +745,6 @@ async function buildTransformedCodexRequestBody(
 				params.tool_choice = toolChoice;
 			}
 		}
-		// When a custom-tool is active, force serial tool-calling. OpenAI's
-		// `parallel_tool_calls` is request-scoped — disabling it here affects
-		// every tool in the turn, not just the custom one. That's coarser
-		// than spec §1's "supports_parallel_tool_calls = false" (which
-		// strictly targets `apply_patch`), but the platform API offers no
-		// per-tool flag.
-		const emittedTools = params.tools as CodexToolPayload[];
-		if (emittedTools.some(t => t.type === "custom")) {
-			params.parallel_tool_calls = false;
-		}
 	}
 
 	const systemPrompts = normalizeSystemPrompts(context.systemPrompt);

package/src/providers/openai-completions.ts

@@ -175,6 +175,19 @@ function normalizeMistralToolId(id: string, isMistral: boolean): string {
 // #1488). The default route forwards `delta.content` (including DSML
 // envelope leaks) which `StreamMarkupHealing` heals into a structured call
 // client-side.
+function resolveOpenAICompletionsRoutingEffort(
+	model: Model<"openai-completions">,
+	effort: Effort | undefined,
+): Effort | undefined {
+	if (!effort) return undefined;
+	if (model.thinking?.efforts.includes(effort)) return effort;
+	const compatMappedEffort = model.compat.reasoningEffortMap?.[effort] as Effort | undefined;
+	if (compatMappedEffort && model.thinking?.efforts.includes(compatMappedEffort)) return compatMappedEffort;
+	const thinkingMappedEffort = model.thinking?.effortMap?.[effort] as Effort | undefined;
+	if (thinkingMappedEffort && model.thinking?.efforts.includes(thinkingMappedEffort)) return thinkingMappedEffort;
+	return effort;
+}
+
 function resolveOpenAICompletionsModelId(
 	model: Model<"openai-completions">,
 	options: OpenAICompletionsOptions | undefined,
@@ -182,8 +195,9 @@ function resolveOpenAICompletionsModelId(
 	// Effort-tier variants route per request effort (off → bare id, efforts →
 	// the thinking backing id); catalog variants (Copilot long-context `-1m`
 	// entries) pin via `requestModelId`; everything else serializes `model.id`.
-	const effort =
+	const requestedEffort =
 		options?.reasoning && !options.disableReasoning && model.reasoning ? (options.reasoning as Effort) : undefined;
+	const effort = resolveOpenAICompletionsRoutingEffort(model, requestedEffort);
 	const wireId = resolveWireModelId(model, effort);
 	return applyWireModelIdTransform(wireId, model.compat.wireModelIdMode, options?.openrouterVariant);
 }

package/src/providers/openai-responses.ts

@@ -862,15 +862,6 @@ export function buildParams(
 				params.tool_choice = toolChoice;
 			}
 		}
-		// The apply_patch spec §1 marks only `apply_patch` itself as
-		// `supports_parallel_tool_calls = false`. OpenAI's Responses API
-		// exposes `parallel_tool_calls` as a request-scoped flag, not a
-		// per-tool one, so when a custom grammar tool is in the list we
-		// disable parallelism for the whole turn. Slightly coarser than
-		// the spec requires — but the platform API offers no finer knob.
-		if (params.tools.some(t => (t as { type?: string }).type === "custom")) {
-			params.parallel_tool_calls = false;
-		}
 	}
 
 	const reasoningPolicy = resolveOpenAICompatPolicy(model, {

package/src/registry/nvidia.ts

@@ -39,6 +39,7 @@ export async function loginNvidia(options: OAuthController): Promise<string> {
 			baseUrl: API_BASE_URL,
 			model: VALIDATION_MODEL,
 			signal: options.signal,
+			fetch: options.fetch,
 		});
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
@@ -57,4 +58,5 @@ export const nvidiaProvider = {
 	id: "nvidia",
 	name: "NVIDIA",
 	login: (cb: OAuthLoginCallbacks) => loginNvidia(cb),
+	appendApiKeyLogin: true,
 } as const satisfies ProviderDefinition;

package/src/registry/types.ts

@@ -44,6 +44,8 @@ export interface ProviderDefinition {
 	readonly envKeys?: KeyResolver;
 	// --- interactive login (OAuthProviderInterface-compatible) ---
 	readonly login?: (callbacks: OAuthLoginCallbacks) => Promise<OAuthCredentials | string>;
+	/** String-returning login appends API keys instead of replacing the provider's existing key. */
+	readonly appendApiKeyLogin?: boolean;
 	readonly refreshToken?: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
 	readonly getApiKey?: (credentials: OAuthCredentials) => string;
 	/** Store OAuth credentials under a different provider id (e.g. `openai-codex-device` ⇒ `openai-codex`). */

package/src/stream.ts

@@ -673,6 +673,30 @@ function mapOpenAiToolChoice(choice?: ToolChoice): OpenAICompletionsOptions["too
 	return undefined;
 }
 
+type ReasoningEffortMapCompat = {
+	reasoningEffortMap?: Partial<Record<Effort, string>>;
+};
+
+function getCompatReasoningEffortMap<TApi extends Api>(
+	model: Model<TApi>,
+): Partial<Record<Effort, string>> | undefined {
+	const compat = model.compat;
+	if (compat === undefined || typeof compat !== "object" || !("reasoningEffortMap" in compat)) {
+		return undefined;
+	}
+	return (compat as ReasoningEffortMapCompat).reasoningEffortMap;
+}
+
+function resolveSupportedMappedReasoningEffort<TApi extends Api>(
+	model: Model<TApi>,
+	reasoning: Effort,
+): Effort | undefined {
+	const mapped = getCompatReasoningEffortMap(model)?.[reasoning];
+	if (!mapped) return undefined;
+	const mappedEffort = mapped as Effort;
+	return model.thinking?.efforts.includes(mappedEffort) ? mappedEffort : undefined;
+}
+
 function resolveOpenAiReasoningEffort<TApi extends Api>(
 	model: Model<TApi>,
 	options?: SimpleStreamOptions,
@@ -687,6 +711,11 @@ function resolveOpenAiReasoningEffort<TApi extends Api>(
 	// defeat the gate and surface a confusing "Compaction failed: Thinking effort
 	// high is not supported by..." to the user.
 	if (!model.thinking) return undefined;
+	if (model.thinking.efforts.includes(reasoning)) return reasoning;
+	const mappedReasoning = resolveSupportedMappedReasoningEffort(model, reasoning);
+	if (mappedReasoning) return mappedReasoning;
+	if (getCompatReasoningEffortMap(model)?.[reasoning] !== undefined) return reasoning;
+	if (model.thinking.effortMap?.[reasoning] !== undefined) return reasoning;
 	return requireSupportedEffort(model, reasoning);
 }
 

package/src/types.ts

@@ -141,18 +141,25 @@ export function resolveServiceTier(
 }
 
 /**
- * True when the (possibly scoped) tier should be sent as OpenAI's
- * `service_tier` request field for the given provider. Non-OpenAI
- * providers, unsupported tiers (`"auto"`, `"default"`), and scope
- * mismatches all return false.
+ * True when the (possibly scoped) tier should be sent on the wire as the
+ * `service_tier` request field for the given provider. OpenAI / OpenAI-Codex
+ * accept `flex`/`scale`/`priority`; Fireworks Serverless realizes only its
+ * Priority serving path (`service_tier: "priority"`) on the OpenAI-compatible
+ * chat-completions endpoint. Unsupported tiers (`"auto"`, `"default"`), other
+ * providers, and scope mismatches all return false.
  */
 export function shouldSendServiceTier(
 	serviceTier: ServiceTier | null | undefined,
 	provider: Provider | undefined,
 ): boolean {
-	if (provider !== "openai" && provider !== "openai-codex") return false;
 	const resolved = resolveServiceTier(serviceTier, provider);
-	return resolved === "flex" || resolved === "scale" || resolved === "priority";
+	if (provider === "openai" || provider === "openai-codex") {
+		return resolved === "flex" || resolved === "scale" || resolved === "priority";
+	}
+	if (provider === "fireworks") {
+		return resolved === "priority";
+	}
+	return false;
 }
 
 /**