@oh-my-pi/pi-ai 16.1.7 → 16.1.9

package/CHANGELOG.md

@@ -2,6 +2,41 @@
 
 ## [Unreleased]
 
+## [16.1.9] - 2026-06-21
+
+### Added
+
+- Added `llama.cpp` to the interactive `/login` provider list, accepting an optional API key while defaulting to local no-auth mode.
+
+### Changed
+
+- Optimized generated AI tool schemas by collapsing verbose `anyOf` unions into standard `enum` types
+
+### Fixed
+
+- Fixed tool-call argument validation dropping nested keys that were accidentally double-encoded
+- Fixed the `moonshot` provider being locked to the international Kimi host (`api.moonshot.ai`): OpenAI-completions requests now honor a `MOONSHOT_BASE_URL` override so users can reach the Kimi China platform (`api.moonshot.cn`), which rejects keys issued for the international endpoint. ([#2883](https://github.com/can1357/oh-my-pi/issues/2883))
+- Fixed tool-call argument validation dropping fields whose object keys were accidentally JSON-encoded a second time (e.g. `{ "\"op\"": "done" }`), which surfaced as spurious missing-required errors. A schema-agnostic pre-validation pass now recursively unwraps such double-encoded keys — through arrays and nested objects, and again after a JSON-string container is parsed — before the unrecognized-key repair can delete them.
+
+### Removed
+
+- Removed the `setNextRequestDebugPath`, `clearNextRequestDebugPath`, and `getNextRequestDebugPath` utility functions for request debugging, as request/response recording now relies exclusively on the `PI_REQ_DEBUG` environment variable.
+- Removed Wafer Pass (`wafer-pass`) login support; Wafer Serverless remains available as `wafer-serverless`.
+
+## [16.1.8] - 2026-06-20
+
+### Changed
+
+- Changed OpenAI Responses and Codex Responses custom grammar tool requests to leave `parallel_tool_calls` unset instead of forcing serial tool calls; Codex `responsesLite` still disables parallel tool calls when tools are present.
+
+### Fixed
+
+- Fixed Bedrock `/btw` and other no-tool ephemeral turns failing after prior tool calls by sending the required sentinel `toolConfig` whenever replayed history contains `toolUse`/`toolResult` blocks. ([#3124](https://github.com/can1357/oh-my-pi/issues/3124))
+- Fixed Anthropic Messages pre-content TLS `bad record MAC` server transport errors surfacing before the provider retry loop exhausts its budget. ([#3134](https://github.com/can1357/oh-my-pi/issues/3134))
+- Fixed API-key login flows replacing existing stored keys for the same provider, so providers such as NVIDIA NIM can keep multiple active keys available for session-level rotation. ([#2923](https://github.com/can1357/oh-my-pi/issues/2923))
+- Fixed `openai-codex-responses` forwarding sampling controls (`temperature`, `top_p`, `top_k`, `min_p`, `presence_penalty`, `repetition_penalty`) into the Codex request body — the ChatGPT-subscription Codex backend rejects each of them with a 400 `{"detail":"Unsupported parameter: temperature"}`, so any caller setting non-default `StreamOptions` saw every turn fail. The provider now drops the full sampling set (matching codex-rs), and the auth-gateway's defensive strip on both `buildStreamOptions` and the pi-native path was widened from `{temperature, topP}` to the same set plus `stopSequences`/`frequencyPenalty`. ([#3117](https://github.com/can1357/oh-my-pi/issues/3117))
+- Fixed Anthropic Messages retry classification for transient TLS/server-error failures such as `tls: bad record MAC (type=server_error)`. These pre-content transport blips are now retried inside the provider loop before the session sees an error banner.
+
 ## [16.1.4] - 2026-06-19
 
 ### Added

package/README.md

@@ -62,7 +62,6 @@ Unified LLM API with automatic model discovery, provider configuration, token an
 - **Hugging Face Inference**
 - **xAI**
 - **Venice** (requires `VENICE_API_KEY`)
-- **Wafer Pass** (requires `WAFER_PASS_API_KEY`; flat-rate subscription, includes GLM-5.1 and Qwen3.5-397B-A17B)
 - **Wafer Serverless** (requires `WAFER_SERVERLESS_API_KEY`; pay-as-you-go)
 - **OpenRouter**
 - **Kilo Gateway** (supports OAuth `/login kilo` or `KILO_API_KEY`)

package/dist/types/providers/openai-codex/request-transformer.d.ts

@@ -34,12 +34,6 @@ export interface RequestBody {
     input?: InputItem[];
     tools?: unknown;
     tool_choice?: unknown;
-    temperature?: number;
-    top_p?: number;
-    top_k?: number;
-    min_p?: number;
-    presence_penalty?: number;
-    repetition_penalty?: number;
     reasoning?: Partial<ReasoningConfig>;
     text?: {
         verbosity?: "low" | "medium" | "high";

package/dist/types/providers/openai-codex-responses.d.ts

@@ -1,5 +1,5 @@
 import type { Context, Model, ProviderSessionState, ServiceTier, StreamFunction, StreamOptions, Tool, ToolChoice } from "../types";
-import { type CodexReasoningContext } from "./openai-codex/request-transformer";
+import { type CodexReasoningContext, type RequestBody } from "./openai-codex/request-transformer";
 import type { ResponseInput } from "./openai-responses-wire";
 export interface OpenAICodexResponsesOptions extends StreamOptions {
     reasoning?: "none" | "minimal" | "low" | "medium" | "high" | "xhigh";
@@ -49,6 +49,8 @@ export interface OpenAICodexWebSocketDebugStats {
 }
 /** @internal Exported for tests. */
 export declare function normalizeCodexToolChoice(choice: ToolChoice | undefined, tools?: Tool[], model?: Model<"openai-codex-responses">): string | Record<string, unknown> | undefined;
+/** @internal Exported for tests. */
+export declare function buildTransformedCodexRequestBody(model: Model<"openai-codex-responses">, context: Context, options: OpenAICodexResponsesOptions | undefined, promptCacheKey?: string | undefined): Promise<RequestBody>;
 export declare const streamOpenAICodexResponses: StreamFunction<"openai-codex-responses">;
 export declare function prewarmOpenAICodexResponses(model: Model<"openai-codex-responses">, options?: Pick<OpenAICodexResponsesOptions, "apiKey" | "headers" | "sessionId" | "signal" | "preferWebsockets" | "providerSessionState" | "responsesLite">): Promise<void>;
 export interface OpenAICodexTransportDetails {

package/dist/types/registry/llama-cpp.d.ts

@@ -0,0 +1,8 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+export declare function loginLlamaCpp(options: OAuthController): Promise<string>;
+export declare const llamaCppProvider: {
+    readonly id: "llama.cpp";
+    readonly name: "llama.cpp (Local OpenAI-compatible)";
+    readonly envKeys: "LLAMA_CPP_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/nvidia.d.ts

@@ -4,4 +4,5 @@ export declare const nvidiaProvider: {
     readonly id: "nvidia";
     readonly name: "NVIDIA";
     readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+    readonly appendApiKeyLogin: true;
 };

package/dist/types/registry/oauth/wafer.d.ts

@@ -1,2 +1 @@
-export declare const loginWaferPass: (options: import("./types").OAuthController) => Promise<string>;
 export declare const loginWaferServerless: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/registry/registry.d.ts

@@ -112,6 +112,11 @@ declare const ALL: ({
     readonly id: "litellm";
     readonly name: "LiteLLM";
     readonly login: (cb: import("./oauth").OAuthLoginCallbacks) => Promise<string>;
+} | {
+    readonly id: "llama.cpp";
+    readonly name: "llama.cpp (Local OpenAI-compatible)";
+    readonly envKeys: "LLAMA_CPP_API_KEY";
+    readonly login: (cb: import("./oauth").OAuthLoginCallbacks) => Promise<string>;
 } | {
     readonly id: "lm-studio";
     readonly name: "LM Studio (Local OpenAI-compatible)";
@@ -142,6 +147,7 @@ declare const ALL: ({
     readonly id: "nvidia";
     readonly name: "NVIDIA";
     readonly login: (cb: import("./oauth").OAuthLoginCallbacks) => Promise<string>;
+    readonly appendApiKeyLogin: true;
 } | {
     readonly id: "ollama";
     readonly name: "Ollama (Local OpenAI-compatible)";
@@ -225,10 +231,6 @@ declare const ALL: ({
     readonly id: "vllm";
     readonly name: "vLLM (Local OpenAI-compatible)";
     readonly login: (cb: import("./oauth").OAuthLoginCallbacks) => Promise<string>;
-} | {
-    readonly id: "wafer-pass";
-    readonly name: "Wafer Pass (flat-rate subscription)";
-    readonly login: (cb: import("./oauth").OAuthLoginCallbacks) => Promise<string>;
 } | {
     readonly id: "wafer-serverless";
     readonly name: "Wafer Serverless (pay-as-you-go)";

package/dist/types/registry/types.d.ts

@@ -40,6 +40,8 @@ export interface ProviderDefinition {
     readonly showInLoginList?: boolean;
     readonly envKeys?: KeyResolver;
     readonly login?: (callbacks: OAuthLoginCallbacks) => Promise<OAuthCredentials | string>;
+    /** String-returning login appends API keys instead of replacing the provider's existing key. */
+    readonly appendApiKeyLogin?: boolean;
     readonly refreshToken?: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
     readonly getApiKey?: (credentials: OAuthCredentials) => string;
     /** Store OAuth credentials under a different provider id (e.g. `openai-codex-device` ⇒ `openai-codex`). */

package/dist/types/types.d.ts

@@ -93,10 +93,12 @@ export type ResolvedServiceTier = Exclude<ServiceTier, "openai-only" | "claude-o
  */
 export declare function resolveServiceTier(serviceTier: ServiceTier | null | undefined, provider: Provider | undefined): ResolvedServiceTier | undefined;
 /**
- * True when the (possibly scoped) tier should be sent as OpenAI's
- * `service_tier` request field for the given provider. Non-OpenAI
- * providers, unsupported tiers (`"auto"`, `"default"`), and scope
- * mismatches all return false.
+ * True when the (possibly scoped) tier should be sent on the wire as the
+ * `service_tier` request field for the given provider. OpenAI / OpenAI-Codex
+ * accept `flex`/`scale`/`priority`; Fireworks Serverless realizes only its
+ * Priority serving path (`service_tier: "priority"`) on the OpenAI-compatible
+ * chat-completions endpoint. Unsupported tiers (`"auto"`, `"default"`), other
+ * providers, and scope mismatches all return false.
  */
 export declare function shouldSendServiceTier(serviceTier: ServiceTier | null | undefined, provider: Provider | undefined): boolean;
 /**

package/dist/types/utils/request-debug.d.ts

@@ -22,9 +22,6 @@ export interface RequestDebugSession {
     wrapResponse(response: Response): Promise<Response>;
 }
 export declare function isRequestDebugEnabled(): boolean;
-export declare function setNextRequestDebugPath(requestPath: string): void;
-export declare function clearNextRequestDebugPath(): void;
-export declare function getNextRequestDebugPath(): string | undefined;
 export declare function wrapFetchForRequestDebug(fetchImpl: FetchImpl): FetchImpl;
 export declare function withRequestDebugFetch<T extends {
     fetch?: FetchImpl;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "16.1.7",
+	"version": "16.1.9",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.0",
-		"@oh-my-pi/pi-catalog": "16.1.7",
-		"@oh-my-pi/pi-utils": "16.1.7",
-		"@oh-my-pi/pi-wire": "16.1.7",
+		"@oh-my-pi/pi-catalog": "16.1.9",
+		"@oh-my-pi/pi-utils": "16.1.9",
+		"@oh-my-pi/pi-wire": "16.1.9",
 		"arktype": "^2.2.0",
 		"partial-json": "^0.1.7",
 		"zod": "^4"

package/src/auth-gateway/server.ts

@@ -120,20 +120,20 @@ function deriveSessionId(modelId: string, context: Context): string {
 function buildStreamOptions(parsed: ParsedFormatRequest, api: Api, signal: AbortSignal): SimpleStreamOptions {
 	const opts: SimpleStreamOptions = { signal };
 	const { options } = parsed;
-	// Codex backend rejects `temperature` / `top_p` (per-model defaults only),
-	// so we drop them silently for that one provider. Every other unsupported
-	// option is just ignored by `streamSimple` if the underlying provider
-	// doesn't honour it.
+	// Codex backend rejects every sampling control with
+	// `Unsupported parameter: …` (#3117). Strip the full set for that one
+	// provider; everything else is harmless to forward — `streamSimple` ignores
+	// what the underlying provider doesn't honour.
 	const isCodex = api === "openai-codex-responses";
 	if (options.maxOutputTokens !== undefined) opts.maxTokens = options.maxOutputTokens;
 	if (options.temperature !== undefined && !isCodex) opts.temperature = options.temperature;
 	if (options.topP !== undefined && !isCodex) opts.topP = options.topP;
-	if (options.topK !== undefined) opts.topK = options.topK;
-	if (options.minP !== undefined) opts.minP = options.minP;
-	if (options.stopSequences !== undefined) opts.stopSequences = options.stopSequences;
-	if (options.presencePenalty !== undefined) opts.presencePenalty = options.presencePenalty;
-	if (options.frequencyPenalty !== undefined) opts.frequencyPenalty = options.frequencyPenalty;
-	if (options.repetitionPenalty !== undefined) opts.repetitionPenalty = options.repetitionPenalty;
+	if (options.topK !== undefined && !isCodex) opts.topK = options.topK;
+	if (options.minP !== undefined && !isCodex) opts.minP = options.minP;
+	if (options.stopSequences !== undefined && !isCodex) opts.stopSequences = options.stopSequences;
+	if (options.presencePenalty !== undefined && !isCodex) opts.presencePenalty = options.presencePenalty;
+	if (options.frequencyPenalty !== undefined && !isCodex) opts.frequencyPenalty = options.frequencyPenalty;
+	if (options.repetitionPenalty !== undefined && !isCodex) opts.repetitionPenalty = options.repetitionPenalty;
 	if (options.metadata !== undefined) opts.metadata = options.metadata;
 	if (options.headers !== undefined) opts.headers = { ...(opts.headers ?? {}), ...options.headers };
 	if (options.toolChoice !== undefined) {
@@ -662,8 +662,8 @@ async function handlePiNative(bootOpts: AuthGatewayBootOptions, req: Request, pe
 
 	// Build the SimpleStreamOptions actually handed to `streamSimple`. We
 	// trust the client's options (already allow-listed by `parseRequest`) and
-	// only inject server-controlled fields. The codex temperature/topP strip
-	// matches `buildStreamOptions` — Codex rejects them with a 400.
+	// only inject server-controlled fields. The codex sampling strip mirrors
+	// `buildStreamOptions` — Codex rejects every one with a 400 (#3117).
 	const streamOpts: SimpleStreamOptions = { ...parsed.options, apiKey, signal: controller.signal };
 	streamOpts.apiKey = buildGatewayApiKeyResolver(
 		bootOpts.storage,
@@ -677,6 +677,12 @@ async function handlePiNative(bootOpts: AuthGatewayBootOptions, req: Request, pe
 	if (model.api === "openai-codex-responses") {
 		delete streamOpts.temperature;
 		delete streamOpts.topP;
+		delete streamOpts.topK;
+		delete streamOpts.minP;
+		delete streamOpts.stopSequences;
+		delete streamOpts.presencePenalty;
+		delete streamOpts.frequencyPenalty;
+		delete streamOpts.repetitionPenalty;
 	}
 	// Merge gateway-captured passthrough headers under the client's own
 	// headers — the client's values win when they collide.

package/src/auth-storage.ts

@@ -1825,10 +1825,6 @@ export class AuthStorage {
 			onPrompt: (prompt: { message: string; placeholder?: string }) => Promise<string>;
 		},
 	): Promise<void> {
-		const saveApiKeyCredential = async (apiKey: string): Promise<void> => {
-			const newCredential: ApiKeyCredential = { type: "api_key", key: apiKey };
-			await this.set(provider, newCredential);
-		};
 		const manualCodeInput = () => ctrl.onPrompt({ message: "Paste the authorization code (or full redirect URL):" });
 		// Built-in registry first, then runtime-registered extension providers.
 		const def = getProviderDefinition(provider) ?? getOAuthProvider(provider);
@@ -1848,7 +1844,20 @@ export class AuthStorage {
 			if (!result) {
 				return;
 			}
-			await saveApiKeyCredential(result);
+			const newCredential: ApiKeyCredential = { type: "api_key", key: result };
+			const appendApiKeyLogin = "appendApiKeyLogin" in def && def.appendApiKeyLogin === true;
+			const stored = appendApiKeyLogin
+				? this.#store.upsertAuthCredentialRemote
+					? await this.#store.upsertAuthCredentialRemote(provider, newCredential)
+					: this.#store.upsertAuthCredentialForProvider(provider, newCredential)
+				: this.#store.replaceAuthCredentialsRemote
+					? await this.#store.replaceAuthCredentialsRemote(provider, [newCredential])
+					: this.#store.replaceAuthCredentialsForProvider(provider, [newCredential]);
+			this.#setStoredCredentials(
+				provider,
+				stored.map(entry => ({ id: entry.id, credential: entry.credential })),
+			);
+			this.#resetProviderAssignments(provider);
 			return;
 		}
 		const newCredential: OAuthCredential = { type: "oauth", ...result };

package/src/providers/amazon-bedrock.ts

@@ -142,6 +142,28 @@ interface WireToolConfig {
 	toolChoice?: WireToolChoice;
 }
 
+/**
+ * Bedrock validates that requests carrying any `toolUse`/`toolResult` history
+ * include a `toolConfig`. For no-tool ephemeral turns (`/btw`, IRC auto-replies)
+ * we have nothing real to send, so we inject this placeholder. Its presence is
+ * tracked by a per-request flag — never the wire name — so callers who happen
+ * to register a real tool literally called `__no_tools__` are not affected.
+ */
+const NO_TOOLS_SENTINEL_NAME = "__no_tools__";
+
+const NO_TOOLS_SENTINEL: WireToolSpec = {
+	toolSpec: {
+		name: NO_TOOLS_SENTINEL_NAME,
+		description: "Placeholder required by Bedrock validation. Do not call; answer with text.",
+		inputSchema: { json: { type: "object", properties: {} } },
+	},
+};
+
+interface BedrockToolPlan {
+	toolConfig: WireToolConfig | undefined;
+	sentinelInjected: boolean;
+}
+
 interface ConverseStreamRequest {
 	messages: WireMessage[];
 	system?: SystemContent[];
@@ -222,10 +244,10 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 
 		try {
 			const cacheRetention = resolveCacheRetention(options.cacheRetention);
-			const historyHasToolBlocks = context.messages.some(
-				m => m.role === "toolResult" || (m.role === "assistant" && m.content.some(b => b.type === "toolCall")),
-			);
-			const toolConfig = convertToolConfig(context.tools, options.toolChoice, historyHasToolBlocks);
+			const convertedMessages = convertMessages(context, model, cacheRetention);
+			const toolPlan = planToolConfig(context.tools, options.toolChoice, convertedMessages);
+			const toolConfig = toolPlan.toolConfig;
+			const sentinelInjected = toolPlan.sentinelInjected;
 			let additionalModelRequestFields = buildAdditionalModelRequestFields(model, options);
 
 			// Bedrock rejects thinking + forced tool_choice ("any" or specific tool).
@@ -236,7 +258,7 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 			}
 
 			const commandInput: ConverseStreamRequest = {
-				messages: convertMessages(context, model, cacheRetention),
+				messages: convertedMessages,
 				system: buildSystemPrompt(context.systemPrompt, model, cacheRetention),
 				inferenceConfig: {
 					maxTokens: options.maxTokens,
@@ -369,7 +391,7 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 					}
 					case "contentBlockStart": {
 						if (!firstTokenTime) firstTokenTime = Date.now();
-						handleContentBlockStart(payload as ContentBlockStartEvent, blocks, output, stream);
+						handleContentBlockStart(payload as ContentBlockStartEvent, blocks, output, stream, sentinelInjected);
 						break;
 					}
 					case "contentBlockDelta": {
@@ -383,7 +405,10 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 					}
 					case "messageStop": {
 						const ev = payload as MessageStopEvent;
-						output.stopReason = mapStopReason(ev.stopReason);
+						// A sentinel-only request must never surface a tool-use stop:
+						// no real tool exists for the agent to dispatch.
+						output.stopReason =
+							sentinelInjected && ev.stopReason === "tool_use" ? "stop" : mapStopReason(ev.stopReason);
 						if (output.stopReason === "error") {
 							output.errorMessage = `Generation failed with stop reason: ${ev.stopReason ?? "unknown"}`;
 						}
@@ -462,10 +487,16 @@ function handleContentBlockStart(
 	blocks: Block[],
 	output: AssistantMessage,
 	stream: AssistantMessageEventStream,
+	sentinelInjected: boolean,
 ): void {
 	const index = event.contentBlockIndex;
 	const start = event.start;
 
+	// Drop the sentinel call only when we injected it ourselves. A caller that
+	// registers a real tool named `__no_tools__` would otherwise lose its
+	// legitimate tool-use events on normal turns.
+	if (sentinelInjected && start?.toolUse?.name === NO_TOOLS_SENTINEL_NAME) return;
+
 	if (start?.toolUse) {
 		const block: Block = {
 			type: "toolCall",
@@ -784,28 +815,48 @@ function convertMessages(
 	return result;
 }
 
-function convertToolConfig(
-	tools: Tool[] | undefined,
-	toolChoice: BedrockOptions["toolChoice"],
-	historyHasToolBlocks: boolean,
-): WireToolConfig | undefined {
-	if (!tools?.length) return undefined;
+function messagesHaveToolBlocks(messages: WireMessage[]): boolean {
+	for (const message of messages) {
+		for (const block of message.content) {
+			if ("toolUse" in block || "toolResult" in block) return true;
+		}
+	}
+	return false;
+}
 
-	const bedrockTools: WireToolSpec[] = tools.map(tool => ({
+function convertToolSpec(tool: Tool): WireToolSpec {
+	return {
 		toolSpec: {
 			name: tool.name,
 			description: tool.description || "",
 			inputSchema: { json: toolWireSchema(tool) },
 		},
-	}));
+	};
+}
+
+function planToolConfig(
+	tools: Tool[] | undefined,
+	toolChoice: BedrockOptions["toolChoice"],
+	messages: WireMessage[],
+): BedrockToolPlan {
+	const activeTools = tools ?? [];
+	const hasTools = activeTools.length > 0;
+	const historyHasToolBlocks = messagesHaveToolBlocks(messages);
 
-	// Bedrock rejects requests whose history contains toolUse/toolResult blocks without a
-	// toolConfig. With prior tool use we must keep the tool specs and merely omit the choice
-	// (there is no "none" choice on Converse); dropping toolConfig entirely would 400.
 	if (toolChoice === "none") {
-		return historyHasToolBlocks ? { tools: bedrockTools } : undefined;
+		if (!historyHasToolBlocks) return { toolConfig: undefined, sentinelInjected: false };
+		if (!hasTools) {
+			return {
+				toolConfig: { tools: [NO_TOOLS_SENTINEL], toolChoice: { auto: {} } },
+				sentinelInjected: true,
+			};
+		}
+		return { toolConfig: { tools: activeTools.map(convertToolSpec) }, sentinelInjected: false };
 	}
 
+	if (!hasTools) return { toolConfig: undefined, sentinelInjected: false };
+
+	const bedrockTools = activeTools.map(convertToolSpec);
 	let bedrockToolChoice: WireToolChoice | undefined;
 	switch (toolChoice) {
 		case "auto":
@@ -820,7 +871,7 @@ function convertToolConfig(
 			}
 	}
 
-	return { tools: bedrockTools, toolChoice: bedrockToolChoice };
+	return { toolConfig: { tools: bedrockTools, toolChoice: bedrockToolChoice }, sentinelInjected: false };
 }
 
 function mapStopReason(reason: string | undefined): StopReason {

package/src/providers/anthropic.ts

@@ -1485,6 +1485,10 @@ function isProviderRetryableStreamEnvelopeError(error: unknown): boolean {
 	return /stream event order|before message_start/i.test(error.message);
 }
 
+function isAnthropicTransientTransportMessage(message: string): boolean {
+	return message.includes("tls: bad record mac") || message.includes("type=server_error");
+}
+
 export function isProviderRetryableError(error: unknown, provider?: string): boolean {
 	if (!(error instanceof Error)) return false;
 	if (provider === "github-copilot" && isCopilotTransientModelError(error)) return true;
@@ -1501,7 +1505,8 @@ export function isProviderRetryableError(error: unknown, provider?: string): boo
 	const msg = error.message.toLowerCase();
 	if (
 		isUnexpectedSocketCloseMessage(msg) ||
-		/rate.?limit|too many requests|overloaded|service.?unavailable|internal_error|stream error.*received from peer|1302|timed?\s*out while waiting for the first event|timeout waiting for first/i.test(
+		isAnthropicTransientTransportMessage(msg) ||
+		/rate.?limit|too many requests|overloaded|service.?unavailable|internal_error|server_error|bad record mac|stream error.*received from peer|1302|timed?\s*out while waiting for the first event|timeout waiting for first/i.test(
 			msg,
 		) ||
 		isTransientStreamParseError(error) ||

package/src/providers/openai-codex/request-transformer.ts

@@ -41,12 +41,10 @@ export interface RequestBody {
 	input?: InputItem[];
 	tools?: unknown;
 	tool_choice?: unknown;
-	temperature?: number;
-	top_p?: number;
-	top_k?: number;
-	min_p?: number;
-	presence_penalty?: number;
-	repetition_penalty?: number;
+	// Sampling controls (temperature/top_p/top_k/min_p/presence_penalty/
+	// repetition_penalty/frequency_penalty/stop) are intentionally absent: the
+	// Codex backend rejects every one with a 400 `Unsupported parameter`, so
+	// the transformer never sets them (#3117).
 	reasoning?: Partial<ReasoningConfig>;
 	text?: {
 		verbosity?: "low" | "medium" | "high";

package/src/providers/openai-codex-responses.ts

@@ -714,7 +714,8 @@ async function buildCodexRequestContext(
 	};
 }
 
-async function buildTransformedCodexRequestBody(
+/** @internal Exported for tests. */
+export async function buildTransformedCodexRequestBody(
 	model: Model<"openai-codex-responses">,
 	context: Context,
 	options: OpenAICodexResponsesOptions | undefined,
@@ -729,25 +730,12 @@ async function buildTransformedCodexRequestBody(
 
 	// `maxTokens` is intentionally not forwarded: transformRequestBody strips
 	// `max_output_tokens`/`max_completion_tokens` (the Codex backend rejects
-	// caller-supplied output caps).
-	if (options?.temperature !== undefined) {
-		params.temperature = options.temperature;
-	}
-	if (options?.topP !== undefined) {
-		params.top_p = options.topP;
-	}
-	if (options?.topK !== undefined) {
-		params.top_k = options.topK;
-	}
-	if (options?.minP !== undefined) {
-		params.min_p = options.minP;
-	}
-	if (options?.presencePenalty !== undefined) {
-		params.presence_penalty = options.presencePenalty;
-	}
-	if (options?.repetitionPenalty !== undefined) {
-		params.repetition_penalty = options.repetitionPenalty;
-	}
+	// caller-supplied output caps). Sampling controls (`temperature`, `top_p`,
+	// `top_k`, `min_p`, `presence_penalty`, `repetition_penalty`,
+	// `frequency_penalty`, `stop`) are likewise refused with
+	// `{"detail":"Unsupported parameter: temperature"}` etc., so we drop
+	// everything from `StreamOptions` rather than forwarding any of them.
+	// (#3117 — codex-rs sends none of these either.)
 	applyOpenAIServiceTier(params, options?.serviceTier, model.provider);
 	if (context.tools && context.tools.length > 0) {
 		params.tools = convertOpenAICodexResponsesTools(context.tools, model);
@@ -757,16 +745,6 @@ async function buildTransformedCodexRequestBody(
 				params.tool_choice = toolChoice;
 			}
 		}
-		// When a custom-tool is active, force serial tool-calling. OpenAI's
-		// `parallel_tool_calls` is request-scoped — disabling it here affects
-		// every tool in the turn, not just the custom one. That's coarser
-		// than spec §1's "supports_parallel_tool_calls = false" (which
-		// strictly targets `apply_patch`), but the platform API offers no
-		// per-tool flag.
-		const emittedTools = params.tools as CodexToolPayload[];
-		if (emittedTools.some(t => t.type === "custom")) {
-			params.parallel_tool_calls = false;
-		}
 	}
 
 	const systemPrompts = normalizeSystemPrompts(context.systemPrompt);

package/src/providers/openai-completions.ts

@@ -175,6 +175,19 @@ function normalizeMistralToolId(id: string, isMistral: boolean): string {
 // #1488). The default route forwards `delta.content` (including DSML
 // envelope leaks) which `StreamMarkupHealing` heals into a structured call
 // client-side.
+function resolveOpenAICompletionsRoutingEffort(
+	model: Model<"openai-completions">,
+	effort: Effort | undefined,
+): Effort | undefined {
+	if (!effort) return undefined;
+	if (model.thinking?.efforts.includes(effort)) return effort;
+	const compatMappedEffort = model.compat.reasoningEffortMap?.[effort] as Effort | undefined;
+	if (compatMappedEffort && model.thinking?.efforts.includes(compatMappedEffort)) return compatMappedEffort;
+	const thinkingMappedEffort = model.thinking?.effortMap?.[effort] as Effort | undefined;
+	if (thinkingMappedEffort && model.thinking?.efforts.includes(thinkingMappedEffort)) return thinkingMappedEffort;
+	return effort;
+}
+
 function resolveOpenAICompletionsModelId(
 	model: Model<"openai-completions">,
 	options: OpenAICompletionsOptions | undefined,
@@ -182,8 +195,9 @@ function resolveOpenAICompletionsModelId(
 	// Effort-tier variants route per request effort (off → bare id, efforts →
 	// the thinking backing id); catalog variants (Copilot long-context `-1m`
 	// entries) pin via `requestModelId`; everything else serializes `model.id`.
-	const effort =
+	const requestedEffort =
 		options?.reasoning && !options.disableReasoning && model.reasoning ? (options.reasoning as Effort) : undefined;
+	const effort = resolveOpenAICompletionsRoutingEffort(model, requestedEffort);
 	const wireId = resolveWireModelId(model, effort);
 	return applyWireModelIdTransform(wireId, model.compat.wireModelIdMode, options?.openrouterVariant);
 }

package/src/providers/openai-responses.ts

@@ -862,15 +862,6 @@ export function buildParams(
 				params.tool_choice = toolChoice;
 			}
 		}
-		// The apply_patch spec §1 marks only `apply_patch` itself as
-		// `supports_parallel_tool_calls = false`. OpenAI's Responses API
-		// exposes `parallel_tool_calls` as a request-scoped flag, not a
-		// per-tool one, so when a custom grammar tool is in the list we
-		// disable parallelism for the whole turn. Slightly coarser than
-		// the spec requires — but the platform API offers no finer knob.
-		if (params.tools.some(t => (t as { type?: string }).type === "custom")) {
-			params.parallel_tool_calls = false;
-		}
 	}
 
 	const reasoningPolicy = resolveOpenAICompatPolicy(model, {

package/src/providers/openai-shared.ts

@@ -155,6 +155,16 @@ export function resolveOpenAIRequestSetup(
 
 	let copilotPremiumRequests: number | undefined;
 	let baseUrl = model.baseUrl;
+	if (model.provider === "moonshot") {
+		// Bundled `moonshot` catalog models hardcode the international endpoint
+		// (`api.moonshot.ai`). MOONSHOT_BASE_URL lets users redirect the provider
+		// at the China platform (`api.moonshot.cn`), which only accepts China keys
+		// and rejects the international host. (#2883)
+		const moonshotBaseUrl = $env.MOONSHOT_BASE_URL?.trim();
+		if (moonshotBaseUrl) {
+			baseUrl = moonshotBaseUrl;
+		}
+	}
 	if (model.provider === "github-copilot") {
 		apiKey = parseGitHubCopilotApiKey(rawApiKey).accessToken;
 		const copilot = buildCopilotDynamicHeaders({

package/src/registry/llama-cpp.ts

@@ -0,0 +1,34 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+const PROVIDER_ID = "llama.cpp";
+const AUTH_URL = "https://github.com/ggml-org/llama.cpp#quick-start";
+const DEFAULT_LOCAL_BASE_URL = "http://127.0.0.1:8080";
+const DEFAULT_LOCAL_TOKEN = "llama-cpp-local";
+
+export async function loginLlamaCpp(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new Error(`${PROVIDER_ID} login requires onPrompt callback`);
+	}
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: `Paste your llama.cpp API key if your server requires auth. Leave empty for local no-auth mode (default base URL: ${DEFAULT_LOCAL_BASE_URL}; set LLAMA_CPP_BASE_URL to customize).`,
+	});
+	const apiKey = await options.onPrompt({
+		message: "Paste your llama.cpp API key (optional for local no-auth)",
+		placeholder: DEFAULT_LOCAL_TOKEN,
+		allowEmpty: true,
+	});
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+	const trimmed = apiKey.trim();
+	return trimmed || DEFAULT_LOCAL_TOKEN;
+}
+
+export const llamaCppProvider = {
+	id: PROVIDER_ID,
+	name: "llama.cpp (Local OpenAI-compatible)",
+	envKeys: "LLAMA_CPP_API_KEY",
+	login: (cb: OAuthLoginCallbacks) => loginLlamaCpp(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/nvidia.ts

@@ -39,6 +39,7 @@ export async function loginNvidia(options: OAuthController): Promise<string> {
 			baseUrl: API_BASE_URL,
 			model: VALIDATION_MODEL,
 			signal: options.signal,
+			fetch: options.fetch,
 		});
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
@@ -57,4 +58,5 @@ export const nvidiaProvider = {
 	id: "nvidia",
 	name: "NVIDIA",
 	login: (cb: OAuthLoginCallbacks) => loginNvidia(cb),
+	appendApiKeyLogin: true,
 } as const satisfies ProviderDefinition;

package/src/registry/oauth/wafer.ts

@@ -1,41 +1,15 @@
 /**
- * Wafer login flows.
+ * Wafer Serverless login flow.
  *
- * Wafer (https://wafer.ai) exposes a single OpenAI-compatible base URL
- * (`https://pass.wafer.ai/v1`) for two SKUs:
- *
- *  - **Wafer Pass** — flat-rate subscription. The key authorizes models whose
- *    catalog entries carry `wafer.tier = "pass_included"`.
- *  - **Wafer Serverless** — pay-as-you-go. Superset of Pass; the same `/v1/models`
- *    endpoint returns the full per-account model list.
- *
- * Both SKUs issue `wfr_…` keys. The key prefix alone does not distinguish
- * tiers — the entitlement is per-account on the server side — so we expose
- * two parallel logins / env vars (`WAFER_PASS_API_KEY`, `WAFER_SERVERLESS_API_KEY`)
- * mirroring the firepass/fireworks split, letting users with both
- * subscriptions switch between them without re-pasting.
- *
- * Validation uses the shared `/v1/models` endpoint, which works for both
- * tiers and is cheap (no token spend).
+ * Wafer (https://wafer.ai) exposes a pay-as-you-go OpenAI-compatible SKU at
+ * `https://pass.wafer.ai/v1`. Keys use the `wfr_…` prefix and are validated
+ * against `/v1/models`, which is cheap (no token spend).
  */
 import { createApiKeyLogin } from "../api-key-login";
 
 const WAFER_AUTH_URL = "https://wafer.ai/dashboard";
 const WAFER_MODELS_URL = "https://pass.wafer.ai/v1/models";
 
-export const loginWaferPass = createApiKeyLogin({
-	providerLabel: "Wafer Pass",
-	authUrl: WAFER_AUTH_URL,
-	instructions: "Create or copy your Wafer Pass API key from the Wafer dashboard",
-	promptMessage: "Paste your Wafer Pass API key",
-	placeholder: "wfr_...",
-	validation: {
-		kind: "models-endpoint",
-		provider: "Wafer Pass",
-		modelsUrl: WAFER_MODELS_URL,
-	},
-});
-
 export const loginWaferServerless = createApiKeyLogin({
 	providerLabel: "Wafer Serverless",
 	authUrl: WAFER_AUTH_URL,

package/src/registry/registry.ts

@@ -22,6 +22,7 @@ import { kagiProvider } from "./kagi";
 import { kiloProvider } from "./kilo";
 import { kimiCodeProvider } from "./kimi-code";
 import { litellmProvider } from "./litellm";
+import { llamaCppProvider } from "./llama-cpp";
 import { lmStudioProvider } from "./lm-studio";
 import { minimaxProvider } from "./minimax";
 import { minimaxCodeProvider } from "./minimax-code";
@@ -50,7 +51,6 @@ import { umansProvider } from "./umans";
 import { veniceProvider } from "./venice";
 import { vercelAiGatewayProvider } from "./vercel-ai-gateway";
 import { vllmProvider } from "./vllm";
-import { waferPassProvider } from "./wafer-pass";
 import { waferServerlessProvider } from "./wafer-serverless";
 import { xaiProvider } from "./xai";
 import { xaiOauthProvider } from "./xai-oauth";
@@ -95,7 +95,6 @@ const ALL = [
 	xiaomiTokenPlanAmsProvider,
 	xiaomiTokenPlanCnProvider,
 	firepassProvider,
-	waferPassProvider,
 	deepseekProvider,
 	moonshotProvider,
 	cerebrasProvider,
@@ -122,6 +121,7 @@ const ALL = [
 	ollamaProvider,
 	ollamaCloudProvider,
 	lmStudioProvider,
+	llamaCppProvider,
 	vllmProvider,
 	openaiProvider,
 	googleProvider,

package/src/registry/types.ts

@@ -44,6 +44,8 @@ export interface ProviderDefinition {
 	readonly envKeys?: KeyResolver;
 	// --- interactive login (OAuthProviderInterface-compatible) ---
 	readonly login?: (callbacks: OAuthLoginCallbacks) => Promise<OAuthCredentials | string>;
+	/** String-returning login appends API keys instead of replacing the provider's existing key. */
+	readonly appendApiKeyLogin?: boolean;
 	readonly refreshToken?: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
 	readonly getApiKey?: (credentials: OAuthCredentials) => string;
 	/** Store OAuth credentials under a different provider id (e.g. `openai-codex-device` ⇒ `openai-codex`). */

package/src/stream.ts

@@ -160,7 +160,6 @@ type KeyResolver = string | (() => string | undefined);
 const LEGACY_ENV_KEYS: Record<string, KeyResolver> = {
 	// Non-provider / search-tool keys and API-name keys not modeled as registry provider defs.
 	"azure-openai-responses": "AZURE_OPENAI_API_KEY",
-	"llama.cpp": "LLAMA_CPP_API_KEY",
 	exa: "EXA_API_KEY",
 	jina: "JINA_API_KEY",
 	brave: "BRAVE_API_KEY",
@@ -673,6 +672,30 @@ function mapOpenAiToolChoice(choice?: ToolChoice): OpenAICompletionsOptions["too
 	return undefined;
 }
 
+type ReasoningEffortMapCompat = {
+	reasoningEffortMap?: Partial<Record<Effort, string>>;
+};
+
+function getCompatReasoningEffortMap<TApi extends Api>(
+	model: Model<TApi>,
+): Partial<Record<Effort, string>> | undefined {
+	const compat = model.compat;
+	if (compat === undefined || typeof compat !== "object" || !("reasoningEffortMap" in compat)) {
+		return undefined;
+	}
+	return (compat as ReasoningEffortMapCompat).reasoningEffortMap;
+}
+
+function resolveSupportedMappedReasoningEffort<TApi extends Api>(
+	model: Model<TApi>,
+	reasoning: Effort,
+): Effort | undefined {
+	const mapped = getCompatReasoningEffortMap(model)?.[reasoning];
+	if (!mapped) return undefined;
+	const mappedEffort = mapped as Effort;
+	return model.thinking?.efforts.includes(mappedEffort) ? mappedEffort : undefined;
+}
+
 function resolveOpenAiReasoningEffort<TApi extends Api>(
 	model: Model<TApi>,
 	options?: SimpleStreamOptions,
@@ -687,6 +710,11 @@ function resolveOpenAiReasoningEffort<TApi extends Api>(
 	// defeat the gate and surface a confusing "Compaction failed: Thinking effort
 	// high is not supported by..." to the user.
 	if (!model.thinking) return undefined;
+	if (model.thinking.efforts.includes(reasoning)) return reasoning;
+	const mappedReasoning = resolveSupportedMappedReasoningEffort(model, reasoning);
+	if (mappedReasoning) return mappedReasoning;
+	if (getCompatReasoningEffortMap(model)?.[reasoning] !== undefined) return reasoning;
+	if (model.thinking.effortMap?.[reasoning] !== undefined) return reasoning;
 	return requireSupportedEffort(model, reasoning);
 }
 

package/src/types.ts

@@ -141,18 +141,25 @@ export function resolveServiceTier(
 }
 
 /**
- * True when the (possibly scoped) tier should be sent as OpenAI's
- * `service_tier` request field for the given provider. Non-OpenAI
- * providers, unsupported tiers (`"auto"`, `"default"`), and scope
- * mismatches all return false.
+ * True when the (possibly scoped) tier should be sent on the wire as the
+ * `service_tier` request field for the given provider. OpenAI / OpenAI-Codex
+ * accept `flex`/`scale`/`priority`; Fireworks Serverless realizes only its
+ * Priority serving path (`service_tier: "priority"`) on the OpenAI-compatible
+ * chat-completions endpoint. Unsupported tiers (`"auto"`, `"default"`), other
+ * providers, and scope mismatches all return false.
  */
 export function shouldSendServiceTier(
 	serviceTier: ServiceTier | null | undefined,
 	provider: Provider | undefined,
 ): boolean {
-	if (provider !== "openai" && provider !== "openai-codex") return false;
 	const resolved = resolveServiceTier(serviceTier, provider);
-	return resolved === "flex" || resolved === "scale" || resolved === "priority";
+	if (provider === "openai" || provider === "openai-codex") {
+		return resolved === "flex" || resolved === "scale" || resolved === "priority";
+	}
+	if (provider === "fireworks") {
+		return resolved === "priority";
+	}
+	return false;
 }
 
 /**

package/src/utils/request-debug.ts

@@ -1,6 +1,5 @@
 import { Buffer } from "node:buffer";
 import * as fs from "node:fs/promises";
-import * as path from "node:path";
 import type { FetchImpl } from "../types";
 
 const REQUEST_DEBUG_ENV = "PI_REQ_DEBUG";
@@ -9,7 +8,6 @@ const textEncoder = new TextEncoder();
 const utf8Decoder = new TextDecoder("utf-8", { fatal: true });
 
 let nextSessionId = 1;
-let nextRequestDebugPath: string | undefined;
 
 type DebugFetch = FetchImpl & { [DEBUG_FETCH_MARKER]?: true };
 type RequestBodyInit = NonNullable<RequestInit["body"]>;
@@ -55,25 +53,7 @@ function isRequestDebugEnvEnabled(): boolean {
 }
 
 export function isRequestDebugEnabled(): boolean {
-	return isRequestDebugEnvEnabled() || nextRequestDebugPath !== undefined;
-}
-
-export function setNextRequestDebugPath(requestPath: string): void {
-	nextRequestDebugPath = requestPath;
-}
-
-export function clearNextRequestDebugPath(): void {
-	nextRequestDebugPath = undefined;
-}
-
-export function getNextRequestDebugPath(): string | undefined {
-	return nextRequestDebugPath;
-}
-
-function consumeNextRequestDebugPath(): string | undefined {
-	const requestPath = nextRequestDebugPath;
-	nextRequestDebugPath = undefined;
-	return requestPath;
+	return isRequestDebugEnvEnabled();
 }
 
 export function wrapFetchForRequestDebug(fetchImpl: FetchImpl): FetchImpl {
@@ -249,19 +229,6 @@ function copyResponseMetadata(target: Response, source: Response): void {
 }
 
 async function reserveRequestDebugFile(): Promise<ReservedRequestDebugFile> {
-	const explicitPath = consumeNextRequestDebugPath();
-	if (explicitPath) {
-		await fs.mkdir(path.dirname(explicitPath), { recursive: true });
-		const handle = await fs.open(explicitPath, "w");
-		return {
-			id: nextSessionId++,
-			requestPath: explicitPath,
-			responsePath: `${explicitPath}.res.log`,
-			handle,
-			overwrite: true,
-		};
-	}
-
 	for (;;) {
 		const id = nextSessionId++;
 		const requestPath = `rr-session-${id}.json`;

package/src/utils/schema/wire.ts

@@ -388,6 +388,73 @@ function inferBareEnumScalarType(obj: Record<string, unknown>): void {
 	if (inferred !== undefined) obj.type = inferred;
 }
 
+/**
+ * ArkType serializes a *described* literal union — `type.enumerated(...).describe(d)`
+ * or a `"a" | "b"` union carrying a description — as an `anyOf` of
+ * `{ const, description }` branches that repeat the description on every branch
+ * *and* the union root. The meta is distributed across the union's constituents
+ * at the type level (each `unit` node inherits it), so the duplication is baked
+ * in before serialization rather than added by this pipeline.
+ *
+ * Collapse such a homogeneous all-`const` union into one typed
+ * `{ type, enum, description }` node: a shorter wire and a single description in
+ * the place providers expect it. The collapse is conservative — applied only
+ * when it is lossless:
+ *   - every branch is a bare `{ const }` (optionally `{ const, description }`),
+ *   - all branch values share one scalar JSON type (so `enum` gets a `type`,
+ *     which Gemini/Vertex require),
+ *   - branch descriptions are either all absent or all identical,
+ * so a union whose branches carry *distinct* per-variant descriptions is left
+ * untouched (a flat `enum` has nowhere to keep them). The union root's own
+ * description wins when present; otherwise the shared branch description is kept.
+ */
+function collapseConstUnionAnyOf(obj: Record<string, unknown>): void {
+	// `hasSchemaDefiningSibling` already rejects a sibling `enum`/`const`/etc.; it
+	// does not list `type`, so guard it here — collapsing would overwrite a
+	// wrapper `type` constraint paired with the `anyOf`.
+	if (hasSchemaDefiningSibling(obj) || "type" in obj) return;
+	const variants = obj.anyOf;
+	if (!Array.isArray(variants) || variants.length < 2) return;
+
+	const values: unknown[] = [];
+	let branchDescription: string | undefined;
+	let describedCount = 0;
+	for (const variant of variants) {
+		if (!isSchemaRecord(variant) || !Object.hasOwn(variant, "const")) return;
+		for (const key in variant) {
+			if (key !== "const" && key !== "description") return; // extra constraints — not a bare const
+		}
+		const desc = variant.description;
+		if (typeof desc === "string") {
+			if (describedCount === 0) branchDescription = desc;
+			else if (desc !== branchDescription) return; // distinct per-variant descriptions — preserve them
+			describedCount++;
+		}
+		values.push(variant.const);
+	}
+	if (describedCount !== 0 && describedCount !== variants.length) return; // mixed described/undescribed
+	// A shared branch description that disagrees with the union root's own
+	// description would be silently dropped by the collapse — keep the anyOf so
+	// neither annotation is lost. (Equal descriptions, the ArkType case, collapse.)
+	if (
+		describedCount === variants.length &&
+		typeof obj.description === "string" &&
+		obj.description !== branchDescription
+	) {
+		return;
+	}
+
+	const scalarType = homogeneousEnumScalarType(values);
+	if (scalarType === undefined) return; // mixed / non-scalar (incl. null) — leave as anyOf
+
+	delete obj.anyOf;
+	obj.type = scalarType;
+	obj.enum = values;
+	if (typeof obj.description !== "string" && branchDescription !== undefined) {
+		obj.description = branchDescription;
+	}
+}
+
 function walk(node: unknown, zodCleanup: boolean): void {
 	if (Array.isArray(node)) {
 		for (const child of node) walk(child, zodCleanup);
@@ -397,6 +464,7 @@ function walk(node: unknown, zodCleanup: boolean): void {
 	const obj = node as Record<string, unknown>;
 	rewriteNullableScalarAnyOf(obj);
 	inferBareEnumScalarType(obj);
+	collapseConstUnionAnyOf(obj);
 
 	if (zodCleanup) {
 		// Drop noise injected for `z.number().int()`.

package/src/utils/validation.ts

@@ -834,6 +834,105 @@ function normalizeOptionalNullsForSchema(
 	return { value: changed ? nextValue : value, changed };
 }
 
+// ============================================================================
+// Double-encoded object-key normalization (LLM quirk).
+// ============================================================================
+//
+// LLMs occasionally serialize an object key one time too many, so the property
+// NAME arrives as the JSON encoding of the real name — literal quote characters
+// and all (e.g. `{ "\"op\"": "done" }` decodes to the JS key `"op"`). The
+// schema never matches such a key, so it reads as an unrecognized extra and is
+// dropped by the unrecognized-key repair, later surfacing as a spurious
+// missing-required error. We walk the whole value (arrays + nested objects)
+// and rename any key that is itself the JSON encoding of a plain string back to
+// that string.
+// ============================================================================
+
+/** Max layers of accidental JSON-encoding to peel off a single object key. */
+const MAX_KEY_DECODE_DEPTH = 3;
+
+/**
+ * If `key` is the JSON encoding of a plain string (quote-wrapped and
+ * `JSON.parse`s to a string), return the decoded string; otherwise null. Peels
+ * up to {@link MAX_KEY_DECODE_DEPTH} nested encodings so multiply-encoded keys
+ * collapse in one pass. Conservative: any key that is not a quote-wrapped JSON
+ * string literal is left untouched.
+ */
+function decodeDoubleEncodedKey(key: string): string | null {
+	let current = key;
+	let decoded: string | null = null;
+	for (let depth = 0; depth < MAX_KEY_DECODE_DEPTH; depth += 1) {
+		if (current.length < 2 || current[0] !== '"' || current[current.length - 1] !== '"') break;
+		let parsed: unknown;
+		try {
+			parsed = JSON.parse(current);
+		} catch {
+			break;
+		}
+		if (typeof parsed !== "string") break;
+		current = parsed;
+		decoded = current;
+	}
+	return decoded;
+}
+
+/**
+ * Recursively unwrap object keys that were accidentally JSON-encoded an extra
+ * time. Schema-agnostic by design: such keys are dropped before any schema pass
+ * can map them, so this runs first. A key is only renamed when the decoded name
+ * differs and does not already exist on the same object — renaming would
+ * otherwise clobber a sibling and silently lose data.
+ */
+function normalizeDoubleEncodedKeys(value: unknown): { value: unknown; changed: boolean } {
+	if (Array.isArray(value)) {
+		let changed = false;
+		let next = value;
+		for (let i = 0; i < value.length; i += 1) {
+			const normalized = normalizeDoubleEncodedKeys(value[i]);
+			if (!normalized.changed) continue;
+			if (!changed) {
+				next = [...value];
+				changed = true;
+			}
+			next[i] = normalized.value;
+		}
+		return { value: changed ? next : value, changed };
+	}
+
+	if (value === null || typeof value !== "object") return { value, changed: false };
+
+	const source = value as Record<string, unknown>;
+	let changed = false;
+	const out: Record<string, unknown> = {};
+	for (const [key, entry] of Object.entries(source)) {
+		const normalizedChild = normalizeDoubleEncodedKeys(entry);
+		const nextChild = normalizedChild.changed ? normalizedChild.value : entry;
+
+		const decodedKey = decodeDoubleEncodedKey(key);
+		// `Object.hasOwn` (not `in`) so a decoded `constructor`/`toString` is not
+		// mistaken for a collision via the prototype chain.
+		const targetKey =
+			decodedKey !== null &&
+			decodedKey !== key &&
+			!Object.hasOwn(source, decodedKey) &&
+			!Object.hasOwn(out, decodedKey)
+				? decodedKey
+				: key;
+
+		if (targetKey !== key || normalizedChild.changed) changed = true;
+		// `defineProperty` so a decoded `__proto__` key becomes an own property
+		// instead of mutating the result object's prototype.
+		Object.defineProperty(out, targetKey, {
+			value: nextChild,
+			writable: true,
+			enumerable: true,
+			configurable: true,
+		});
+	}
+
+	return { value: changed ? out : value, changed };
+}
+
 // ============================================================================
 // String-encoded array coercion for union(string, array) schemas.
 // ============================================================================
@@ -922,8 +1021,15 @@ function normalizeStringEncodedArrayUnions(schema: unknown, value: unknown): { v
 		if (!trimmed.startsWith("[")) return { value, changed: false };
 		try {
 			const parsed = JSON.parse(trimmed) as unknown;
-			if (Array.isArray(parsed) && parsedArrayMatchesArrayBranch(schemaObject, parsed)) {
-				return { value: parsed, changed: true };
+			if (Array.isArray(parsed)) {
+				// Unwrap any double-encoded object keys inside the parsed array
+				// before the branch-match check; otherwise an `array<object>`
+				// branch fails to validate and the value silently stays on the
+				// string branch.
+				const candidate = normalizeDoubleEncodedKeys(parsed).value as unknown[];
+				if (parsedArrayMatchesArrayBranch(schemaObject, candidate)) {
+					return { value: candidate, changed: true };
+				}
 			}
 		} catch {
 			// Not valid JSON — leave the string alone for the validator to handle.
@@ -1312,6 +1418,18 @@ export function validateToolArguments(tool: Tool, toolCall: ToolCall): ToolCall[
 	// placeholders for "no value" even when validation would otherwise pass.
 	let normalizedArgs: unknown = originalArgs;
 	let changed = false;
+
+	// Unwrap accidentally double-JSON-encoded object keys before any schema
+	// pass. LLMs sometimes emit `{ "\"op\"": "done" }`, so the property name
+	// arrives quote-wrapped; left alone it reads as an unrecognized key, gets
+	// dropped by the coercion repair, and re-surfaces as a missing-required
+	// error. Running first means every later pass sees the corrected names.
+	const keyNormalization = normalizeDoubleEncodedKeys(normalizedArgs);
+	if (keyNormalization.changed) {
+		normalizedArgs = keyNormalization.value;
+		changed = true;
+	}
+
 	const initialNormalization = normalizeOptionalNullsForSchema(json, normalizedArgs);
 	if (initialNormalization.changed) {
 		normalizedArgs = initialNormalization.value;
@@ -1338,6 +1456,15 @@ export function validateToolArguments(tool: Tool, toolCall: ToolCall): ToolCall[
 		normalizedArgs = coercion.value;
 		changed = true;
 
+		// `coerceArgsFromIssues` may have just parsed a JSON-string container at
+		// the root or a nested field, exposing double-encoded keys the initial
+		// pass could not reach. Re-unwrap before the unrecognized-key repair on
+		// the next validation pass would delete them.
+		const keyNormalizationPass = normalizeDoubleEncodedKeys(normalizedArgs);
+		if (keyNormalizationPass.changed) {
+			normalizedArgs = keyNormalizationPass.value;
+		}
+
 		const nullNormalization = normalizeOptionalNullsForSchema(json, normalizedArgs);
 		if (nullNormalization.changed) {
 			normalizedArgs = nullNormalization.value;

package/dist/types/registry/wafer-pass.d.ts

@@ -1,6 +0,0 @@
-import type { OAuthLoginCallbacks } from "./oauth/types";
-export declare const waferPassProvider: {
-    readonly id: "wafer-pass";
-    readonly name: "Wafer Pass (flat-rate subscription)";
-    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
-};

package/src/registry/wafer-pass.ts

@@ -1,12 +0,0 @@
-import type { OAuthLoginCallbacks } from "./oauth/types";
-import type { ProviderDefinition } from "./types";
-
-export const waferPassProvider = {
-	id: "wafer-pass",
-	name: "Wafer Pass (flat-rate subscription)",
-	login: async (cb: OAuthLoginCallbacks) => {
-		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
-		const { loginWaferPass } = await import("./oauth/wafer");
-		return loginWaferPass(cb);
-	},
-} as const satisfies ProviderDefinition;