@oh-my-pi/pi-ai 16.3.0 → 16.3.3

package/src/utils/proxy.ts

@@ -162,11 +162,26 @@ export function wrapFetchForProxy(fetchImpl: FetchImpl, provider: string): Fetch
 	return wrapped;
 }
 
+export interface ConnectProxiedSocketOptions {
+	/** Caller cancellation for the proxy TCP/TLS handshake and CONNECT tunnel. */
+	signal?: AbortSignal;
+	/** Maximum wall-clock time to establish the final TLS tunnel. Disabled when absent or non-positive. */
+	timeoutMs?: number;
+}
+
 /**
  * Tunnel a socket connection through an HTTP CONNECT proxy.
  * This is used specifically to wrap Node's `http2.connect(baseUrl, { createConnection })` for Cursor.
  */
-export async function connectProxiedSocket(proxyUrlStr: string, targetUrlStr: string): Promise<tls.TLSSocket> {
+export async function connectProxiedSocket(
+	proxyUrlStr: string,
+	targetUrlStr: string,
+	options?: ConnectProxiedSocketOptions,
+): Promise<tls.TLSSocket> {
+	if (options?.signal?.aborted) {
+		throw new AIError.AbortError("Proxy tunnel aborted");
+	}
+
 	const proxyUrl = new URL(proxyUrlStr);
 	const targetUrl = new URL(targetUrlStr);
 
@@ -179,23 +194,73 @@ export async function connectProxiedSocket(proxyUrlStr: string, targetUrlStr: st
 
 	const { promise, resolve, reject } = Promise.withResolvers<tls.TLSSocket>();
 
-	let rawSocket: net.Socket;
-	if (useProxySsl) {
-		rawSocket = tls.connect({
-			host: proxyHost,
-			port: proxyPort,
-		});
-	} else {
-		rawSocket = net.connect({
-			host: proxyHost,
-			port: proxyPort,
-		});
-	}
-
-	rawSocket.once("error", reject);
-
 	const readyEvent = useProxySsl ? "secureConnect" : "connect";
-	rawSocket.once(readyEvent, () => {
+	let rawSocket: net.Socket | undefined;
+	let tunnelSocket: tls.TLSSocket | undefined;
+	let timeout: NodeJS.Timeout | undefined;
+	let responseData = "";
+	let settled = false;
+
+	const cleanup = (): void => {
+		if (timeout) {
+			clearTimeout(timeout);
+			timeout = undefined;
+		}
+		options?.signal?.removeEventListener("abort", onAbort);
+		rawSocket?.off("error", onRawError);
+		rawSocket?.off(readyEvent, onProxyReady);
+		rawSocket?.off("data", onProxyData);
+		tunnelSocket?.off("secureConnect", onTunnelReady);
+		tunnelSocket?.off("error", onTunnelError);
+	};
+	const destroyInProgress = (): void => {
+		tunnelSocket?.destroy();
+		rawSocket?.destroy();
+	};
+	const rejectOnce = (error: Error): void => {
+		if (settled) return;
+		settled = true;
+		cleanup();
+		destroyInProgress();
+		reject(error);
+	};
+	const resolveOnce = (socket: tls.TLSSocket): void => {
+		if (settled) return;
+		settled = true;
+		cleanup();
+		resolve(socket);
+	};
+	const onAbort = (): void => rejectOnce(new AIError.AbortError("Proxy tunnel aborted"));
+	const onRawError = (error: Error): void => rejectOnce(error);
+	const onTunnelError = (error: Error): void => rejectOnce(error);
+	const onTunnelReady = (): void => {
+		if (!tunnelSocket) return;
+		resolveOnce(tunnelSocket);
+	};
+	const onProxyData = (chunk: Buffer): void => {
+		if (!rawSocket) return;
+		responseData += chunk.toString("binary");
+		if (!responseData.includes("\r\n\r\n")) return;
+
+		rawSocket.off("data", onProxyData);
+		rawSocket.off("error", onRawError);
+
+		const firstLine = responseData.split("\r\n")[0];
+		if (!firstLine.includes(" 200 ")) {
+			rejectOnce(new AIError.ValidationError(`Proxy tunnel failed: ${firstLine}`));
+			return;
+		}
+
+		tunnelSocket = tls.connect({
+			socket: rawSocket,
+			servername: targetHost,
+			ALPNProtocols: ["h2"],
+		});
+		tunnelSocket.once("secureConnect", onTunnelReady);
+		tunnelSocket.once("error", onTunnelError);
+	};
+	const onProxyReady = (): void => {
+		if (!rawSocket) return;
 		let connectReq = `CONNECT ${targetHost}:${targetPort} HTTP/1.1\r\n` + `Host: ${targetHost}:${targetPort}\r\n`;
 
 		if (proxyUrl.username || proxyUrl.password) {
@@ -207,34 +272,29 @@ export async function connectProxiedSocket(proxyUrlStr: string, targetUrlStr: st
 		connectReq += "\r\n";
 
 		rawSocket.write(connectReq);
+		rawSocket.on("data", onProxyData);
+	};
 
-		let responseData = "";
-		const onData = (chunk: Buffer) => {
-			responseData += chunk.toString("binary");
-			if (responseData.includes("\r\n\r\n")) {
-				rawSocket.off("data", onData);
-				rawSocket.off("error", reject);
-
-				const firstLine = responseData.split("\r\n")[0];
-				if (firstLine.includes(" 200 ")) {
-					const tlsSocket = tls.connect({
-						socket: rawSocket,
-						servername: targetHost,
-						ALPNProtocols: ["h2"],
-					});
-
-					tlsSocket.once("secureConnect", () => {
-						resolve(tlsSocket);
-					});
-					tlsSocket.once("error", reject);
-				} else {
-					rawSocket.destroy();
-					reject(new AIError.ValidationError(`Proxy tunnel failed: ${firstLine}`));
-				}
-			}
-		};
-		rawSocket.on("data", onData);
-	});
+	options?.signal?.addEventListener("abort", onAbort, { once: true });
+	if (options?.timeoutMs !== undefined && Number.isFinite(options.timeoutMs) && options.timeoutMs > 0) {
+		const timeoutMs = Math.trunc(options.timeoutMs);
+		timeout = setTimeout(() => {
+			rejectOnce(new AIError.StreamTimeoutError(`Proxy tunnel timed out after ${timeoutMs}ms`));
+		}, timeoutMs);
+		timeout.unref?.();
+	}
+
+	rawSocket = useProxySsl
+		? tls.connect({
+				host: proxyHost,
+				port: proxyPort,
+			})
+		: net.connect({
+				host: proxyHost,
+				port: proxyPort,
+			});
+	rawSocket.once("error", onRawError);
+	rawSocket.once(readyEvent, onProxyReady);
 
 	return promise;
 }

package/src/utils/validation.ts

@@ -1081,6 +1081,54 @@ function normalizeStringEncodedArrayUnions(schema: unknown, value: unknown): { v
 	return { value: changed ? nextValue : valueObject, changed };
 }
 
+/**
+ * Name of the sole property when a schema declares exactly one required string
+ * field, else `undefined`. Recognizes the closed single-argument tool shape
+ * (`{ type: "object", properties: { X: { type: "string" } }, required: ["X"] }`).
+ */
+function singleRequiredStringKey(schema: unknown): string | undefined {
+	if (!schema || typeof schema !== "object" || Array.isArray(schema)) return undefined;
+	const obj = schema as Record<string, unknown>;
+	if (obj.type !== "object") return undefined;
+	const properties = obj.properties;
+	if (!properties || typeof properties !== "object") return undefined;
+	const keys = Object.keys(properties as Record<string, unknown>);
+	if (keys.length !== 1) return undefined;
+	const key = keys[0];
+	const required = obj.required;
+	if (!Array.isArray(required) || required.length !== 1 || required[0] !== key) return undefined;
+	const propertySchema = (properties as Record<string, unknown>)[key];
+	if (!propertySchema || typeof propertySchema !== "object") return undefined;
+	return (propertySchema as Record<string, unknown>).type === "string" ? key : undefined;
+}
+
+/**
+ * LLM-quirk repair for single-argument tools. When a tool declares exactly one
+ * property — a required string — some providers deliver the payload under a
+ * different key (e.g. the `edit` tool's patch arriving as `input`/`_input`, or
+ * any single-string tool whose argument the model mislabels). When the declared
+ * key is absent but another field holds a string, adopt the first such string
+ * as the declared key so the call validates instead of failing with "<key> was
+ * missing". A present-but-wrong-type value is left alone so its real type error
+ * still surfaces.
+ */
+function normalizeSingleStringField(schema: unknown, value: unknown): { value: unknown; changed: boolean } {
+	const key = singleRequiredStringKey(schema);
+	if (key === undefined) return { value, changed: false };
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return { value, changed: false };
+	const record = value as Record<string, unknown>;
+	if (record[key] !== undefined) return { value, changed: false };
+	for (const candidate in record) {
+		if (candidate === key || !Object.hasOwn(record, candidate)) continue;
+		const candidateValue = record[candidate];
+		if (typeof candidateValue !== "string") continue;
+		const next = { ...record, [key]: candidateValue };
+		delete next[candidate];
+		return { value: next, changed: true };
+	}
+	return { value, changed: false };
+}
+
 // ============================================================================
 // Zod issue → coercion bridge
 // ============================================================================
@@ -1447,6 +1495,14 @@ export function validateToolArguments(tool: Tool, toolCall: ToolCall): ToolCall[
 		changed = true;
 	}
 
+	// Single-argument tools (e.g. `edit`): if the model put the lone required
+	// string under a different key, adopt the first string field as that key.
+	const singleStringNorm = normalizeSingleStringField(json, normalizedArgs);
+	if (singleStringNorm.changed) {
+		normalizedArgs = singleStringNorm.value;
+		changed = true;
+	}
+
 	let result = validateContext(ctx, normalizedArgs);
 	if (result.success) return result.value as ToolCall["arguments"];
 
@@ -1480,6 +1536,14 @@ export function validateToolArguments(tool: Tool, toolCall: ToolCall): ToolCall[
 			normalizedArgs = stringEncodedArrayNormPass.value;
 		}
 
+		// Re-run single-string remap: `coerceArgsFromIssues` may have just
+		// unwrapped a JSON-stringified root object, exposing a mislabelled lone
+		// string field the initial pre-pass could not see.
+		const singleStringNormPass = normalizeSingleStringField(json, normalizedArgs);
+		if (singleStringNormPass.changed) {
+			normalizedArgs = singleStringNormPass.value;
+		}
+
 		result = validateContext(ctx, normalizedArgs);
 		if (result.success) return result.value as ToolCall["arguments"];
 	}

package/src/providers/openai-responses-reasoning-suppression.md

@@ -1 +0,0 @@
-Keep internal reasoning brief. Continue following the task and use tools normally.