@oh-my-pi/pi-ai 16.3.11 → 16.3.13

package/src/providers/cursor.ts

@@ -653,7 +653,8 @@ export interface UsageState {
 	sawTokenDelta: boolean;
 }
 
-async function handleServerMessage(
+/** Exported for tests: drives one Cursor server message through the stream (exec waits mark the stream busy). */
+export async function handleServerMessage(
 	msg: AgentServerMessage,
 	output: AssistantMessage,
 	stream: AssistantMessageEventStream,
@@ -675,15 +676,21 @@ async function handleServerMessage(
 	} else if (msgCase === "kvServerMessage") {
 		handleKvServerMessage(msg.message.value as KvServerMessage, blobStore, h2Request);
 	} else if (msgCase === "execServerMessage") {
-		await handleExecServerMessage(
-			msg.message.value as ExecServerMessage,
-			h2Request,
-			execHandlers,
-			onToolResult,
-			requestContextTools,
-			output,
-			stream,
-			state,
+		// The server is waiting on OUR local tool result during this window — no
+		// AssistantMessageEvent flows until the handler finishes. Mark the wait
+		// as local work so the lazy stream idle watchdog attributes the silence
+		// to the tool run instead of aborting a healthy stream (issue #4593).
+		await stream.trackLocalWork(
+			handleExecServerMessage(
+				msg.message.value as ExecServerMessage,
+				h2Request,
+				execHandlers,
+				onToolResult,
+				requestContextTools,
+				output,
+				stream,
+				state,
+			),
 		);
 	} else if (msgCase === "conversationCheckpointUpdate") {
 		handleConversationCheckpointUpdate(msg.message.value, output, usageState, onConversationCheckpoint);

package/src/providers/openai-codex-responses.ts

@@ -95,6 +95,7 @@ import {
 	encodeTextSignatureV1,
 	finalizeCustomToolCallInputDone,
 	finalizePendingResponsesToolCalls,
+	finalizeReasoningThinking,
 	finalizeToolCallArgumentsDone,
 	isOpenAIResponsesProgressEvent,
 	mapOpenAIResponsesStopReason,
@@ -1232,12 +1233,27 @@ function getOutputBlockStartEventType(block: CodexOutputBlock): "thinking_start"
 	return "toolcall_start";
 }
 
+const CODEX_STALE_PREVIOUS_RESPONSE_CODES: Record<string, true> = {
+	// OpenAI-standard code for an expired/missing `previous_response_id` chain.
+	previous_response_not_found: true,
+	// Proxy-specific: upstream response anchor expired. Same recovery class —
+	// retry the turn with full context and no `previous_response_id`.
+	codex_previous_response_stale: true,
+};
+
 function isCodexStalePreviousResponseError(error: unknown): boolean {
-	if (error instanceof CodexProviderStreamError) return error.code === "previous_response_not_found";
 	if (!(error instanceof Error)) return false;
-	if ((error as { code?: string }).code === "previous_response_not_found") return true;
-	// "unsupported": the backend intermittently rejects the parameter outright
-	// with `{"detail":"Unsupported parameter: previous_response_id"}` (no
+	if (
+		"code" in error &&
+		typeof error.code === "string" &&
+		Object.hasOwn(CODEX_STALE_PREVIOUS_RESPONSE_CODES, error.code)
+	) {
+		return true;
+	}
+	// Message-based fallback for providers/proxies that report the condition
+	// without a canonical code. Also covers "unsupported": the backend
+	// intermittently rejects the parameter outright with
+	// `{"detail":"Unsupported parameter: previous_response_id"}` (no
 	// `error.code`); treat it like a stale chain so the turn replays with full
 	// context instead of surfacing the 400.
 	return (
@@ -1392,6 +1408,21 @@ class CodexStreamProcessor {
 			return firstTokenTime;
 		}
 
+		if (eventType === "response.reasoning_text.delta") {
+			const entry = this.runtime.openItemForEvent(rawEvent);
+			const delta = typeof rawEvent.delta === "string" ? rawEvent.delta : "";
+			if (entry?.item.type === "reasoning" && entry.block?.type === "thinking") {
+				entry.block.thinking += delta;
+				stream.push({
+					type: "thinking_delta",
+					contentIndex: entry.contentIndex,
+					delta,
+					partial: output,
+				});
+			}
+			return firstTokenTime;
+		}
+
 		if (eventType === "response.reasoning_summary_part.done") {
 			if (this.runtime.currentItem?.type === "reasoning" && this.runtime.currentBlock?.type === "thinking") {
 				appendReasoningSummaryPartDone(
@@ -1507,13 +1538,13 @@ class CodexStreamProcessor {
 		// most-recently-added block may belong to a sibling (#2619). Some Codex
 		// function/custom tool items omit `id`; in that case `output_index` still
 		// routes `output_item.done` to the block that received `output_item.added`.
-		const itemId = typeof (item as { id?: string }).id === "string" ? (item as { id: string }).id : "";
+		const itemId = "id" in item && typeof item.id === "string" ? item.id : "";
 		const entry = (itemId ? runtime.openItems.get(itemId) : null) ?? runtime.openItemForEvent(rawEvent);
 		const block = entry?.block ?? null;
 		const contentIndex = entry?.contentIndex ?? output.content.length - 1;
 
 		if (item.type === "reasoning" && block?.type === "thinking") {
-			block.thinking = item.summary?.map(summary => summary.text).join("\n\n") || "";
+			block.thinking = finalizeReasoningThinking(item, block.thinking);
 			block.thinkingSignature = JSON.stringify(item);
 			stream.push({
 				type: "thinking_end",

package/src/providers/openai-responses.ts

@@ -668,7 +668,7 @@ const streamOpenAIResponsesOnce = (
 			}
 
 			// Detect premature stream closure: the HTTP stream ended without the
-			// provider sending `response.completed` or `response.incomplete`.
+			// provider sending a recognized terminal response event.
 			// Custom/proxy providers may drop the connection mid-stream; without
 			// this guard the incomplete output is silently surfaced as a successful
 			// "stop".

package/src/providers/openai-shared.ts

@@ -80,6 +80,7 @@ import {
 import type { ChatCompletionCreateParamsStreaming } from "./openai-chat-wire";
 import type { InputItem } from "./openai-codex/request-transformer";
 import type {
+	Response as OpenAIResponse,
 	ResponseContentPartAddedEvent,
 	ResponseCreateParamsStreaming,
 	ResponseCustomToolCall,
@@ -1683,6 +1684,14 @@ export function appendReasoningSummaryPart(
 	item.summary.push(part);
 }
 
+/** Chooses the final reasoning text without discarding content already streamed into the block. */
+export function finalizeReasoningThinking(item: ResponseReasoningItem, streamedThinking: string): string {
+	const summaryThinking = item.summary?.map(part => part.text).join("\n\n") ?? "";
+	if (summaryThinking) return summaryThinking;
+	const contentThinking = item.content?.[0]?.type === "reasoning_text" ? (item.content[0].text ?? "") : "";
+	return contentThinking || streamedThinking || "";
+}
+
 export function appendReasoningSummaryTextDelta(
 	item: ResponseReasoningItem,
 	block: ThinkingContent,
@@ -1798,13 +1807,25 @@ export function finalizeCustomToolCallInputDone(block: ResponsesToolCallBlock, i
 	block.arguments = { input };
 }
 
+type OpenAIResponsesTerminalStreamEvent =
+	| Extract<ResponseStreamEvent, { type: "response.completed" | "response.incomplete" }>
+	| { type: "response.done"; response?: Partial<OpenAIResponse> };
+
+function getOpenAIResponsesTerminalEvent(event: ResponseStreamEvent): OpenAIResponsesTerminalStreamEvent | undefined {
+	const type = (event as { type?: unknown }).type;
+	return type === "response.completed" || type === "response.incomplete" || type === "response.done"
+		? (event as OpenAIResponsesTerminalStreamEvent)
+		: undefined;
+}
+
 export interface ProcessResponsesStreamOptions {
 	onFirstToken?: () => void;
 	onOutputItemDone?: (item: ResponseOutputItem) => void;
 	/**
-	 * Called when a terminal `response.completed` or `response.incomplete` event
-	 * is successfully processed. Only invoked on the successful-completion path;
-	 * thrown failure (`response.failed`) and cancellation paths never call this.
+	 * Called when a terminal `response.completed`, `response.incomplete`, or
+	 * `response.done` event is successfully processed. Only invoked on the
+	 * successful-completion path; thrown failure (`response.failed`) and
+	 * cancellation paths never call this.
 	 * Used by callers to detect premature stream closure (i.e. the stream ended
 	 * without a recognized terminal event).
 	 */
@@ -2039,6 +2060,7 @@ export async function processResponsesStream<TApi extends Api>(
 	let sawFirstToken = false;
 
 	for await (const event of openaiStream) {
+		const terminalEvent = getOpenAIResponsesTerminalEvent(event);
 		if (event.type === "response.created") {
 			output.responseId = event.response.id;
 		} else if (event.type === "response.output_item.added") {
@@ -2194,12 +2216,6 @@ export async function processResponsesStream<TApi extends Api>(
 					? lookupOpenItem({ output_index: event.output_index, item_id: item.id ?? item.call_id })
 					: lookupOpenItem({ output_index: event.output_index, item_id: item.id });
 			if (item.type === "reasoning") {
-				const thinking =
-					item.summary?.length > 0
-						? item.summary.map(part => part.text).join("\n\n")
-						: item.content?.[0]?.type === "reasoning_text"
-							? (item.content[0].text ?? "")
-							: "";
 				// Prefer the routed entry; the bare itemId find misroutes when ids are
 				// absent (`undefined === undefined` matches the FIRST thinking block) and
 				// misses entirely when the done-event id drifts from the added-event id.
@@ -2210,12 +2226,12 @@ export async function processResponsesStream<TApi extends Api>(
 								| ThinkingContent
 								| undefined);
 				if (reasoningBlock) {
-					reasoningBlock.thinking = thinking;
+					reasoningBlock.thinking = finalizeReasoningThinking(item, reasoningBlock.thinking);
 					reasoningBlock.thinkingSignature = JSON.stringify(item);
 					stream.push({
 						type: "thinking_end",
 						contentIndex: contentIndexOf(reasoningBlock),
-						content: thinking,
+						content: reasoningBlock.thinking,
 						partial: output,
 					});
 				}
@@ -2297,8 +2313,8 @@ export async function processResponsesStream<TApi extends Api>(
 				closeOpenItem(event.output_index, item.id, entry, item.call_id, prefixedFunctionCallItemKey(item.call_id));
 				stream.push({ type: "toolcall_end", contentIndex, toolCall, partial: output });
 			}
-		} else if (event.type === "response.completed" || event.type === "response.incomplete") {
-			const response = event.response;
+		} else if (terminalEvent) {
+			const response = terminalEvent.response;
 			finalizePendingResponsesToolCalls(output);
 			if (response?.id) {
 				output.responseId = response.id;
@@ -2336,7 +2352,7 @@ export async function processResponsesStream<TApi extends Api>(
 			}
 			promoteResponsesToolUseStopReason(output, (response as { end_turn?: boolean } | undefined)?.end_turn);
 			options?.onCompleted?.();
-			// `response.completed`/`response.incomplete` is the last event of a
+			// `response.completed`/`response.incomplete`/`response.done` is the last event of a
 			// Responses stream. Stop pulling instead of waiting for the server to
 			// close the connection: misbehaving providers keep the socket open
 			// after the terminal event, which would park this loop until the idle

package/src/providers/register-builtins.ts

@@ -157,6 +157,7 @@ let openAICompletionsProviderModulePromise: Promise<LazyProviderModule<"openai-c
 let openAIResponsesProviderModulePromise: Promise<LazyProviderModule<"openai-responses">> | undefined;
 let ollamaProviderModulePromise: Promise<LazyProviderModule<"ollama-chat">> | undefined;
 let cursorProviderModulePromise: Promise<LazyProviderModule<"cursor-agent">> | undefined;
+let cursorProviderModuleOverride: LazyProviderModule<"cursor-agent"> | undefined;
 let devinProviderModulePromise: Promise<LazyProviderModule<"devin-agent">> | undefined;
 let bedrockProviderModuleOverride: LazyProviderModule<"bedrock-converse-stream"> | undefined;
 let bedrockProviderModulePromise: Promise<LazyProviderModule<"bedrock-converse-stream">> | undefined;
@@ -167,6 +168,12 @@ export function setBedrockProviderModule(module: BedrockProviderModule): void {
 	};
 }
 
+export function setCursorProviderModule(module: CursorProviderModule): void {
+	cursorProviderModuleOverride = {
+		stream: module.streamCursor,
+	};
+}
+
 // ---------------------------------------------------------------------------
 // Stream forwarding / error helpers
 // ---------------------------------------------------------------------------
@@ -245,6 +252,10 @@ function forwardStream<TApi extends Api>(
 					(limits?.openAIIdleEnvFloorsFirstEvent
 						? getOpenAIStreamFirstEventTimeoutMs(idleTimeoutMs, limits.defaultFirstEventTimeoutMs)
 						: getStreamFirstEventTimeoutMs(idleTimeoutMs, limits?.defaultFirstEventTimeoutMs)));
+			// Providers with a server-driven local tool bridge (e.g. the Cursor
+			// exec channel) mark their stream busy while a local tool runs; the
+			// watchdog must not read that silence as a provider stall (#4593).
+			const localWorkSource = source instanceof EventStreamImpl ? source : undefined;
 			const watchedSource = iterateWithIdleTimeout(source, {
 				idleTimeoutMs,
 				firstItemTimeoutMs,
@@ -260,6 +271,7 @@ function forwardStream<TApi extends Api>(
 				// `idleTimeoutMs` while we're still legitimately waiting on the model's
 				// first response (slow first-token from reasoning models, cold proxies, etc.).
 				isProgressItem: event => (event as AssistantMessageEvent).type !== "start",
+				hasPendingLocalWork: localWorkSource ? () => localWorkSource.hasPendingLocalWork : undefined,
 			});
 
 			for await (const event of watchedSource) {
@@ -411,6 +423,9 @@ function loadOllamaProviderModule(): Promise<LazyProviderModule<"ollama-chat">>
 }
 
 function loadCursorProviderModule(): Promise<LazyProviderModule<"cursor-agent">> {
+	if (cursorProviderModuleOverride) {
+		return Promise.resolve(cursorProviderModuleOverride);
+	}
 	cursorProviderModulePromise ||= import("./cursor").then(module => {
 		const provider = module as CursorProviderModule;
 		return { stream: provider.streamCursor };

package/src/registry/oauth/__tests__/xai-oauth.test.ts

@@ -69,6 +69,61 @@ describe("XAIOAuthFlow", () => {
 
 		expect(flow.redirectUri).toBe("http://127.0.0.1:56121/callback");
 	});
+
+	it("uses pasted-code login without starting a callback server", async () => {
+		const serveSpy = vi.spyOn(Bun, "serve").mockImplementation(() => {
+			throw new Error("callback server should not start");
+		});
+		let authUrl = "";
+		let tokenRequestBody = "";
+		const progress: string[] = [];
+		const fetchMock = vi.fn(async (input: string | URL | Request, init?: RequestInit) => {
+			const url = typeof input === "string" ? input : input instanceof Request ? input.url : input.toString();
+			if (url.includes("/.well-known/openid-configuration")) {
+				return new Response(
+					JSON.stringify({
+						authorization_endpoint: "https://auth.x.ai/oauth/authorize",
+						token_endpoint: "https://auth.x.ai/oauth/token",
+					}),
+					{ status: 200, headers: { "Content-Type": "application/json" } },
+				);
+			}
+			tokenRequestBody = init?.body instanceof URLSearchParams ? init.body.toString() : String(init?.body ?? "");
+			return new Response(
+				JSON.stringify({
+					access_token: "access-token",
+					refresh_token: "refresh-token",
+					expires_in: 3600,
+				}),
+				{ status: 200, headers: { "Content-Type": "application/json" } },
+			);
+		});
+
+		const flow = new XAIOAuthFlow({
+			fetch: fetchMock as unknown as typeof fetch,
+			onAuth: info => {
+				authUrl = info.url;
+			},
+			onManualCodeInput: async () => {
+				const parsed = new URL(authUrl);
+				const redirectUri = parsed.searchParams.get("redirect_uri") ?? "";
+				const state = parsed.searchParams.get("state") ?? "";
+				return `${redirectUri}?code=code-xyz&state=${encodeURIComponent(state)}`;
+			},
+			onProgress: message => progress.push(message),
+		});
+
+		const credentials = await flow.login();
+		const authorizeUrl = new URL(authUrl);
+		const tokenParams = new URLSearchParams(tokenRequestBody);
+
+		expect(serveSpy).not.toHaveBeenCalled();
+		expect(authorizeUrl.searchParams.get("redirect_uri")).toBe("http://127.0.0.1:56121/callback");
+		expect(progress).toContain("Waiting for pasted authorization code...");
+		expect(tokenParams.get("code")).toBe("code-xyz");
+		expect(credentials.access).toBe("access-token");
+		expect(credentials.refresh).toBe("refresh-token");
+	});
 });
 
 describe("XAIOAuthFlow.exchangeToken", () => {

package/src/registry/oauth/callback-server.ts

@@ -48,6 +48,8 @@ export interface OAuthCallbackFlowOptions {
 	 * an actionable message before opening the browser.
 	 */
 	allowPortFallback?: boolean;
+	/** Skip the local callback server entirely; the user pastes the code or redirect URL back. */
+	manualInputOnly?: boolean;
 }
 
 /**
@@ -60,6 +62,7 @@ export abstract class OAuthCallbackFlow {
 	callbackHostname: string;
 	redirectUri?: string;
 	allowPortFallback: boolean;
+	#manualInputOnly: boolean;
 	#callbackResolve?: (result: CallbackResult) => void;
 	#callbackReject?: (error: string) => void;
 	/**
@@ -82,6 +85,7 @@ export abstract class OAuthCallbackFlow {
 			this.callbackPath = callbackPath;
 			this.callbackHostname = DEFAULT_HOSTNAME;
 			this.allowPortFallback = true;
+			this.#manualInputOnly = false;
 			return;
 		}
 
@@ -90,6 +94,7 @@ export abstract class OAuthCallbackFlow {
 		this.callbackHostname = preferredPortOrOptions.callbackHostname ?? DEFAULT_HOSTNAME;
 		this.redirectUri = preferredPortOrOptions.redirectUri;
 		this.allowPortFallback = preferredPortOrOptions.allowPortFallback ?? true;
+		this.#manualInputOnly = preferredPortOrOptions.manualInputOnly ?? false;
 	}
 
 	/**
@@ -135,8 +140,12 @@ export abstract class OAuthCallbackFlow {
 		const state = this.generateState();
 		this.#throwIfCancelled();
 
-		// Start callback server first to get actual redirect URI
-		const { server, redirectUri, launchUrl } = await this.#startCallbackServer(state);
+		// Start callback server first to get actual redirect URI. Manual-only
+		// flows never bind a server — the advertised redirect URI is fixed and
+		// the user pastes the code/redirect URL back instead.
+		const { server, redirectUri, launchUrl } = this.#manualInputOnly
+			? { server: undefined, redirectUri: this.#buildRedirectUri(), launchUrl: undefined }
+			: await this.#startCallbackServer(state);
 
 		try {
 			this.#throwIfCancelled();
@@ -152,9 +161,12 @@ export abstract class OAuthCallbackFlow {
 
 			// Notify controller that auth is ready
 			this.ctrl.onAuth?.({ url: authUrl, launchUrl, instructions });
-			this.ctrl.onProgress?.("Waiting for browser authentication...");
+			this.ctrl.onProgress?.(
+				this.#manualInputOnly
+					? "Waiting for pasted authorization code..."
+					: "Waiting for browser authentication...",
+			);
 
-			// Wait for callback or manual input
 			const { code } = await this.#waitForCallback(state);
 			this.#throwIfCancelled();
 
@@ -163,10 +175,14 @@ export abstract class OAuthCallbackFlow {
 			return await this.exchangeToken(code, state, redirectUri);
 		} finally {
 			this.#pendingAuthUrl = undefined;
-			server.stop();
+			server?.stop();
 		}
 	}
 
+	#buildRedirectUri(): string {
+		return this.redirectUri ?? `http://${this.callbackHostname}:${this.preferredPort}${this.callbackPath}`;
+	}
+
 	/**
 	 * Start callback server, trying preferred port first, falling back to random.
 	 * `launchUrl` is `undefined` when the caller configured `callbackPath` to
@@ -229,20 +245,32 @@ export abstract class OAuthCallbackFlow {
 
 	/**
 	 * Build the `/launch` URL served by the callback server bound to `port`, or
-	 * `undefined` when the configured `callbackPath` (or a `redirectUri` whose
-	 * pathname resolves to {@link LAUNCH_PATH}) would collide with the launch
-	 * route. Kept short (~30 chars) so UIs can advertise it as a
+	 * `undefined` when it must not be advertised:
+	 * - the configured `callbackPath` (or a `redirectUri` whose pathname
+	 *   resolves to {@link LAUNCH_PATH}) would collide with the launch route;
+	 * - the flow's `redirectUri` never returns to this loopback server: fixed
+	 *   non-loopback hosts, or custom schemes like GitLab Duo's `vscode://`
+	 *   URI — which `new URL` parses without complaint, so a scheme/host check
+	 *   is required, not just the parse failure path. Advertising a localhost
+	 *   `/launch` target for such flows misrepresents the callback endpoint
+	 *   and hands remote users a URL that resolves nowhere.
+	 * Kept short (~30 chars) so UIs can advertise it as a
 	 * viewport-truncation-safe copy target for the full authorization URL.
 	 */
 	#launchUrlIfSafe(port: number): string | undefined {
 		if (this.callbackPath === LAUNCH_PATH) return undefined;
 		if (this.redirectUri) {
 			try {
-				if (new URL(this.redirectUri).pathname === LAUNCH_PATH) return undefined;
+				const parsed = new URL(this.redirectUri);
+				if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return undefined;
+				if (parsed.hostname !== "localhost" && parsed.hostname !== "127.0.0.1" && parsed.hostname !== "[::1]") {
+					return undefined;
+				}
+				if (parsed.pathname === LAUNCH_PATH) return undefined;
 			} catch {
-				// A non-parseable redirectUri (e.g. `vscode://...` handled elsewhere)
-				// can't collide with an HTTP `/launch` route — fall through and
-				// advertise the launch URL against the loopback server.
+				// A redirectUri even WHATWG URL cannot parse certainly does not
+				// return to this server — never advertise a launch URL for it.
+				return undefined;
 			}
 		}
 		return `http://${this.callbackHostname}:${port}${LAUNCH_PATH}`;

package/src/registry/oauth/xai-oauth.ts

@@ -1,9 +1,10 @@
 // Ported from NousResearch/hermes-agent (MIT) — hermes_cli/auth.py xAI sections (L93-111, L2979-3160, L5286-5469).
 
 /**
- * xAI Grok (SuperGrok Subscription) OAuth flow.
+ * xAI Grok (SuperGrok or X Premium+) OAuth flow.
  *
- * Loopback PKCE flow on `127.0.0.1:56121/callback`. One token unlocks Grok-4.x
+ * Manual-code PKCE flow using `127.0.0.1:56121/callback` as the allowlisted
+ * redirect URI. One token unlocks Grok-4.x
  * chat, Grok Imagine image generation, and Grok Voice TTS via subsequent
  * commits. Endpoint discovery is hardened against MITM via
  * {@link validateXAIEndpoint}: any non-HTTPS or non-`x.ai`/`*.x.ai` host is
@@ -196,10 +197,7 @@ function buildXAIAuthorizeUrl(opts: BuildXAIAuthorizeUrlOptions): string {
 }
 
 /**
- * xAI Grok OAuth loopback flow (Hermes `_xai_oauth_loopback_login` L5315-5469).
- *
- * Uses a fixed redirect URI so the callback server fails fast instead of
- * falling back to a random port that xAI's redirect_uri allowlist rejects.
+ * xAI Grok OAuth code flow (Hermes `_xai_oauth_loopback_login` L5315-5469).
  */
 export class XAIOAuthFlow extends OAuthCallbackFlow {
 	#verifier: string = "";
@@ -211,6 +209,7 @@ export class XAIOAuthFlow extends OAuthCallbackFlow {
 			callbackPath: XAI_OAUTH_REDIRECT_PATH,
 			callbackHostname: XAI_OAUTH_REDIRECT_HOST,
 			redirectUri: `http://${XAI_OAUTH_REDIRECT_HOST}:${XAI_OAUTH_REDIRECT_PORT}${XAI_OAUTH_REDIRECT_PATH}`,
+			manualInputOnly: true,
 		} satisfies OAuthCallbackFlowOptions);
 		this.#fetch = ctrl.fetch ?? fetch;
 	}
@@ -231,7 +230,7 @@ export class XAIOAuthFlow extends OAuthCallbackFlow {
 
 		return {
 			url,
-			instructions: `Complete login in your browser for xAI Grok (SuperGrok). Docs: ${XAI_OAUTH_DOCS_URL}`,
+			instructions: `Complete login in your browser for xAI Grok (SuperGrok or X Premium+). Docs: ${XAI_OAUTH_DOCS_URL}`,
 		};
 	}
 
@@ -308,9 +307,6 @@ export class XAIOAuthFlow extends OAuthCallbackFlow {
 	}
 }
 
-/**
- * Login with xAI Grok OAuth (SuperGrok Subscription).
- */
 export async function loginXAIOAuth(ctrl: OAuthController): Promise<OAuthCredentials> {
 	return new XAIOAuthFlow(ctrl).login();
 }

package/src/registry/xai-oauth.ts

@@ -3,7 +3,7 @@ import type { ProviderDefinition } from "./types";
 
 export const xaiOauthProvider = {
 	id: "xai-oauth",
-	name: "xAI Grok OAuth (SuperGrok Subscription)",
+	name: "xAI Grok OAuth (SuperGrok or X Premium+)",
 	login: async (cb: OAuthLoginCallbacks) => {
 		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
 		const { loginXAIOAuth } = await import("./oauth/xai-oauth");
@@ -14,4 +14,5 @@ export const xaiOauthProvider = {
 		const { refreshXAIOAuthToken } = await import("./oauth/xai-oauth");
 		return refreshXAIOAuthToken(credentials.refresh);
 	},
+	pasteCodeFlow: true,
 } as const satisfies ProviderDefinition;

package/src/stream.ts

@@ -1106,7 +1106,13 @@ export function streamSimple<TApi extends Api>(
 				// Caller aborted between attempts: don't mint a fresh token or fire
 				// another doomed request — emit the captured failure instead.
 				if (signal?.aborted) break;
-				const nextKey = await resolveRetryKey(apiKeyResolver, AUTH_RETRY_STEPS[step]!, failure.error, signal);
+				const nextKey = await resolveRetryKey(
+					apiKeyResolver,
+					AUTH_RETRY_STEPS[step]!,
+					failure.error,
+					signal,
+					lastKey,
+				);
 				if (nextKey === undefined || nextKey === lastKey) continue;
 				lastKey = nextKey;
 				const isLastStep = step === AUTH_RETRY_STEPS.length - 1;

package/src/types.ts

@@ -715,6 +715,8 @@ export interface AssistantMessage {
 	stopReason: StopReason;
 	stopDetails?: StopDetails | null;
 	errorMessage?: string;
+	/** Per-tool abort messages used when an aborted assistant turn needs different placeholder results per tool call. */
+	toolCallAbortMessages?: Record<string, string>;
 	/** HTTP status surfaced by the provider when the request failed. Populated by every provider's catch block alongside `errorMessage` so consumers (auth retry, telemetry, UI) can branch without regex-scraping the message. */
 	errorStatus?: number;
 	/** Structured machine-readable error classifier; see `utils/error-id.ts` for bit layout and helpers. */

package/src/usage/openai-codex.ts

@@ -285,8 +285,6 @@ function buildUsageLimit(args: {
 		label: usageWindow.label,
 		scope: {
 			provider: "openai-codex",
-			accountId: args.accountId,
-			tier: args.planType,
 			windowId: usageWindow.id,
 			shared: true,
 		},
@@ -507,6 +505,9 @@ export const openaiCodexUsageProvider: UsageProvider = {
 const FIVE_HOUR_MS = 5 * 60 * 60 * 1000;
 
 export const codexRankingStrategy: CredentialRankingStrategy = {
+	blockScope() {
+		return "shared";
+	},
 	findWindowLimits(report) {
 		const findLimit = (key: "primary" | "secondary"): UsageLimit | undefined => {
 			const direct = report.limits.find(l => l.id === `openai-codex:${key}`);

package/src/utils/event-stream.ts

@@ -10,6 +10,14 @@ export class EventStream<T, R = T> implements AsyncIterable<T> {
 	resultSettled = false;
 	#failed = false;
 	#error: unknown = undefined;
+	/**
+	 * Consumer-side local operations currently in flight for this stream — a
+	 * provider transport waiting on a server-requested local tool bridge
+	 * (e.g. the Cursor exec channel) before it can send the result upstream.
+	 * While non-zero, event silence is attributable to our own pending work,
+	 * not a provider stall; idle watchdogs consult {@link hasPendingLocalWork}.
+	 */
+	#pendingLocalWork = 0;
 	finalResultPromise: Promise<R>;
 	resolveFinalResult!: (result: R) => void;
 	rejectFinalResult!: (err: unknown) => void;
@@ -116,6 +124,24 @@ export class EventStream<T, R = T> implements AsyncIterable<T> {
 	result(): Promise<R> {
 		return this.finalResultPromise;
 	}
+
+	/** True while local work tracked via {@link trackLocalWork} is pending. */
+	get hasPendingLocalWork(): boolean {
+		return this.#pendingLocalWork > 0;
+	}
+
+	/**
+	 * Track a local-work promise so idle watchdogs on this stream do not treat
+	 * the event silence while it is pending as a provider stall.
+	 */
+	async trackLocalWork<TWork>(work: Promise<TWork>): Promise<TWork> {
+		this.#pendingLocalWork++;
+		try {
+			return await work;
+		} finally {
+			this.#pendingLocalWork--;
+		}
+	}
 }
 
 export class AssistantMessageEventStream extends EventStream<AssistantMessageEvent, AssistantMessage> {