@oh-my-pi/pi-ai 16.3.12 → 16.3.13

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [16.3.13] - 2026-07-09
+
+### Changed
+
+- Changed the xAI Grok OAuth (`xai-oauth`) provider to use manual code-paste login by default. `/login` now accepts a pasted authorization code or full `http://127.0.0.1:56121/callback?code=...` redirect URL without starting a local callback listener ([#3277](https://github.com/can1357/oh-my-pi/pull/3277) by [@Jaaneek](https://github.com/Jaaneek)).
+- Renamed the xAI Grok OAuth provider in login and credential prompts to "xAI Grok OAuth (SuperGrok or X Premium+)" ([#3277](https://github.com/can1357/oh-my-pi/pull/3277) by [@Jaaneek](https://github.com/Jaaneek)).
+
+### Fixed
+
+- Fixed the generic lazy-stream idle watchdog aborting healthy `cursor-agent` streams with "Provider stream stalled while waiting for the next event" while a Cursor exec-channel local tool (shell/read/grep/write/MCP/…) legitimately ran longer than the idle budget. Provider streams now advertise consumer-side local work in flight and the watchdog slides its deadline instead of aborting; genuinely silent streams still time out. ([#4593](https://github.com/can1357/oh-my-pi/issues/4593))
+- Fixed OpenAI Codex/Responses reasoning streams so streamed thinking content is preserved when the final `output_item.done` reconstructs to an empty summary ([#4918](https://github.com/can1357/oh-my-pi/issues/4918)).
+- Fixed Anthropic streams hanging forever when generation wedges mid-stream (notably long `write` tool calls on Opus 4.8 high/xhigh) while the server keeps sending `ping` keepalives: pings now extend the idle watchdog only within a bounded window (3x the idle timeout) since the last real stream event, so a stalled tool-call stream times out and recovers instead of hanging with no retry path ([#4900](https://github.com/can1357/oh-my-pi/issues/4900)).
+
 ## [16.3.12] - 2026-07-08
 
 ### Added

package/dist/types/auth-broker/discover.d.ts

@@ -19,7 +19,7 @@ export declare function getAuthBrokerTokenFilePath(): string;
  * Resolve broker connection configuration using the same precedence as the TUI:
  *
  * 1. `OMP_AUTH_BROKER_URL` / `OMP_AUTH_BROKER_TOKEN` env vars.
- * 2. `auth.broker.url` / `auth.broker.token` in `<agentDir>/config.yml`.
+ * 2. `auth.broker.url` / `auth.broker.token` in `<agentDir>/config.yml` or `<agentDir>/config.yaml`.
  * 3. `<config-root>/auth-broker.token` file (paired with a URL from env/config).
  *
  * Returns `null` when no broker URL is configured — callers should fall back to

package/dist/types/providers/cursor.d.ts

@@ -1,4 +1,7 @@
+import http2 from "node:http2";
 import { type JsonValue } from "@bufbuild/protobuf";
+import type { McpToolDefinition } from "@oh-my-pi/pi-catalog/discovery/cursor-gen/agent_pb";
+import { type AgentServerMessage, type ConversationStateStructure } from "@oh-my-pi/pi-catalog/discovery/cursor-gen/agent_pb";
 import type { AssistantMessage, CursorExecHandlerResult, CursorExecHandlers, CursorToolResultHandler, Message, StreamFunction, StreamOptions, TextContent, ThinkingContent, ToolCall, ToolResultMessage } from "../types.js";
 import { kCursorExecResolved, kStreamingBlockIndex, kStreamingBlockKind, kStreamingLastParseLen, kStreamingPartialJson } from "../utils/block-symbols.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
@@ -39,6 +42,8 @@ export interface BlockState {
 export interface UsageState {
     sawTokenDelta: boolean;
 }
+/** Exported for tests: drives one Cursor server message through the stream (exec waits mark the stream busy). */
+export declare function handleServerMessage(msg: AgentServerMessage, output: AssistantMessage, stream: AssistantMessageEventStream, state: BlockState, blobStore: Map<string, Uint8Array>, h2Request: http2.ClientHttp2Stream, execHandlers: CursorExecHandlers | undefined, onToolResult: CursorToolResultHandler | undefined, usageState: UsageState, requestContextTools: McpToolDefinition[], onConversationCheckpoint?: (checkpoint: ConversationStateStructure) => void): Promise<void>;
 /** Exported for tests: verifies handler is invoked with correct `this` when passed as bound. */
 export declare function resolveExecHandler<TArgs, TResult>(args: TArgs, handler: ((args: TArgs) => Promise<CursorExecHandlerResult<TResult>>) | undefined, onToolResult: CursorToolResultHandler | undefined, buildFromToolResult: (toolResult: ToolResultMessage) => TResult, buildRejected: (reason: string) => TResult, buildError: (error: string) => TResult): Promise<{
     execResult: TResult;

package/dist/types/providers/openai-shared.d.ts

@@ -382,6 +382,8 @@ type ResponsesToolCallBlock = ToolCall & {
     [kStreamingLastParseLen]?: number;
 };
 export declare function appendReasoningSummaryPart(item: ResponseReasoningItem, part: ResponseReasoningItem["summary"][number]): void;
+/** Chooses the final reasoning text without discarding content already streamed into the block. */
+export declare function finalizeReasoningThinking(item: ResponseReasoningItem, streamedThinking: string): string;
 export declare function appendReasoningSummaryTextDelta(item: ResponseReasoningItem, block: ThinkingContent, delta: string, stream: AssistantMessageEventStream, output: AssistantMessage, contentIndex: number): void;
 export declare function appendReasoningSummaryPartDone(item: ResponseReasoningItem, block: ThinkingContent, stream: AssistantMessageEventStream, output: AssistantMessage, contentIndex: number): void;
 export declare function appendMessageContentPart(item: ResponseOutputMessage, part: ResponseContentPartAddedEvent["part"] | undefined): void;

package/dist/types/providers/register-builtins.d.ts

@@ -13,10 +13,15 @@
 import type { AssistantMessageEventStream, Context, Model, OptionsForApi } from "../types.js";
 import { AssistantMessageEventStream as EventStreamImpl } from "../utils/event-stream.js";
 import type { BedrockOptions } from "./amazon-bedrock.js";
+import type { CursorOptions } from "./cursor.js";
+interface CursorProviderModule {
+    streamCursor: (model: Model<"cursor-agent">, context: Context, options: CursorOptions) => AssistantMessageEventStream;
+}
 interface BedrockProviderModule {
     streamBedrock: (model: Model<"bedrock-converse-stream">, context: Context, options: BedrockOptions) => AssistantMessageEventStream;
 }
 export declare function setBedrockProviderModule(module: BedrockProviderModule): void;
+export declare function setCursorProviderModule(module: CursorProviderModule): void;
 export declare const streamAnthropic: (model: Model<"anthropic-messages">, context: Context, options: OptionsForApi<"anthropic-messages">) => EventStreamImpl;
 export declare const streamAzureOpenAIResponses: (model: Model<"azure-openai-responses">, context: Context, options: OptionsForApi<"azure-openai-responses">) => EventStreamImpl;
 export declare const streamGoogle: (model: Model<"google-generative-ai">, context: Context, options: OptionsForApi<"google-generative-ai">) => EventStreamImpl;

package/dist/types/registry/oauth/callback-server.d.ts

@@ -23,6 +23,8 @@ export interface OAuthCallbackFlowOptions {
      * an actionable message before opening the browser.
      */
     allowPortFallback?: boolean;
+    /** Skip the local callback server entirely; the user pastes the code or redirect URL back. */
+    manualInputOnly?: boolean;
 }
 /**
  * Abstract base class for OAuth flows with local callback servers.

package/dist/types/registry/oauth/xai-oauth.d.ts

@@ -24,10 +24,7 @@ export declare function validateXAIEndpoint(url: string, field: string): string;
  */
 export declare function isXAIAccessTokenExpiring(jwt: string, skewSeconds?: number): boolean;
 /**
- * xAI Grok OAuth loopback flow (Hermes `_xai_oauth_loopback_login` L5315-5469).
- *
- * Uses a fixed redirect URI so the callback server fails fast instead of
- * falling back to a random port that xAI's redirect_uri allowlist rejects.
+ * xAI Grok OAuth code flow (Hermes `_xai_oauth_loopback_login` L5315-5469).
  */
 export declare class XAIOAuthFlow extends OAuthCallbackFlow {
     #private;
@@ -38,9 +35,6 @@ export declare class XAIOAuthFlow extends OAuthCallbackFlow {
     }>;
     exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials>;
 }
-/**
- * Login with xAI Grok OAuth (SuperGrok Subscription).
- */
 export declare function loginXAIOAuth(ctrl: OAuthController): Promise<OAuthCredentials>;
 /**
  * Refresh an xAI OAuth access token using a stored refresh_token.

package/dist/types/registry/registry.d.ts

@@ -265,9 +265,10 @@ declare const ALL: ({
     readonly name: "xAI";
 } | {
     readonly id: "xai-oauth";
-    readonly name: "xAI Grok OAuth (SuperGrok Subscription)";
+    readonly name: "xAI Grok OAuth (SuperGrok or X Premium+)";
     readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<import("./oauth/index.js").OAuthCredentials>;
     readonly refreshToken: (credentials: import("./oauth/index.js").OAuthCredentials) => Promise<import("./oauth/index.js").OAuthCredentials>;
+    readonly pasteCodeFlow: true;
 } | {
     readonly id: "xiaomi";
     readonly name: "Xiaomi MiMo";

package/dist/types/registry/xai-oauth.d.ts

@@ -1,7 +1,8 @@
 import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types.js";
 export declare const xaiOauthProvider: {
     readonly id: "xai-oauth";
-    readonly name: "xAI Grok OAuth (SuperGrok Subscription)";
+    readonly name: "xAI Grok OAuth (SuperGrok or X Premium+)";
     readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
     readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+    readonly pasteCodeFlow: true;
 };

package/dist/types/utils/event-stream.d.ts

@@ -22,6 +22,13 @@ export declare class EventStream<T, R = T> implements AsyncIterable<T> {
     fail(err: unknown): void;
     [Symbol.asyncIterator](): AsyncIterator<T>;
     result(): Promise<R>;
+    /** True while local work tracked via {@link trackLocalWork} is pending. */
+    get hasPendingLocalWork(): boolean;
+    /**
+     * Track a local-work promise so idle watchdogs on this stream do not treat
+     * the event silence while it is pending as a provider stall.
+     */
+    trackLocalWork<TWork>(work: Promise<TWork>): Promise<TWork>;
 }
 export declare class AssistantMessageEventStream extends EventStream<AssistantMessageEvent, AssistantMessage> {
     constructor();

package/dist/types/utils/idle-iterator.d.ts

@@ -83,6 +83,16 @@ export interface IdleTimeoutIteratorOptions {
      * keepalive/no-op events from keeping a stalled tool call alive forever.
      */
     isProgressItem?: (item: unknown) => boolean;
+    /**
+     * Reports consumer-side local work in flight for the stream: the provider
+     * transport is waiting on a server-requested local tool bridge (e.g. the
+     * Cursor exec channel) before anything can flow upstream again. While it
+     * returns true, an expired idle / first-item deadline slides forward
+     * instead of aborting — the silence is ours, not a provider stall. The
+     * watchdog re-arms with a full budget once the local work completes, so a
+     * provider that stalls afterwards is still caught.
+     */
+    hasPendingLocalWork?: () => boolean;
     /**
      * Cancel iteration as soon as this signal aborts. Required for caller-driven
      * cancellation (ESC) when the underlying transport does not surface signal

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "16.3.12",
+	"version": "16.3.13",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.0",
-		"@oh-my-pi/pi-catalog": "16.3.12",
-		"@oh-my-pi/pi-utils": "16.3.12",
-		"@oh-my-pi/pi-wire": "16.3.12",
+		"@oh-my-pi/pi-catalog": "16.3.13",
+		"@oh-my-pi/pi-utils": "16.3.13",
+		"@oh-my-pi/pi-wire": "16.3.13",
 		"arktype": "^2.2.0",
 		"zod": "^4"
 	},

package/src/auth-broker/discover.ts

@@ -1,6 +1,6 @@
 /**
  * Broker-aware auth-storage discovery used by both the coding-agent runtime and
- * the catalog model generator. Keeps the precedence logic (env → config.yml →
+ * the catalog model generator. Keeps the precedence logic (env → config.yml/config.yaml →
  * token file → local SQLite) in one place so build-time tooling sees the same
  * credentials as the TUI.
  */
@@ -12,6 +12,7 @@ import {
 	getConfigRootDir,
 	isEnoent,
 	logger,
+	MAIN_CONFIG_FILENAMES,
 } from "@oh-my-pi/pi-utils";
 import { YAML } from "bun";
 import { AuthStorage } from "../auth-storage";
@@ -72,21 +73,24 @@ interface ConfigSnapshot {
 }
 
 async function readConfigYaml(agentDir: string): Promise<ConfigSnapshot> {
-	const configPath = path.join(agentDir, "config.yml");
-	try {
-		const raw = await Bun.file(configPath).text();
-		const parsed = YAML.parse(raw);
-		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
-		const record = parsed as Record<string, unknown>;
-		const url = typeof record["auth.broker.url"] === "string" ? (record["auth.broker.url"] as string) : undefined;
-		const token =
-			typeof record["auth.broker.token"] === "string" ? (record["auth.broker.token"] as string) : undefined;
-		return { url, token };
-	} catch (err) {
-		if (isEnoent(err)) return {};
-		logger.warn("auth-broker config.yml unreadable", { error: String(err) });
-		return {};
+	for (const filename of MAIN_CONFIG_FILENAMES) {
+		const configPath = path.join(agentDir, filename);
+		try {
+			const raw = await Bun.file(configPath).text();
+			const parsed = YAML.parse(raw);
+			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+			const record = parsed as Record<string, unknown>;
+			const url = typeof record["auth.broker.url"] === "string" ? (record["auth.broker.url"] as string) : undefined;
+			const token =
+				typeof record["auth.broker.token"] === "string" ? (record["auth.broker.token"] as string) : undefined;
+			return { url, token };
+		} catch (err) {
+			if (isEnoent(err)) continue;
+			logger.warn("auth-broker config unreadable", { path: configPath, error: String(err) });
+			return {};
+		}
 	}
+	return {};
 }
 
 function resolveSnapshotTtlMs(): number {
@@ -104,7 +108,7 @@ function resolveSnapshotTtlMs(): number {
  * Resolve broker connection configuration using the same precedence as the TUI:
  *
  * 1. `OMP_AUTH_BROKER_URL` / `OMP_AUTH_BROKER_TOKEN` env vars.
- * 2. `auth.broker.url` / `auth.broker.token` in `<agentDir>/config.yml`.
+ * 2. `auth.broker.url` / `auth.broker.token` in `<agentDir>/config.yml` or `<agentDir>/config.yaml`.
  * 3. `<config-root>/auth-broker.token` file (paired with a URL from env/config).
  *
  * Returns `null` when no broker URL is configured — callers should fall back to

package/src/providers/anthropic.ts

@@ -1462,6 +1462,16 @@ async function* observeDecodedAnthropicSdkEvents(
 
 const PROVIDER_MAX_RETRIES = 10;
 
+/**
+ * How long `ping` keepalives may keep extending the idle deadline without any
+ * semantic stream progress, as a multiple of the idle timeout. Anthropic pings
+ * across legitimate generation gaps, so pings count as liveness — but a wedged
+ * upstream that pings forever while producing no events must eventually trip
+ * the idle watchdog instead of hanging an active tool-call stream without a
+ * recovery path (#4900).
+ */
+const PING_PROGRESS_MAX_IDLE_MULTIPLIER = 3;
+
 /**
  * Log a malformed-stream-envelope anomaly without aborting the turn. The strict
  * parser would `throw new AnthropicStreamEnvelopeError(...)` here; we instead
@@ -2007,11 +2017,20 @@ const streamAnthropicOnce = (
 						}
 					>();
 
-					// Pings keep the idle deadline alive once content is flowing, but a
-					// ping before message_start must not consume the first-event watchdog:
-					// it would flip the (retryable) pre-content stall classification into
-					// a terminal mid-stream idle timeout.
+					// Pings keep the idle deadline alive once content is flowing (Anthropic
+					// bridges legitimate generation gaps with keepalives), but only within a
+					// bounded window: a wedged upstream that pings forever while the model
+					// produces nothing must still trip the idle watchdog, otherwise an
+					// active tool-call stream hangs unrecoverably with no retry (#4900).
+					// A ping before message_start must not consume the first-event watchdog
+					// either: it would flip the (retryable) pre-content stall classification
+					// into a terminal mid-stream idle timeout.
 					let sawNonPingEvent = false;
+					let lastNonPingProgressAtMs = 0;
+					const pingProgressCapMs =
+						idleTimeoutMs !== undefined && idleTimeoutMs > 0
+							? idleTimeoutMs * PING_PROGRESS_MAX_IDLE_MULTIPLIER
+							: undefined;
 					const timedAnthropicStream = iterateWithIdleTimeout(anthropicStream, {
 						idleTimeoutMs,
 						firstItemTimeoutMs: firstEventTimeoutMs,
@@ -2021,8 +2040,13 @@ const streamAnthropicOnce = (
 						onFirstItemTimeout: () => activeAbortTracker.abortLocally(firstEventTimeoutAbortError),
 						abortSignal: options?.signal,
 						isProgressItem: item => {
-							if ((item as AnthropicStreamEvent).type === "ping") return sawNonPingEvent;
+							if ((item as AnthropicStreamEvent).type === "ping") {
+								if (!sawNonPingEvent) return false;
+								if (pingProgressCapMs === undefined) return true;
+								return Date.now() - lastNonPingProgressAtMs < pingProgressCapMs;
+							}
 							sawNonPingEvent = true;
+							lastNonPingProgressAtMs = Date.now();
 							return true;
 						},
 					});

package/src/providers/cursor.ts

@@ -653,7 +653,8 @@ export interface UsageState {
 	sawTokenDelta: boolean;
 }
 
-async function handleServerMessage(
+/** Exported for tests: drives one Cursor server message through the stream (exec waits mark the stream busy). */
+export async function handleServerMessage(
 	msg: AgentServerMessage,
 	output: AssistantMessage,
 	stream: AssistantMessageEventStream,
@@ -675,15 +676,21 @@ async function handleServerMessage(
 	} else if (msgCase === "kvServerMessage") {
 		handleKvServerMessage(msg.message.value as KvServerMessage, blobStore, h2Request);
 	} else if (msgCase === "execServerMessage") {
-		await handleExecServerMessage(
-			msg.message.value as ExecServerMessage,
-			h2Request,
-			execHandlers,
-			onToolResult,
-			requestContextTools,
-			output,
-			stream,
-			state,
+		// The server is waiting on OUR local tool result during this window — no
+		// AssistantMessageEvent flows until the handler finishes. Mark the wait
+		// as local work so the lazy stream idle watchdog attributes the silence
+		// to the tool run instead of aborting a healthy stream (issue #4593).
+		await stream.trackLocalWork(
+			handleExecServerMessage(
+				msg.message.value as ExecServerMessage,
+				h2Request,
+				execHandlers,
+				onToolResult,
+				requestContextTools,
+				output,
+				stream,
+				state,
+			),
 		);
 	} else if (msgCase === "conversationCheckpointUpdate") {
 		handleConversationCheckpointUpdate(msg.message.value, output, usageState, onConversationCheckpoint);

package/src/providers/openai-codex-responses.ts

@@ -95,6 +95,7 @@ import {
 	encodeTextSignatureV1,
 	finalizeCustomToolCallInputDone,
 	finalizePendingResponsesToolCalls,
+	finalizeReasoningThinking,
 	finalizeToolCallArgumentsDone,
 	isOpenAIResponsesProgressEvent,
 	mapOpenAIResponsesStopReason,
@@ -1407,6 +1408,21 @@ class CodexStreamProcessor {
 			return firstTokenTime;
 		}
 
+		if (eventType === "response.reasoning_text.delta") {
+			const entry = this.runtime.openItemForEvent(rawEvent);
+			const delta = typeof rawEvent.delta === "string" ? rawEvent.delta : "";
+			if (entry?.item.type === "reasoning" && entry.block?.type === "thinking") {
+				entry.block.thinking += delta;
+				stream.push({
+					type: "thinking_delta",
+					contentIndex: entry.contentIndex,
+					delta,
+					partial: output,
+				});
+			}
+			return firstTokenTime;
+		}
+
 		if (eventType === "response.reasoning_summary_part.done") {
 			if (this.runtime.currentItem?.type === "reasoning" && this.runtime.currentBlock?.type === "thinking") {
 				appendReasoningSummaryPartDone(
@@ -1522,13 +1538,13 @@ class CodexStreamProcessor {
 		// most-recently-added block may belong to a sibling (#2619). Some Codex
 		// function/custom tool items omit `id`; in that case `output_index` still
 		// routes `output_item.done` to the block that received `output_item.added`.
-		const itemId = typeof (item as { id?: string }).id === "string" ? (item as { id: string }).id : "";
+		const itemId = "id" in item && typeof item.id === "string" ? item.id : "";
 		const entry = (itemId ? runtime.openItems.get(itemId) : null) ?? runtime.openItemForEvent(rawEvent);
 		const block = entry?.block ?? null;
 		const contentIndex = entry?.contentIndex ?? output.content.length - 1;
 
 		if (item.type === "reasoning" && block?.type === "thinking") {
-			block.thinking = item.summary?.map(summary => summary.text).join("\n\n") || "";
+			block.thinking = finalizeReasoningThinking(item, block.thinking);
 			block.thinkingSignature = JSON.stringify(item);
 			stream.push({
 				type: "thinking_end",

package/src/providers/openai-shared.ts

@@ -1684,6 +1684,14 @@ export function appendReasoningSummaryPart(
 	item.summary.push(part);
 }
 
+/** Chooses the final reasoning text without discarding content already streamed into the block. */
+export function finalizeReasoningThinking(item: ResponseReasoningItem, streamedThinking: string): string {
+	const summaryThinking = item.summary?.map(part => part.text).join("\n\n") ?? "";
+	if (summaryThinking) return summaryThinking;
+	const contentThinking = item.content?.[0]?.type === "reasoning_text" ? (item.content[0].text ?? "") : "";
+	return contentThinking || streamedThinking || "";
+}
+
 export function appendReasoningSummaryTextDelta(
 	item: ResponseReasoningItem,
 	block: ThinkingContent,
@@ -2208,12 +2216,6 @@ export async function processResponsesStream<TApi extends Api>(
 					? lookupOpenItem({ output_index: event.output_index, item_id: item.id ?? item.call_id })
 					: lookupOpenItem({ output_index: event.output_index, item_id: item.id });
 			if (item.type === "reasoning") {
-				const thinking =
-					item.summary?.length > 0
-						? item.summary.map(part => part.text).join("\n\n")
-						: item.content?.[0]?.type === "reasoning_text"
-							? (item.content[0].text ?? "")
-							: "";
 				// Prefer the routed entry; the bare itemId find misroutes when ids are
 				// absent (`undefined === undefined` matches the FIRST thinking block) and
 				// misses entirely when the done-event id drifts from the added-event id.
@@ -2224,12 +2226,12 @@ export async function processResponsesStream<TApi extends Api>(
 								| ThinkingContent
 								| undefined);
 				if (reasoningBlock) {
-					reasoningBlock.thinking = thinking;
+					reasoningBlock.thinking = finalizeReasoningThinking(item, reasoningBlock.thinking);
 					reasoningBlock.thinkingSignature = JSON.stringify(item);
 					stream.push({
 						type: "thinking_end",
 						contentIndex: contentIndexOf(reasoningBlock),
-						content: thinking,
+						content: reasoningBlock.thinking,
 						partial: output,
 					});
 				}

package/src/providers/register-builtins.ts

@@ -157,6 +157,7 @@ let openAICompletionsProviderModulePromise: Promise<LazyProviderModule<"openai-c
 let openAIResponsesProviderModulePromise: Promise<LazyProviderModule<"openai-responses">> | undefined;
 let ollamaProviderModulePromise: Promise<LazyProviderModule<"ollama-chat">> | undefined;
 let cursorProviderModulePromise: Promise<LazyProviderModule<"cursor-agent">> | undefined;
+let cursorProviderModuleOverride: LazyProviderModule<"cursor-agent"> | undefined;
 let devinProviderModulePromise: Promise<LazyProviderModule<"devin-agent">> | undefined;
 let bedrockProviderModuleOverride: LazyProviderModule<"bedrock-converse-stream"> | undefined;
 let bedrockProviderModulePromise: Promise<LazyProviderModule<"bedrock-converse-stream">> | undefined;
@@ -167,6 +168,12 @@ export function setBedrockProviderModule(module: BedrockProviderModule): void {
 	};
 }
 
+export function setCursorProviderModule(module: CursorProviderModule): void {
+	cursorProviderModuleOverride = {
+		stream: module.streamCursor,
+	};
+}
+
 // ---------------------------------------------------------------------------
 // Stream forwarding / error helpers
 // ---------------------------------------------------------------------------
@@ -245,6 +252,10 @@ function forwardStream<TApi extends Api>(
 					(limits?.openAIIdleEnvFloorsFirstEvent
 						? getOpenAIStreamFirstEventTimeoutMs(idleTimeoutMs, limits.defaultFirstEventTimeoutMs)
 						: getStreamFirstEventTimeoutMs(idleTimeoutMs, limits?.defaultFirstEventTimeoutMs)));
+			// Providers with a server-driven local tool bridge (e.g. the Cursor
+			// exec channel) mark their stream busy while a local tool runs; the
+			// watchdog must not read that silence as a provider stall (#4593).
+			const localWorkSource = source instanceof EventStreamImpl ? source : undefined;
 			const watchedSource = iterateWithIdleTimeout(source, {
 				idleTimeoutMs,
 				firstItemTimeoutMs,
@@ -260,6 +271,7 @@ function forwardStream<TApi extends Api>(
 				// `idleTimeoutMs` while we're still legitimately waiting on the model's
 				// first response (slow first-token from reasoning models, cold proxies, etc.).
 				isProgressItem: event => (event as AssistantMessageEvent).type !== "start",
+				hasPendingLocalWork: localWorkSource ? () => localWorkSource.hasPendingLocalWork : undefined,
 			});
 
 			for await (const event of watchedSource) {
@@ -411,6 +423,9 @@ function loadOllamaProviderModule(): Promise<LazyProviderModule<"ollama-chat">>
 }
 
 function loadCursorProviderModule(): Promise<LazyProviderModule<"cursor-agent">> {
+	if (cursorProviderModuleOverride) {
+		return Promise.resolve(cursorProviderModuleOverride);
+	}
 	cursorProviderModulePromise ||= import("./cursor").then(module => {
 		const provider = module as CursorProviderModule;
 		return { stream: provider.streamCursor };

package/src/registry/oauth/__tests__/xai-oauth.test.ts

@@ -69,6 +69,61 @@ describe("XAIOAuthFlow", () => {
 
 		expect(flow.redirectUri).toBe("http://127.0.0.1:56121/callback");
 	});
+
+	it("uses pasted-code login without starting a callback server", async () => {
+		const serveSpy = vi.spyOn(Bun, "serve").mockImplementation(() => {
+			throw new Error("callback server should not start");
+		});
+		let authUrl = "";
+		let tokenRequestBody = "";
+		const progress: string[] = [];
+		const fetchMock = vi.fn(async (input: string | URL | Request, init?: RequestInit) => {
+			const url = typeof input === "string" ? input : input instanceof Request ? input.url : input.toString();
+			if (url.includes("/.well-known/openid-configuration")) {
+				return new Response(
+					JSON.stringify({
+						authorization_endpoint: "https://auth.x.ai/oauth/authorize",
+						token_endpoint: "https://auth.x.ai/oauth/token",
+					}),
+					{ status: 200, headers: { "Content-Type": "application/json" } },
+				);
+			}
+			tokenRequestBody = init?.body instanceof URLSearchParams ? init.body.toString() : String(init?.body ?? "");
+			return new Response(
+				JSON.stringify({
+					access_token: "access-token",
+					refresh_token: "refresh-token",
+					expires_in: 3600,
+				}),
+				{ status: 200, headers: { "Content-Type": "application/json" } },
+			);
+		});
+
+		const flow = new XAIOAuthFlow({
+			fetch: fetchMock as unknown as typeof fetch,
+			onAuth: info => {
+				authUrl = info.url;
+			},
+			onManualCodeInput: async () => {
+				const parsed = new URL(authUrl);
+				const redirectUri = parsed.searchParams.get("redirect_uri") ?? "";
+				const state = parsed.searchParams.get("state") ?? "";
+				return `${redirectUri}?code=code-xyz&state=${encodeURIComponent(state)}`;
+			},
+			onProgress: message => progress.push(message),
+		});
+
+		const credentials = await flow.login();
+		const authorizeUrl = new URL(authUrl);
+		const tokenParams = new URLSearchParams(tokenRequestBody);
+
+		expect(serveSpy).not.toHaveBeenCalled();
+		expect(authorizeUrl.searchParams.get("redirect_uri")).toBe("http://127.0.0.1:56121/callback");
+		expect(progress).toContain("Waiting for pasted authorization code...");
+		expect(tokenParams.get("code")).toBe("code-xyz");
+		expect(credentials.access).toBe("access-token");
+		expect(credentials.refresh).toBe("refresh-token");
+	});
 });
 
 describe("XAIOAuthFlow.exchangeToken", () => {

package/src/registry/oauth/callback-server.ts

@@ -48,6 +48,8 @@ export interface OAuthCallbackFlowOptions {
 	 * an actionable message before opening the browser.
 	 */
 	allowPortFallback?: boolean;
+	/** Skip the local callback server entirely; the user pastes the code or redirect URL back. */
+	manualInputOnly?: boolean;
 }
 
 /**
@@ -60,6 +62,7 @@ export abstract class OAuthCallbackFlow {
 	callbackHostname: string;
 	redirectUri?: string;
 	allowPortFallback: boolean;
+	#manualInputOnly: boolean;
 	#callbackResolve?: (result: CallbackResult) => void;
 	#callbackReject?: (error: string) => void;
 	/**
@@ -82,6 +85,7 @@ export abstract class OAuthCallbackFlow {
 			this.callbackPath = callbackPath;
 			this.callbackHostname = DEFAULT_HOSTNAME;
 			this.allowPortFallback = true;
+			this.#manualInputOnly = false;
 			return;
 		}
 
@@ -90,6 +94,7 @@ export abstract class OAuthCallbackFlow {
 		this.callbackHostname = preferredPortOrOptions.callbackHostname ?? DEFAULT_HOSTNAME;
 		this.redirectUri = preferredPortOrOptions.redirectUri;
 		this.allowPortFallback = preferredPortOrOptions.allowPortFallback ?? true;
+		this.#manualInputOnly = preferredPortOrOptions.manualInputOnly ?? false;
 	}
 
 	/**
@@ -135,8 +140,12 @@ export abstract class OAuthCallbackFlow {
 		const state = this.generateState();
 		this.#throwIfCancelled();
 
-		// Start callback server first to get actual redirect URI
-		const { server, redirectUri, launchUrl } = await this.#startCallbackServer(state);
+		// Start callback server first to get actual redirect URI. Manual-only
+		// flows never bind a server — the advertised redirect URI is fixed and
+		// the user pastes the code/redirect URL back instead.
+		const { server, redirectUri, launchUrl } = this.#manualInputOnly
+			? { server: undefined, redirectUri: this.#buildRedirectUri(), launchUrl: undefined }
+			: await this.#startCallbackServer(state);
 
 		try {
 			this.#throwIfCancelled();
@@ -152,9 +161,12 @@ export abstract class OAuthCallbackFlow {
 
 			// Notify controller that auth is ready
 			this.ctrl.onAuth?.({ url: authUrl, launchUrl, instructions });
-			this.ctrl.onProgress?.("Waiting for browser authentication...");
+			this.ctrl.onProgress?.(
+				this.#manualInputOnly
+					? "Waiting for pasted authorization code..."
+					: "Waiting for browser authentication...",
+			);
 
-			// Wait for callback or manual input
 			const { code } = await this.#waitForCallback(state);
 			this.#throwIfCancelled();
 
@@ -163,10 +175,14 @@ export abstract class OAuthCallbackFlow {
 			return await this.exchangeToken(code, state, redirectUri);
 		} finally {
 			this.#pendingAuthUrl = undefined;
-			server.stop();
+			server?.stop();
 		}
 	}
 
+	#buildRedirectUri(): string {
+		return this.redirectUri ?? `http://${this.callbackHostname}:${this.preferredPort}${this.callbackPath}`;
+	}
+
 	/**
 	 * Start callback server, trying preferred port first, falling back to random.
 	 * `launchUrl` is `undefined` when the caller configured `callbackPath` to

package/src/registry/oauth/xai-oauth.ts

@@ -1,9 +1,10 @@
 // Ported from NousResearch/hermes-agent (MIT) — hermes_cli/auth.py xAI sections (L93-111, L2979-3160, L5286-5469).
 
 /**
- * xAI Grok (SuperGrok Subscription) OAuth flow.
+ * xAI Grok (SuperGrok or X Premium+) OAuth flow.
  *
- * Loopback PKCE flow on `127.0.0.1:56121/callback`. One token unlocks Grok-4.x
+ * Manual-code PKCE flow using `127.0.0.1:56121/callback` as the allowlisted
+ * redirect URI. One token unlocks Grok-4.x
  * chat, Grok Imagine image generation, and Grok Voice TTS via subsequent
  * commits. Endpoint discovery is hardened against MITM via
  * {@link validateXAIEndpoint}: any non-HTTPS or non-`x.ai`/`*.x.ai` host is
@@ -196,10 +197,7 @@ function buildXAIAuthorizeUrl(opts: BuildXAIAuthorizeUrlOptions): string {
 }
 
 /**
- * xAI Grok OAuth loopback flow (Hermes `_xai_oauth_loopback_login` L5315-5469).
- *
- * Uses a fixed redirect URI so the callback server fails fast instead of
- * falling back to a random port that xAI's redirect_uri allowlist rejects.
+ * xAI Grok OAuth code flow (Hermes `_xai_oauth_loopback_login` L5315-5469).
  */
 export class XAIOAuthFlow extends OAuthCallbackFlow {
 	#verifier: string = "";
@@ -211,6 +209,7 @@ export class XAIOAuthFlow extends OAuthCallbackFlow {
 			callbackPath: XAI_OAUTH_REDIRECT_PATH,
 			callbackHostname: XAI_OAUTH_REDIRECT_HOST,
 			redirectUri: `http://${XAI_OAUTH_REDIRECT_HOST}:${XAI_OAUTH_REDIRECT_PORT}${XAI_OAUTH_REDIRECT_PATH}`,
+			manualInputOnly: true,
 		} satisfies OAuthCallbackFlowOptions);
 		this.#fetch = ctrl.fetch ?? fetch;
 	}
@@ -231,7 +230,7 @@ export class XAIOAuthFlow extends OAuthCallbackFlow {
 
 		return {
 			url,
-			instructions: `Complete login in your browser for xAI Grok (SuperGrok). Docs: ${XAI_OAUTH_DOCS_URL}`,
+			instructions: `Complete login in your browser for xAI Grok (SuperGrok or X Premium+). Docs: ${XAI_OAUTH_DOCS_URL}`,
 		};
 	}
 
@@ -308,9 +307,6 @@ export class XAIOAuthFlow extends OAuthCallbackFlow {
 	}
 }
 
-/**
- * Login with xAI Grok OAuth (SuperGrok Subscription).
- */
 export async function loginXAIOAuth(ctrl: OAuthController): Promise<OAuthCredentials> {
 	return new XAIOAuthFlow(ctrl).login();
 }

package/src/registry/xai-oauth.ts

@@ -3,7 +3,7 @@ import type { ProviderDefinition } from "./types";
 
 export const xaiOauthProvider = {
 	id: "xai-oauth",
-	name: "xAI Grok OAuth (SuperGrok Subscription)",
+	name: "xAI Grok OAuth (SuperGrok or X Premium+)",
 	login: async (cb: OAuthLoginCallbacks) => {
 		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
 		const { loginXAIOAuth } = await import("./oauth/xai-oauth");
@@ -14,4 +14,5 @@ export const xaiOauthProvider = {
 		const { refreshXAIOAuthToken } = await import("./oauth/xai-oauth");
 		return refreshXAIOAuthToken(credentials.refresh);
 	},
+	pasteCodeFlow: true,
 } as const satisfies ProviderDefinition;

package/src/utils/event-stream.ts

@@ -10,6 +10,14 @@ export class EventStream<T, R = T> implements AsyncIterable<T> {
 	resultSettled = false;
 	#failed = false;
 	#error: unknown = undefined;
+	/**
+	 * Consumer-side local operations currently in flight for this stream — a
+	 * provider transport waiting on a server-requested local tool bridge
+	 * (e.g. the Cursor exec channel) before it can send the result upstream.
+	 * While non-zero, event silence is attributable to our own pending work,
+	 * not a provider stall; idle watchdogs consult {@link hasPendingLocalWork}.
+	 */
+	#pendingLocalWork = 0;
 	finalResultPromise: Promise<R>;
 	resolveFinalResult!: (result: R) => void;
 	rejectFinalResult!: (err: unknown) => void;
@@ -116,6 +124,24 @@ export class EventStream<T, R = T> implements AsyncIterable<T> {
 	result(): Promise<R> {
 		return this.finalResultPromise;
 	}
+
+	/** True while local work tracked via {@link trackLocalWork} is pending. */
+	get hasPendingLocalWork(): boolean {
+		return this.#pendingLocalWork > 0;
+	}
+
+	/**
+	 * Track a local-work promise so idle watchdogs on this stream do not treat
+	 * the event silence while it is pending as a provider stall.
+	 */
+	async trackLocalWork<TWork>(work: Promise<TWork>): Promise<TWork> {
+		this.#pendingLocalWork++;
+		try {
+			return await work;
+		} finally {
+			this.#pendingLocalWork--;
+		}
+	}
 }
 
 export class AssistantMessageEventStream extends EventStream<AssistantMessageEvent, AssistantMessage> {

package/src/utils/idle-iterator.ts

@@ -135,6 +135,16 @@ export interface IdleTimeoutIteratorOptions {
 	 * keepalive/no-op events from keeping a stalled tool call alive forever.
 	 */
 	isProgressItem?: (item: unknown) => boolean;
+	/**
+	 * Reports consumer-side local work in flight for the stream: the provider
+	 * transport is waiting on a server-requested local tool bridge (e.g. the
+	 * Cursor exec channel) before anything can flow upstream again. While it
+	 * returns true, an expired idle / first-item deadline slides forward
+	 * instead of aborting — the silence is ours, not a provider stall. The
+	 * watchdog re-arms with a full budget once the local work completes, so a
+	 * provider that stalls afterwards is still caught.
+	 */
+	hasPendingLocalWork?: () => boolean;
 	/**
 	 * Cancel iteration as soon as this signal aborts. Required for caller-driven
 	 * cancellation (ESC) when the underlying transport does not surface signal
@@ -157,7 +167,7 @@ export async function* iterateWithIdleTimeout<T>(
 	options: IdleTimeoutIteratorOptions,
 ): AsyncGenerator<T> {
 	const firstItemTimeoutMs = options.firstItemTimeoutMs ?? options.idleTimeoutMs;
-	const firstItemDeadlineMs =
+	let firstItemDeadlineMs =
 		firstItemTimeoutMs !== undefined && firstItemTimeoutMs > 0 ? Date.now() + firstItemTimeoutMs : undefined;
 	const abortSignal = options.abortSignal;
 	const iterator = iterable[Symbol.asyncIterator]();
@@ -197,6 +207,28 @@ export async function* iterateWithIdleTimeout<T>(
 	};
 	let lastProgressAt = Date.now();
 
+	const hasPendingLocalWork = (): boolean => {
+		if (!options.hasPendingLocalWork) return false;
+		try {
+			return options.hasPendingLocalWork();
+		} catch {
+			return false;
+		}
+	};
+	// Local work means the current gap is attributable to the consumer side,
+	// not the provider: slide the active deadline a full budget past now
+	// instead of aborting. Once the work completes the watchdog resumes from
+	// the last extension, so a provider that stalls afterwards is still caught.
+	const extendDeadlineForLocalWork = (): void => {
+		if (awaitingFirstItem) {
+			if (firstItemDeadlineMs !== undefined && firstItemTimeoutMs !== undefined) {
+				firstItemDeadlineMs = Date.now() + firstItemTimeoutMs;
+			}
+		} else {
+			lastProgressAt = Date.now();
+		}
+	};
+
 	const noTimeoutEnforced =
 		(firstItemTimeoutMs === undefined || firstItemTimeoutMs <= 0) &&
 		(options.idleTimeoutMs === undefined || options.idleTimeoutMs <= 0);
@@ -271,6 +303,12 @@ export async function* iterateWithIdleTimeout<T>(
 		timer = setTimeout(onTimerFire, Math.max(0, deadlineMs - Date.now()));
 	};
 
+	// The in-flight iterator.next() promise, persisted across loop iterations:
+	// a deadline extension for pending local work loops without consuming it,
+	// and issuing a second next() while one is outstanding would drop an item.
+	let pendingNext:
+		| Promise<{ kind: "next"; result: IteratorResult<T> } | { kind: "error"; error: unknown }>
+		| undefined;
 	try {
 		let raceCount = 0;
 		while (true) {
@@ -291,21 +329,29 @@ export async function* iterateWithIdleTimeout<T>(
 				if (firstItemDeadlineMs !== undefined) {
 					activeTimeoutMs = firstItemDeadlineMs - Date.now();
 					if (activeTimeoutMs <= 0) {
-						options.onFirstItemTimeout?.();
-						closeIterator();
-						throw new AIError.StreamTimeoutError(options.firstItemErrorMessage ?? options.errorMessage);
+						if (!hasPendingLocalWork()) {
+							options.onFirstItemTimeout?.();
+							closeIterator();
+							throw new AIError.StreamTimeoutError(options.firstItemErrorMessage ?? options.errorMessage);
+						}
+						extendDeadlineForLocalWork();
+						activeTimeoutMs = firstItemDeadlineMs! - Date.now();
 					}
 				}
 			} else if (options.idleTimeoutMs !== undefined && options.idleTimeoutMs > 0) {
 				activeTimeoutMs = options.idleTimeoutMs - (Date.now() - lastProgressAt);
 				if (activeTimeoutMs <= 0) {
-					options.onIdle?.();
-					closeIterator();
-					throw new AIError.StreamTimeoutError(options.errorMessage);
+					if (!hasPendingLocalWork()) {
+						options.onIdle?.();
+						closeIterator();
+						throw new AIError.StreamTimeoutError(options.errorMessage);
+					}
+					extendDeadlineForLocalWork();
+					activeTimeoutMs = options.idleTimeoutMs;
 				}
 			}
 
-			const nextResultPromise = withRacy(iterator.next());
+			pendingNext ??= withRacy(iterator.next());
 
 			const racers: Array<
 				Promise<
@@ -314,7 +360,7 @@ export async function* iterateWithIdleTimeout<T>(
 					| { kind: "timeout" }
 					| { kind: "abort" }
 				>
-			> = [nextResultPromise];
+			> = [pendingNext];
 
 			const enforceTimeout = !noTimeoutEnforced && activeTimeoutMs !== undefined && activeTimeoutMs > 0;
 			if (enforceTimeout) {
@@ -333,11 +379,21 @@ export async function* iterateWithIdleTimeout<T>(
 			let continuing = false;
 			try {
 				const outcome = await Promise.race(racers);
+				if (outcome.kind === "next" || outcome.kind === "error") {
+					pendingNext = undefined;
+				}
 				if (outcome.kind === "abort") {
 					closeIterator();
 					throw abortReason(abortSignal!);
 				}
 				if (outcome.kind === "timeout") {
+					if (hasPendingLocalWork()) {
+						// A local tool is still running; the provider cannot make
+						// progress until we hand its result back. Keep waiting.
+						extendDeadlineForLocalWork();
+						continuing = true;
+						continue;
+					}
 					if (!awaitingFirstItem) {
 						options.onIdle?.();
 					} else {