@oh-my-pi/pi-ai 16.3.14 → 16.4.0

package/dist/types/registry/oauth/xai-oauth.d.ts

@@ -1,14 +1,11 @@
 import type { FetchImpl } from "../../types.js";
-import { OAuthCallbackFlow } from "./callback-server.js";
 import type { OAuthController, OAuthCredentials } from "./types.js";
 /**
- * Validate an xAI OIDC discovery endpoint against scheme + host.
+ * Validate an xAI OIDC endpoint against its scheme and host.
  *
- * Hermes `_xai_validate_oauth_endpoint` L2997-3035. The discovery response is
- * long-lived and cached in {@link OAuthCredentials}; a single MITM during
- * initial login could substitute a malicious `token_endpoint` that would then
- * receive every future refresh_token. Rejecting non-HTTPS or non-`x.ai` /
- * `*.x.ai` hosts pins the cached endpoint to the xAI auth origin.
+ * The discovery response is long-lived and its token endpoint receives every
+ * future refresh token. Rejecting non-HTTPS or non-`x.ai` / `*.x.ai` hosts
+ * pins that endpoint to the xAI auth origin.
  *
  * @throws Error with message `Invalid xAI <field>: <url>` when the URL fails
  *         either scheme or host validation.
@@ -18,29 +15,16 @@ export declare function validateXAIEndpoint(url: string, field: string): string;
  * Check whether a JWT access token is at or past its `exp` claim (with an
  * optional refresh-skew margin).
  *
- * Hermes `_xai_access_token_is_expiring` L2979-2994. Returns `false` for any
- * malformed input — this is a refresh-trigger check, not a validation, so
- * non-JWTs ("no token in cache") must NOT trigger a spurious refresh.
+ * Returns `false` for malformed input because this is a refresh-trigger check,
+ * not token validation.
  */
 export declare function isXAIAccessTokenExpiring(jwt: string, skewSeconds?: number): boolean;
-/**
- * xAI Grok OAuth code flow (Hermes `_xai_oauth_loopback_login` L5315-5469).
- */
-export declare class XAIOAuthFlow extends OAuthCallbackFlow {
-    #private;
-    constructor(ctrl: OAuthController);
-    generateAuthUrl(state: string, redirectUri: string): Promise<{
-        url: string;
-        instructions?: string;
-    }>;
-    exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials>;
-}
+/** Log in to xAI Grok with the RFC 8628 device authorization grant. */
 export declare function loginXAIOAuth(ctrl: OAuthController): Promise<OAuthCredentials>;
 /**
  * Refresh an xAI OAuth access token using a stored refresh_token.
  *
- * Hermes `refresh_xai_oauth_pure` L3087-3160. Re-runs OIDC discovery and
- * re-validates the cached `token_endpoint` on the refresh hot path so a
- * cached-but-poisoned endpoint cannot silently leak a refresh_token.
+ * Re-runs OIDC discovery and re-validates the token endpoint before sending
+ * the stored refresh token.
  */
 export declare function refreshXAIOAuthToken(refreshToken: string, fetchOverride?: FetchImpl): Promise<OAuthCredentials>;

package/dist/types/registry/registry.d.ts

@@ -165,6 +165,10 @@ declare const ALL: ({
     readonly id: "nanogpt";
     readonly name: "NanoGPT";
     readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
+} | {
+    id: "novita";
+    name: string;
+    login: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
 } | {
     readonly id: "nvidia";
     readonly name: "NVIDIA";
@@ -268,7 +272,6 @@ declare const ALL: ({
     readonly name: "xAI Grok OAuth (SuperGrok or X Premium+)";
     readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<import("./oauth/index.js").OAuthCredentials>;
     readonly refreshToken: (credentials: import("./oauth/index.js").OAuthCredentials) => Promise<import("./oauth/index.js").OAuthCredentials>;
-    readonly pasteCodeFlow: true;
 } | {
     readonly id: "xiaomi";
     readonly name: "Xiaomi MiMo";

package/dist/types/registry/xai-oauth.d.ts

@@ -4,5 +4,4 @@ export declare const xaiOauthProvider: {
     readonly name: "xAI Grok OAuth (SuperGrok or X Premium+)";
     readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
     readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
-    readonly pasteCodeFlow: true;
 };

package/dist/types/types.d.ts

@@ -166,6 +166,27 @@ export interface RawSseEvent {
     data: string;
     raw: string[];
 }
+/** Lifecycle fields shared by every Codex compaction implementation. */
+export interface CodexCompactionContext {
+    /** Stable only for one logical compaction, including parallel summary calls. */
+    operationId: string;
+    trigger: "manual" | "auto";
+    reason: "user_requested" | "context_limit" | "model_downshift" | "comp_hash_changed";
+    phase: "standalone_turn" | "pre_turn" | "mid_turn";
+    strategy: "memento" | "prefix_compaction";
+}
+/** Canonical nested metadata serialized into the Codex turn envelope. */
+export interface CodexCompactionMetadata {
+    trigger: "manual" | "auto";
+    reason: "user_requested" | "context_limit" | "model_downshift" | "comp_hash_changed";
+    implementation: "responses" | "responses_compaction_v2" | "responses_compact";
+    phase: "standalone_turn" | "pre_turn" | "mid_turn";
+    strategy: "memento" | "prefix_compaction";
+}
+/** Dispatch context combining canonical metadata with its local operation identity. */
+export interface CodexCompactionRequestContext extends CodexCompactionMetadata {
+    operationId: string;
+}
 export interface StreamOptions {
     temperature?: number;
     topP?: number;
@@ -231,9 +252,9 @@ export interface StreamOptions {
      */
     sessionId?: string;
     /**
-     * Optional prompt-cache identity. When set, OpenAI Responses-compatible
-     * providers use this for `prompt_cache_key` while keeping `sessionId` for
-     * provider routing / conversation headers.
+     * Optional prompt-cache identity. OpenAI-family providers use this for
+     * `prompt_cache_key` payloads and cache-affinity headers such as
+     * `x-grok-conv-id`; when omitted, they fall back to `sessionId`.
      */
     promptCacheKey?: string;
     /**
@@ -241,6 +262,8 @@ export interface StreamOptions {
      * Providers can use this to persist transport/session state between turns.
      */
     providerSessionState?: Map<string, ProviderSessionState>;
+    /** Canonical Codex compaction classification; ignored by other providers. */
+    codexCompaction?: CodexCompactionRequestContext;
     /**
      * Force Gemini model-mode Interactions API transport for providers that support it.
      * When unset, those providers may still use Interactions to continue known

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "16.3.14",
+	"version": "16.4.0",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.0",
-		"@oh-my-pi/pi-catalog": "16.3.14",
-		"@oh-my-pi/pi-utils": "16.3.14",
-		"@oh-my-pi/pi-wire": "16.3.14",
+		"@oh-my-pi/pi-catalog": "16.4.0",
+		"@oh-my-pi/pi-utils": "16.4.0",
+		"@oh-my-pi/pi-wire": "16.4.0",
 		"arktype": "^2.2.0",
 		"zod": "^4"
 	},

package/src/auth-broker/remote-store.ts

@@ -39,6 +39,7 @@ import type {
  * one broker call instead of N.
  */
 const USAGE_CACHE_TTL_MS = 15_000;
+const CREDENTIAL_BLOCK_RECONCILE_DELAY_MS = 5 * 60_000;
 const WAIT_THRESHOLD_MS = 1_000;
 const MAX_WAIT_MS = 5_000;
 const BACKGROUND_WAIT_MS = 30_000;
@@ -50,7 +51,9 @@ function compareCredentialBlockSnapshots(a: CredentialBlockSnapshot, b: Credenti
 	if (provider !== 0) return provider;
 	const scope = a.blockScope.localeCompare(b.blockScope);
 	if (scope !== 0) return scope;
-	return a.blockedUntilMs - b.blockedUntilMs;
+	const blockedUntil = a.blockedUntilMs - b.blockedUntilMs;
+	if (blockedUntil !== 0) return blockedUntil;
+	return (a.updatedAtMs ?? 0) - (b.updatedAtMs ?? 0);
 }
 
 function toCredentialBlockSnapshot(block: StoredCredentialBlock): CredentialBlockSnapshot {
@@ -58,6 +61,7 @@ function toCredentialBlockSnapshot(block: StoredCredentialBlock): CredentialBloc
 		providerKey: block.providerKey,
 		blockScope: block.blockScope,
 		blockedUntilMs: block.blockedUntilMs,
+		...(block.updatedAtMs !== undefined ? { updatedAtMs: block.updatedAtMs } : {}),
 	};
 }
 
@@ -74,7 +78,8 @@ function credentialBlockSnapshotsEqual(
 		if (
 			leftBlock.providerKey !== rightBlock.providerKey ||
 			leftBlock.blockScope !== rightBlock.blockScope ||
-			leftBlock.blockedUntilMs !== rightBlock.blockedUntilMs
+			leftBlock.blockedUntilMs !== rightBlock.blockedUntilMs ||
+			leftBlock.updatedAtMs !== rightBlock.updatedAtMs
 		) {
 			return false;
 		}
@@ -208,6 +213,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 	#cache: Map<string, CacheEntry> = new Map();
 	#usageCache?: UsageCacheEntry;
 	#usageInflight?: Promise<UsageReport[] | null>;
+	#credentialBlockReconcileAfter: Map<string, number> = new Map();
 	#usageCacheEpoch = 0;
 	#closed = false;
 	/**
@@ -236,10 +242,12 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		return this.#snapshot;
 	}
 
-	#applySnapshot(snapshot: SnapshotResponse, generation: number): void {
+	#applySnapshot(snapshot: SnapshotResponse, generation: number, protectNewBlocks = true): void {
 		const nowMs = Date.now();
+		const previousCredentials = this.#snapshot.credentials;
 		const credentials = snapshot.credentials.map(entry => this.#normalizeSnapshotEntryBlocks(entry, nowMs));
-		if (snapshotBlocksChanged(this.#snapshot.credentials, credentials)) this.#invalidateUsageCache();
+		if (snapshotBlocksChanged(previousCredentials, credentials)) this.#invalidateUsageCache();
+		if (protectNewBlocks) this.#protectNewSnapshotBlocks(previousCredentials, credentials, nowMs);
 		this.#snapshot = { ...snapshot, credentials };
 		this.#generation = generation;
 		this.#snapshotReceivedAt = nowMs;
@@ -251,6 +259,34 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 			logger.debug("auth-broker snapshot callback failed", { error: String(error) });
 		}
 	}
+	#protectNewSnapshotBlocks(previous: readonly SnapshotEntry[], next: readonly SnapshotEntry[], nowMs: number): void {
+		const previousBlocksByKey = new Map<string, string>();
+		for (const entry of previous) {
+			for (const block of entry.blocks ?? []) {
+				previousBlocksByKey.set(
+					`${entry.id}\0${block.providerKey}\0${block.blockScope}`,
+					`${block.blockedUntilMs}\0${block.updatedAtMs ?? ""}`,
+				);
+			}
+		}
+		const activeKeys = new Set<string>();
+		for (const entry of next) {
+			for (const block of entry.blocks ?? []) {
+				const key = `${entry.id}\0${block.providerKey}\0${block.blockScope}`;
+				activeKeys.add(key);
+				const signature = `${block.blockedUntilMs}\0${block.updatedAtMs ?? ""}`;
+				if (previousBlocksByKey.get(key) === signature) continue;
+				const updatedAtMs = block.updatedAtMs ?? nowMs;
+				this.#credentialBlockReconcileAfter.set(
+					key,
+					Math.min(block.blockedUntilMs, updatedAtMs + CREDENTIAL_BLOCK_RECONCILE_DELAY_MS),
+				);
+			}
+		}
+		for (const key of this.#credentialBlockReconcileAfter.keys()) {
+			if (!activeKeys.has(key)) this.#credentialBlockReconcileAfter.delete(key);
+		}
+	}
 
 	async #runBackground(): Promise<void> {
 		let backoffMs = BACKGROUND_BACKOFF_INITIAL_MS;
@@ -340,11 +376,13 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		const incoming = this.#normalizeSnapshotEntryBlocks(entry, Date.now());
 		const index = this.#snapshot.credentials.findIndex(candidate => candidate.id === incoming.id);
 		const previousBlocks = index === -1 ? undefined : this.#snapshot.credentials[index]?.blocks;
-		if (!credentialBlockSnapshotsEqual(previousBlocks, incoming.blocks)) this.#invalidateUsageCache();
+		const blocksChanged = !credentialBlockSnapshotsEqual(previousBlocks, incoming.blocks);
+		if (blocksChanged) this.#invalidateUsageCache();
 		const credentials =
 			index === -1
 				? [...this.#snapshot.credentials, incoming]
 				: this.#snapshot.credentials.map((candidate, i) => (i === index ? incoming : candidate));
+		if (blocksChanged) this.#protectNewSnapshotBlocks(this.#snapshot.credentials, credentials, Date.now());
 		this.#snapshot = { ...this.#snapshot, generation, serverNowMs, refresher, credentials };
 		this.#generation = generation;
 		this.#snapshotReceivedAt = Date.now();
@@ -392,6 +430,11 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		return block.blockedUntilMs;
 	}
 
+	getCredentialBlockReconcileAfter(credentialId: number, providerKey: string, blockScope: string): number | undefined {
+		if (this.getCredentialBlock(credentialId, providerKey, blockScope) === undefined) return undefined;
+		return this.#credentialBlockReconcileAfter.get(`${credentialId}\0${providerKey}\0${blockScope}`);
+	}
+
 	listCredentialBlocks(credentialIds: readonly number[]): StoredCredentialBlock[] {
 		const nowMs = Date.now();
 		this.cleanExpiredCredentialBlocks(nowMs);
@@ -406,6 +449,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 					providerKey: block.providerKey,
 					blockScope: block.blockScope,
 					blockedUntilMs: block.blockedUntilMs,
+					updatedAtMs: block.updatedAtMs,
 				});
 			}
 		}
@@ -416,6 +460,10 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 	upsertCredentialBlock(block: StoredCredentialBlock): void {
 		this.#upsertSnapshotBlock(block);
 		this.#invalidateUsageCache();
+		this.#credentialBlockReconcileAfter.set(
+			`${block.credentialId}\0${block.providerKey}\0${block.blockScope}`,
+			Math.min(block.blockedUntilMs, Date.now() + CREDENTIAL_BLOCK_RECONCILE_DELAY_MS),
+		);
 		const body = toCredentialBlockSnapshot(block);
 		void this.#client
 			.upsertCredentialBlock(block.credentialId, body)
@@ -434,6 +482,9 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 
 	deleteCredentialBlocks(credentialId: number): void {
 		this.#deleteSnapshotBlocks(credentialId);
+		for (const key of this.#credentialBlockReconcileAfter.keys()) {
+			if (key.startsWith(`${credentialId}\0`)) this.#credentialBlockReconcileAfter.delete(key);
+		}
 		this.#invalidateUsageCache();
 		void this.#client
 			.deleteCredentialBlocks(credentialId)
@@ -450,6 +501,9 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 
 	cleanExpiredCredentialBlocks(nowMs: number): void {
 		this.#pruneExpiredCredentialBlocks(nowMs);
+		for (const [key, reconcileAfterMs] of this.#credentialBlockReconcileAfter) {
+			if (reconcileAfterMs <= nowMs) this.#credentialBlockReconcileAfter.delete(key);
+		}
 	}
 
 	/**
@@ -647,6 +701,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 				providerKey: block.providerKey,
 				blockScope: block.blockScope,
 				blockedUntilMs: block.blockedUntilMs,
+				...(block.updatedAtMs !== undefined ? { updatedAtMs: block.updatedAtMs } : {}),
 			}))
 			.sort(compareCredentialBlockSnapshots);
 		if (blocks.length > 0) return { ...entry, blocks };

package/src/auth-broker/server.ts

@@ -290,6 +290,7 @@ function buildCredentialBlockGroups(
 			providerKey: block.providerKey,
 			blockScope: block.blockScope,
 			blockedUntilMs: block.blockedUntilMs,
+			updatedAtMs: block.updatedAtMs,
 		};
 		const existing = byCredentialId.get(block.credentialId);
 		if (existing) {

package/src/auth-broker/wire-schemas.ts

@@ -74,6 +74,7 @@ export const credentialBlockSnapshotSchema = type({
 	providerKey: type("string").atLeastLength(1),
 	blockScope: "string",
 	blockedUntilMs: "number",
+	"updatedAtMs?": "number",
 });
 
 export const snapshotEntrySchema = type({

package/src/auth-gateway/server.ts

@@ -112,8 +112,8 @@ function deriveSessionId(modelId: string, context: Context): string {
 		parts.push(JSON.stringify({ role: first.role, content: first.content }));
 	}
 	const seed = parts.join("\u0000");
-	// The 36-char UUID flows through unchanged: Codex's
-	// `normalizeOpenAIResponsesPromptCacheKey` accepts ≤64 chars verbatim.
+	// The 36-char UUID flows through unchanged:
+	// `normalizeOpenAIPromptCacheKey` accepts ≤64 chars verbatim.
 	return deterministicUuid(seed);
 }