@oh-my-pi/pi-ai 16.3.4 → 16.3.6

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## [Unreleased]
 
+## [16.3.6] - 2026-07-04
+
+### Added
+
+- Persisted credential rate-limit blocks across processes: `auth_credential_blocks` (auth schema v5) stores per-credential blocks keyed by row id + provider key + block scope with MAX-upsert semantics, `AuthStorage` merges persisted and in-memory blocks on read, and auth-broker snapshots/SSE carry per-entry blocks with `POST /v1/credential/:id/block` and `DELETE /v1/credential/:id/blocks` endpoints so gateway and sibling omp processes stop re-discovering exhausted accounts by burning a 429 each.
+
+### Fixed
+
+- Fixed Anthropic credential selection sampling Fable/Mythos-exhausted accounts on every new session: a Fable/Mythos weekly cap now proactively hard-blocks the credential when confirmed exhausted (server `exhausted` status or used fraction >= 1) with a live `resetsAt`, and a live Fable 429 extends the reactive block to the confirmed tier reset instead of the 60s default. Unconfirmed rows (missing/expired reset, below cap) remain ranking hints only, preserving the false-100% guard.
+- Fixed Ollama/Ollama Cloud tool requests failing with HTTP 400 by rewriting boolean subschemas (`true`/`false`) into a value-widening `anyOf` union of primitive types, stripping boolean `additionalProperties`/`unevaluatedProperties`, and flattening nullable `type` arrays before serializing tool parameters, so unconstrained fields still advertise "any JSON value" to grammar-constrained samplers (llama.cpp) instead of collapsing to an empty object. ([#4488](https://github.com/can1357/oh-my-pi/issues/4488))
+
+## [16.3.5] - 2026-07-04
+
+### Added
+
+- `OAuthCallbackFlow` now serves a `GET /launch` route on its loopback callback server that 302-redirects to the pending authorization URL, and exposes that short URL as `OAuthAuthInfo.launchUrl`. UIs can advertise it as a truncation-safe copy target (~30 chars) instead of the full authorize URL, so terminals narrower than the composed row cannot silently drop OAuth query parameters like `code_challenge_method=S256` ([#4418](https://github.com/can1357/oh-my-pi/issues/4418)).
+- Preserved explicit `tool.strict === false` on OpenAI-family function tool payloads (openai-responses, openai-codex-responses, openai-completions) so backends that distinguish `strict: false` from an omitted flag stop over-filling optional arguments ([#4336](https://github.com/can1357/oh-my-pi/issues/4336)).
+
+### Fixed
+
+- Fixed tool-call validation to strip stray trailing line terminators on schema-matching enum values and on well-known identifier fields (`path`, `paths`, `file`, `file_path`, `url`, `uri`, `title`, `label`) before dispatch, keeping ordinary trailing spaces and content-carrying fields (`content`, `input`, `code`, `command`, etc.) intact ([#4461](https://github.com/can1357/oh-my-pi/issues/4461)).
+
 ## [16.3.4] - 2026-07-03
 
 ### Added

package/dist/types/auth-broker/client.d.ts

@@ -1,5 +1,5 @@
 import type { AuthCredential } from "../auth-storage";
-import type { CredentialDisableResponse, CredentialRefreshResponse, CredentialUploadResponse, HealthzResponse, SnapshotResponse, SnapshotStreamEvent, UsageResponse } from "./types";
+import type { CredentialBlockRequest, CredentialBlockResponse, CredentialBlocksDeleteResponse, CredentialDisableResponse, CredentialRefreshResponse, CredentialUploadResponse, HealthzResponse, SnapshotResponse, SnapshotStreamEvent, UsageResponse } from "./types";
 export interface AuthBrokerClientOptions {
     /** Base URL (e.g. `https://broker.tailnet:8765`). Trailing slashes are trimmed. */
     url: string;
@@ -63,4 +63,6 @@ export declare class AuthBrokerClient {
     refreshCredential(id: number, signal?: AbortSignal): Promise<CredentialRefreshResponse>;
     disableCredential(id: number, cause: string, signal?: AbortSignal): Promise<CredentialDisableResponse>;
     uploadCredential(provider: string, credential: AuthCredential, signal?: AbortSignal): Promise<CredentialUploadResponse>;
+    upsertCredentialBlock(id: number, block: CredentialBlockRequest, signal?: AbortSignal): Promise<CredentialBlockResponse>;
+    deleteCredentialBlocks(id: number, signal?: AbortSignal): Promise<CredentialBlocksDeleteResponse>;
 }

package/dist/types/auth-broker/remote-store.d.ts

@@ -1,4 +1,4 @@
-import { type AuthCredential, type AuthCredentialStore, type OAuthCredential, type StoredAuthCredential } from "../auth-storage";
+import { type AuthCredential, type AuthCredentialStore, type OAuthCredential, type StoredAuthCredential, type StoredCredentialBlock } from "../auth-storage";
 import type { OAuthCredentials } from "../registry/oauth/types";
 import type { Provider } from "../types";
 import type { UsageReport } from "../usage";
@@ -30,6 +30,11 @@ export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
     /** Re-hydrate the in-memory snapshot from the broker. */
     refreshSnapshot(): Promise<SnapshotResponse>;
     listAuthCredentials(provider?: string): StoredAuthCredential[];
+    getCredentialBlock(credentialId: number, providerKey: string, blockScope: string): number | undefined;
+    listCredentialBlocks(credentialIds: readonly number[]): StoredCredentialBlock[];
+    upsertCredentialBlock(block: StoredCredentialBlock): void;
+    deleteCredentialBlocks(credentialId: number): void;
+    cleanExpiredCredentialBlocks(nowMs: number): void;
     /**
      * In-memory update from a successful refresh through the broker. AuthStorage
      * calls this after `#replaceCredentialAt`; the broker already persisted the

package/dist/types/auth-broker/types.d.ts

@@ -5,7 +5,7 @@
  * clients use `access` tokens directly and call back to the broker when a
  * credential expires or a 401 surfaces on a supposedly-fresh credential.
  */
-import type { AuthCredential, AuthCredentialSnapshot, AuthCredentialSnapshotEntry } from "../auth-storage";
+import type { AuthCredential, AuthCredentialSnapshot, AuthCredentialSnapshotEntry, StoredCredentialBlock } from "../auth-storage";
 import type { UsageReport } from "../usage";
 /** GET /v1/healthz response body. */
 export interface HealthzResponse {
@@ -18,8 +18,10 @@ export interface RefresherSchedule {
     skewMs: number;
     nextSweepInMs: number;
 }
+export type CredentialBlockSnapshot = Omit<StoredCredentialBlock, "credentialId">;
 export type SnapshotEntry = AuthCredentialSnapshotEntry & {
     rotatesInMs: number | null;
+    blocks?: CredentialBlockSnapshot[];
 };
 /** GET /v1/snapshot response body. */
 export interface SnapshotResponse extends Omit<AuthCredentialSnapshot, "credentials"> {
@@ -44,6 +46,16 @@ export interface CredentialDisableRequest {
 export interface CredentialDisableResponse {
     ok: boolean;
 }
+/** POST /v1/credential/:id/block request body. */
+export type CredentialBlockRequest = CredentialBlockSnapshot;
+/** POST /v1/credential/:id/block response body. */
+export interface CredentialBlockResponse {
+    ok: boolean;
+}
+/** DELETE /v1/credential/:id/blocks response body. */
+export interface CredentialBlocksDeleteResponse {
+    ok: boolean;
+}
 /**
  * POST /v1/credential request body. The OAuth `refresh` must be the *real*
  * refresh token (not the sentinel) — the broker is the canonical writer.

package/dist/types/auth-broker/wire-schemas.d.ts

@@ -75,6 +75,11 @@ export declare const credentialSnapshotEntrySchema: import("arktype/internal/var
     };
     identityKey: string | null;
 }, {}>;
+export declare const credentialBlockSnapshotSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    providerKey: string;
+    blockScope: string;
+    blockedUntilMs: number;
+}, {}>;
 export declare const snapshotEntrySchema: import("arktype/internal/variants/object.ts").ObjectType<{
     id: number;
     provider: string;
@@ -94,6 +99,11 @@ export declare const snapshotEntrySchema: import("arktype/internal/variants/obje
     };
     identityKey: string | null;
     rotatesInMs: number | null;
+    blocks?: {
+        providerKey: string;
+        blockScope: string;
+        blockedUntilMs: number;
+    }[] | undefined;
 }, {}>;
 export declare const refresherScheduleSchema: import("arktype/internal/variants/object.ts").ObjectType<{
     enabled: boolean;
@@ -130,6 +140,11 @@ export declare const snapshotResponseSchema: import("arktype/internal/variants/o
         };
         identityKey: string | null;
         rotatesInMs: number | null;
+        blocks?: {
+            providerKey: string;
+            blockScope: string;
+            blockedUntilMs: number;
+        }[] | undefined;
     }[];
 }, {}>;
 /** First frame on connect — full snapshot embedded inline with a `kind` tag. */
@@ -162,6 +177,11 @@ export declare const snapshotStreamSnapshotEventSchema: import("arktype/internal
         };
         identityKey: string | null;
         rotatesInMs: number | null;
+        blocks?: {
+            providerKey: string;
+            blockScope: string;
+            blockedUntilMs: number;
+        }[] | undefined;
     }[];
     kind: "snapshot";
 }, {}>;
@@ -195,6 +215,11 @@ export declare const snapshotStreamEntryEventSchema: import("arktype/internal/va
         };
         identityKey: string | null;
         rotatesInMs: number | null;
+        blocks?: {
+            providerKey: string;
+            blockScope: string;
+            blockedUntilMs: number;
+        }[] | undefined;
     };
 }, {}>;
 /** Per-credential delete delta. */
@@ -240,6 +265,11 @@ export declare const snapshotStreamEventSchema: import("arktype/internal/variant
         };
         identityKey: string | null;
         rotatesInMs: number | null;
+        blocks?: {
+            providerKey: string;
+            blockScope: string;
+            blockedUntilMs: number;
+        }[] | undefined;
     }[];
     kind: "snapshot";
 } | {
@@ -271,6 +301,11 @@ export declare const snapshotStreamEventSchema: import("arktype/internal/variant
         };
         identityKey: string | null;
         rotatesInMs: number | null;
+        blocks?: {
+            providerKey: string;
+            blockScope: string;
+            blockedUntilMs: number;
+        }[] | undefined;
     };
 } | {
     kind: "removed";
@@ -371,6 +406,17 @@ export declare const credentialDisableRequestSchema: import("arktype/internal/va
 export declare const credentialDisableResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
     ok: boolean;
 }, {}>;
+export declare const credentialBlockRequestSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    providerKey: string;
+    blockScope: string;
+    blockedUntilMs: number;
+}, {}>;
+export declare const credentialBlockResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    ok: boolean;
+}, {}>;
+export declare const credentialBlocksDeleteResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    ok: boolean;
+}, {}>;
 export declare const credentialUploadRequestSchema: import("arktype/internal/variants/object.ts").ObjectType<{
     provider: string;
     credential: {

package/dist/types/auth-storage.d.ts

@@ -9,7 +9,7 @@
  */
 import { Database } from "bun:sqlite";
 import type { ApiKeyResolver } from "./auth-retry";
-import type { OAuthController, OAuthCredentials, OAuthProviderId } from "./registry/oauth/types";
+import type { OAuthAuthInfo, OAuthController, OAuthCredentials, OAuthProviderId } from "./registry/oauth/types";
 import type { Provider } from "./types";
 import type { CredentialRankingStrategy, UsageCostHistoryEntry, UsageCostHistoryQuery, UsageHistoryEntry, UsageHistoryQuery, UsageLogger, UsageProvider, UsageReport } from "./usage";
 import { type CodexResetConsumeCode, type CodexResetCredit } from "./usage/openai-codex-reset";
@@ -61,6 +61,17 @@ export interface StoredAuthCredential {
     credential: AuthCredential;
     disabledCause: string | null;
 }
+/** One persisted rate-limit block: credential row id + provider-type key + optional scope. */
+export interface StoredCredentialBlock {
+    /** SQLite row id of the credential (auth_credentials.id). */
+    credentialId: number;
+    /** `${provider}:${credentialType}` — same value as AuthStorage's in-memory providerKey. */
+    providerKey: string;
+    /** Block scope (e.g. "tier:fable"); empty string = unscoped. Never NUL-delimited. */
+    blockScope: string;
+    /** Epoch milliseconds. */
+    blockedUntilMs: number;
+}
 /**
  * Per-credential health record returned by {@link AuthStorage.checkCredentials}.
  *
@@ -227,6 +238,16 @@ export interface AuthCredentialStore {
     }): string | null;
     setCache(key: string, value: string, expiresAtSec: number): void;
     cleanExpiredCache(): void;
+    /** Non-expired block for one (credential, providerKey, scope) key, or undefined. */
+    getCredentialBlock?(credentialId: number, providerKey: string, blockScope: string): number | undefined;
+    /** Upsert with MAX semantics: keep the later blockedUntilMs on conflict. */
+    upsertCredentialBlock?(block: StoredCredentialBlock): void;
+    /** Drop every block row for a credential (all providerKeys/scopes). */
+    deleteCredentialBlocks?(credentialId: number): void;
+    /** Prune rows with blocked_until_ms <= nowMs. */
+    cleanExpiredCredentialBlocks?(nowMs: number): void;
+    /** List non-expired blocks for broker snapshots. */
+    listCredentialBlocks?(credentialIds: readonly number[]): StoredCredentialBlock[];
     /**
      * Append usage-limit snapshots for trend history. Optional: stores without
      * durable storage (e.g. the broker remote store) omit it and recording is
@@ -694,10 +715,7 @@ export declare class AuthStorage {
      */
     login(provider: OAuthProviderId, ctrl: OAuthController & {
         /** onAuth is required by auth-storage but optional in OAuthController */
-        onAuth: (info: {
-            url: string;
-            instructions?: string;
-        }) => void;
+        onAuth: (info: OAuthAuthInfo) => void;
         /** onPrompt is required for some providers (github-copilot, openai-codex) */
         onPrompt: (prompt: {
             message: string;
@@ -949,6 +967,18 @@ export declare class AuthStorage {
      * the existing row instead of inserting a duplicate.
      */
     upsertCredential(provider: string, credential: AuthCredential): AuthCredentialSnapshotEntry[];
+    /**
+     * Broker-server seam: list non-expired persisted blocks for snapshot entries.
+     */
+    listCredentialBlocks(credentialIds: readonly number[]): StoredCredentialBlock[];
+    /**
+     * Broker-server seam: persist one credential block and notify snapshot waiters.
+     */
+    upsertCredentialBlock(block: StoredCredentialBlock): void;
+    /**
+     * Broker-server seam: clear all persisted blocks for one credential and notify snapshot waiters.
+     */
+    deleteCredentialBlocks(credentialId: number): void;
     /**
      * Describe where the active credential for a provider came from.
      *
@@ -1000,6 +1030,11 @@ export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
     }): string | null;
     setCache(key: string, value: string, expiresAtSec: number): void;
     cleanExpiredCache(): void;
+    getCredentialBlock(credentialId: number, providerKey: string, blockScope: string): number | undefined;
+    upsertCredentialBlock(block: StoredCredentialBlock): void;
+    deleteCredentialBlocks(credentialId: number): void;
+    cleanExpiredCredentialBlocks(nowMs: number): void;
+    listCredentialBlocks(credentialIds: readonly number[]): StoredCredentialBlock[];
     recordUsageSnapshots(entries: UsageHistoryEntry[]): void;
     listUsageHistory(query?: UsageHistoryQuery): UsageHistoryEntry[];
     recordUsageCosts(entries: UsageCostHistoryEntry[]): void;

package/dist/types/registry/oauth/types.d.ts

@@ -18,7 +18,21 @@ export type OAuthPrompt = {
     allowEmpty?: boolean;
 };
 export type OAuthAuthInfo = {
+    /**
+     * Full authorization URL. Suitable for direct browser launch, OSC 8
+     * hyperlinks, and clipboard when the target UI can guarantee the full
+     * string reaches the user unmodified.
+     */
     url: string;
+    /**
+     * Short loopback URL that 302-redirects to {@link url}. Provided by flows
+     * that host the redirect on the same callback server they already run
+     * ({@link OAuthCallbackFlow}). UIs SHOULD prefer this as the copy target
+     * so viewport truncation cannot corrupt OAuth query parameters. Undefined
+     * for flows without a loopback callback server (device code, paste-code
+     * providers with fixed non-loopback redirects, etc.).
+     */
+    launchUrl?: string;
     instructions?: string;
 };
 export interface OAuthProviderInfo {

package/dist/types/types.d.ts

@@ -493,6 +493,21 @@ export interface DeveloperMessage {
     providerPayload?: ProviderPayload;
     timestamp: number;
 }
+export type AssistantRetryRecoveryKind = "credential" | "model" | "wait" | "plain";
+export interface AssistantRetryRecovery {
+    kind: "auto-retry";
+    status: "recovered";
+    attempt: number;
+    recoveredAt: string;
+    recovery: AssistantRetryRecoveryKind;
+    note: string;
+    supersededBy?: {
+        timestamp: number;
+        responseId?: string;
+        provider: string;
+        model: string;
+    };
+}
 export interface ContextSnapshot {
     promptTokens: number;
     nonMessageTokens: number;
@@ -505,6 +520,7 @@ export interface AssistantMessage {
     provider: Provider;
     model: string;
     contextSnapshot?: ContextSnapshot;
+    retryRecovery?: AssistantRetryRecovery;
     responseId?: string;
     /**
      * Name of the upstream provider an aggregator routed this request to, as

package/dist/types/utils/schema/normalize.d.ts

@@ -66,6 +66,11 @@ export declare function normalizeSchemaForMCP(value: unknown): unknown;
  * and the depth-10 limit.
  */
 export declare function normalizeSchemaForMoonshot(value: unknown): unknown;
+/**
+ * Rewrites standard JSON Schema forms that Ollama's Go `/api/chat` tool parser
+ * cannot unmarshal into its object-shaped `Schema` struct.
+ */
+export declare function sanitizeSchemaForOllama(schema: JsonObject): JsonObject;
 /**
  * OpenAI Responses rejects `oneOf` in tool schemas even when strict mode is
  * disabled, and rejects every schema node with `type: "object"` unless it has

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "16.3.4",
+	"version": "16.3.6",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.0",
-		"@oh-my-pi/pi-catalog": "16.3.4",
-		"@oh-my-pi/pi-utils": "16.3.4",
-		"@oh-my-pi/pi-wire": "16.3.4",
+		"@oh-my-pi/pi-catalog": "16.3.6",
+		"@oh-my-pi/pi-utils": "16.3.6",
+		"@oh-my-pi/pi-wire": "16.3.6",
 		"arktype": "^2.2.0",
 		"zod": "^4"
 	},

package/src/auth-broker/client.ts

@@ -9,6 +9,9 @@ import { readSseEvents } from "@oh-my-pi/pi-utils";
 import { type } from "arktype";
 import type { AuthCredential } from "../auth-storage";
 import type {
+	CredentialBlockRequest,
+	CredentialBlockResponse,
+	CredentialBlocksDeleteResponse,
 	CredentialDisableRequest,
 	CredentialDisableResponse,
 	CredentialRefreshResponse,
@@ -20,6 +23,8 @@ import type {
 	UsageResponse,
 } from "./types";
 import {
+	credentialBlockResponseSchema,
+	credentialBlocksDeleteResponseSchema,
 	credentialDisableResponseSchema,
 	credentialRefreshResponseSchema,
 	credentialUploadResponseSchema,
@@ -106,7 +111,11 @@ export class AuthBrokerClient {
 	}
 
 	healthz(signal?: AbortSignal): Promise<HealthzResponse> {
-		return this.#request("GET", "/v1/healthz", { schema: healthzResponseSchema, auth: false, signal });
+		return this.#request<HealthzResponse>("GET", "/v1/healthz", {
+			schema: healthzResponseSchema,
+			auth: false,
+			signal,
+		});
 	}
 
 	async fetchSnapshot(opts: FetchSnapshotOptions = {}): Promise<FetchSnapshotResult> {
@@ -230,19 +239,19 @@ export class AuthBrokerClient {
 		// `metadata`) but leaves provider-specific extension fields permissive so
 		// the broker can ship new shapes ahead of the client. `raw` is accepted
 		// but normally stripped by the broker before send.
-		return this.#request("GET", "/v1/usage", { schema: usageResponseSchema, signal }) as Promise<UsageResponse>;
+		return this.#request<UsageResponse>("GET", "/v1/usage", { schema: usageResponseSchema, signal });
 	}
 
 	async refreshCredential(id: number, signal?: AbortSignal): Promise<CredentialRefreshResponse> {
-		return this.#request("POST", `/v1/credential/${id}/refresh`, {
+		return this.#request<CredentialRefreshResponse>("POST", `/v1/credential/${id}/refresh`, {
 			schema: credentialRefreshResponseSchema,
 			signal,
-		}) as Promise<CredentialRefreshResponse>;
+		});
 	}
 
 	async disableCredential(id: number, cause: string, signal?: AbortSignal): Promise<CredentialDisableResponse> {
 		const body: CredentialDisableRequest = { cause };
-		return this.#request("POST", `/v1/credential/${id}/disable`, {
+		return this.#request<CredentialDisableResponse>("POST", `/v1/credential/${id}/disable`, {
 			body,
 			schema: credentialDisableResponseSchema,
 			signal,
@@ -255,18 +264,38 @@ export class AuthBrokerClient {
 		signal?: AbortSignal,
 	): Promise<CredentialUploadResponse> {
 		const body: CredentialUploadRequest = { provider, credential };
-		return this.#request("POST", "/v1/credential", {
+		return this.#request<CredentialUploadResponse>("POST", "/v1/credential", {
 			body,
 			schema: credentialUploadResponseSchema,
 			signal,
-		}) as Promise<CredentialUploadResponse>;
+		});
+	}
+
+	async upsertCredentialBlock(
+		id: number,
+		block: CredentialBlockRequest,
+		signal?: AbortSignal,
+	): Promise<CredentialBlockResponse> {
+		const body: CredentialBlockRequest = block;
+		return this.#request<CredentialBlockResponse>("POST", `/v1/credential/${id}/block`, {
+			body,
+			schema: credentialBlockResponseSchema,
+			signal,
+		});
+	}
+
+	async deleteCredentialBlocks(id: number, signal?: AbortSignal): Promise<CredentialBlocksDeleteResponse> {
+		return this.#request<CredentialBlocksDeleteResponse>("DELETE", `/v1/credential/${id}/blocks`, {
+			schema: credentialBlocksDeleteResponseSchema,
+			signal,
+		});
 	}
 
-	async #request(
-		method: "GET" | "POST",
+	async #request<t>(
+		method: "GET" | "POST" | "DELETE",
 		path: string,
 		opts: { schema: (input: unknown) => unknown; auth?: boolean; body?: unknown; signal?: AbortSignal },
-	): Promise<any> {
+	): Promise<t> {
 		const response = await this.#fetchRaw(method, path, opts);
 		const text = await response.text();
 		const raw = this.#parseJson(text, response.status);
@@ -277,7 +306,7 @@ export class AuthBrokerClient {
 				body: validated.summary,
 			});
 		}
-		return validated;
+		return validated as t;
 	}
 
 	#parseJson(text: string, status: number): unknown {
@@ -293,7 +322,7 @@ export class AuthBrokerClient {
 	}
 
 	async #fetchRaw(
-		method: "GET" | "POST",
+		method: "GET" | "POST" | "DELETE",
 		path: string,
 		opts: {
 			auth?: boolean;