@oh-my-pi/pi-ai 16.3.4 → 16.3.6

package/src/registry/oauth/callback-server.ts

@@ -17,6 +17,14 @@ import type { OAuthController, OAuthCredentials } from "./types";
 const DEFAULT_TIMEOUT = 300_000;
 const DEFAULT_HOSTNAME = "localhost";
 const CALLBACK_PATH = "/callback";
+/**
+ * Path served by {@link OAuthCallbackFlow} that 302-redirects to the pending
+ * authorization URL. Kept out of {@link OAuthCallbackFlowOptions} because it
+ * lives on the loopback callback server alongside {@link CALLBACK_PATH} and
+ * must never clash with a provider-registered redirect URI (all known
+ * providers register `/callback`-shaped paths).
+ */
+const LAUNCH_PATH = "/launch";
 
 export type CallbackResult = { code: string; state: string };
 
@@ -54,6 +62,14 @@ export abstract class OAuthCallbackFlow {
 	allowPortFallback: boolean;
 	#callbackResolve?: (result: CallbackResult) => void;
 	#callbackReject?: (error: string) => void;
+	/**
+	 * Authorization URL the `/launch` route currently redirects to. Set by
+	 * {@link login} after {@link generateAuthUrl} and before {@link OAuthController.onAuth}
+	 * fires, cleared when the server stops. `undefined` before the flow reaches
+	 * that point and after it finishes, so `/launch` returns 503 rather than
+	 * a stale URL.
+	 */
+	#pendingAuthUrl?: string;
 
 	constructor(
 		ctrl: OAuthController,
@@ -120,7 +136,7 @@ export abstract class OAuthCallbackFlow {
 		this.#throwIfCancelled();
 
 		// Start callback server first to get actual redirect URI
-		const { server, redirectUri } = await this.#startCallbackServer(state);
+		const { server, redirectUri, launchUrl } = await this.#startCallbackServer(state);
 
 		try {
 			this.#throwIfCancelled();
@@ -128,8 +144,14 @@ export abstract class OAuthCallbackFlow {
 			const { url: authUrl, instructions } = await this.generateAuthUrl(state, redirectUri);
 			this.#throwIfCancelled();
 
+			// Publish the auth URL to the `/launch` route BEFORE handing it to
+			// callers. `onAuth` immediately renders a UI that advertises the
+			// launch URL as a copy target, so `/launch` must already resolve if
+			// the user clicks/pastes it during the same render pass.
+			this.#pendingAuthUrl = authUrl;
+
 			// Notify controller that auth is ready
-			this.ctrl.onAuth?.({ url: authUrl, instructions });
+			this.ctrl.onAuth?.({ url: authUrl, launchUrl, instructions });
 			this.ctrl.onProgress?.("Waiting for browser authentication...");
 
 			// Wait for callback or manual input
@@ -140,21 +162,33 @@ export abstract class OAuthCallbackFlow {
 
 			return await this.exchangeToken(code, state, redirectUri);
 		} finally {
+			this.#pendingAuthUrl = undefined;
 			server.stop();
 		}
 	}
 
 	/**
 	 * Start callback server, trying preferred port first, falling back to random.
+	 * `launchUrl` is `undefined` when the caller configured `callbackPath` to
+	 * collide with {@link LAUNCH_PATH} — the callback handler resolves the real
+	 * callback in that case, so advertising a self-redirecting URL would be
+	 * incorrect.
 	 */
-	async #startCallbackServer(expectedState: string): Promise<{ server: Bun.Server<unknown>; redirectUri: string }> {
+	async #startCallbackServer(
+		expectedState: string,
+	): Promise<{ server: Bun.Server<unknown>; redirectUri: string; launchUrl: string | undefined }> {
 		try {
 			const server = this.#createServer(this.preferredPort, expectedState);
+			// `preferredPort: 0` opts into a random port — read the actual bound
+			// port from the server so both the redirect URI and launch URL point at
+			// a reachable socket, not the sentinel.
+			const actualPort = this.#resolveServerPort(server);
+			const launchUrl = this.#launchUrlIfSafe(actualPort);
 			if (this.redirectUri) {
-				return { server, redirectUri: this.redirectUri };
+				return { server, redirectUri: this.redirectUri, launchUrl };
 			}
-			const redirectUri = `http://${this.callbackHostname}:${this.preferredPort}${this.callbackPath}`;
-			return { server, redirectUri };
+			const redirectUri = `http://${this.callbackHostname}:${actualPort}${this.callbackPath}`;
+			return { server, redirectUri, launchUrl };
 		} catch (cause) {
 			if (this.redirectUri) {
 				throw new AIError.ConfigurationError(
@@ -169,11 +203,49 @@ export abstract class OAuthCallbackFlow {
 				);
 			}
 			const server = this.#createServer(0, expectedState);
-			const actualPort = server.port;
+			const actualPort = this.#resolveServerPort(server);
 			const redirectUri = `http://${this.callbackHostname}:${actualPort}${this.callbackPath}`;
+			const launchUrl = this.#launchUrlIfSafe(actualPort);
 			this.ctrl.onProgress?.(`Preferred port ${this.preferredPort} unavailable, using port ${actualPort}`);
-			return { server, redirectUri };
+			return { server, redirectUri, launchUrl };
+		}
+	}
+
+	/**
+	 * Read the numeric port a callback server bound to. `Bun.Server.port` is
+	 * declared `number | undefined` because Unix-socket servers have no port,
+	 * but every callback flow uses TCP; a missing port here indicates a
+	 * configuration error rather than a fallback case.
+	 */
+	#resolveServerPort(server: Bun.Server<unknown>): number {
+		const port = server.port;
+		if (typeof port !== "number") {
+			throw new AIError.ConfigurationError(
+				"OAuth callback server bound to a non-TCP endpoint; expected a numeric port. Check `oauth.callbackPort`/`oauth.redirectUri`.",
+			);
+		}
+		return port;
+	}
+
+	/**
+	 * Build the `/launch` URL served by the callback server bound to `port`, or
+	 * `undefined` when the configured `callbackPath` (or a `redirectUri` whose
+	 * pathname resolves to {@link LAUNCH_PATH}) would collide with the launch
+	 * route. Kept short (~30 chars) so UIs can advertise it as a
+	 * viewport-truncation-safe copy target for the full authorization URL.
+	 */
+	#launchUrlIfSafe(port: number): string | undefined {
+		if (this.callbackPath === LAUNCH_PATH) return undefined;
+		if (this.redirectUri) {
+			try {
+				if (new URL(this.redirectUri).pathname === LAUNCH_PATH) return undefined;
+			} catch {
+				// A non-parseable redirectUri (e.g. `vscode://...` handled elsewhere)
+				// can't collide with an HTTP `/launch` route — fall through and
+				// advertise the launch URL against the loopback server.
+			}
 		}
+		return `http://${this.callbackHostname}:${port}${LAUNCH_PATH}`;
 	}
 
 	/**
@@ -190,12 +262,28 @@ export abstract class OAuthCallbackFlow {
 	}
 
 	/**
-	 * Handle OAuth callback HTTP request.
+	 * Handle OAuth callback HTTP request. Two routes on the same loopback server:
+	 * - `callbackPath` (default `/callback`) — the provider redirect target.
+	 * - {@link LAUNCH_PATH} (`/launch`) — 302 to the pending authorization URL so
+	 *   viewport-safe copy targets can survive TUI truncation.
+	 *
+	 * `callbackPath` wins any collision: an OMP config that pins the provider
+	 * redirect at `/launch` (via `oauth.callbackPath` or a loopback
+	 * `oauth.redirectUri`) must resolve the callback normally rather than
+	 * self-redirect. `#startCallbackServer` also suppresses `launchUrl` in that
+	 * case, so the launch route is never advertised when it would collide.
 	 */
 	#handleCallback(req: Request, expectedState: string): Response {
 		const url = new URL(req.url);
 
 		if (url.pathname !== this.callbackPath) {
+			if (url.pathname === LAUNCH_PATH) {
+				const pending = this.#pendingAuthUrl;
+				if (!pending) {
+					return new Response("OAuth launch URL is no longer active", { status: 503 });
+				}
+				return Response.redirect(pending, 302);
+			}
 			return new Response("Not Found", { status: 404 });
 		}
 

package/src/registry/oauth/types.ts

@@ -23,7 +23,21 @@ export type OAuthPrompt = {
 };
 
 export type OAuthAuthInfo = {
+	/**
+	 * Full authorization URL. Suitable for direct browser launch, OSC 8
+	 * hyperlinks, and clipboard when the target UI can guarantee the full
+	 * string reaches the user unmodified.
+	 */
 	url: string;
+	/**
+	 * Short loopback URL that 302-redirects to {@link url}. Provided by flows
+	 * that host the redirect on the same callback server they already run
+	 * ({@link OAuthCallbackFlow}). UIs SHOULD prefer this as the copy target
+	 * so viewport truncation cannot corrupt OAuth query parameters. Undefined
+	 * for flows without a loopback callback server (device code, paste-code
+	 * providers with fixed non-loopback redirects, etc.).
+	 */
+	launchUrl?: string;
 	instructions?: string;
 };
 

package/src/types.ts

@@ -647,6 +647,23 @@ export interface DeveloperMessage {
 	timestamp: number; // Unix timestamp in milliseconds
 }
 
+export type AssistantRetryRecoveryKind = "credential" | "model" | "wait" | "plain";
+
+export interface AssistantRetryRecovery {
+	kind: "auto-retry";
+	status: "recovered";
+	attempt: number;
+	recoveredAt: string;
+	recovery: AssistantRetryRecoveryKind;
+	note: string;
+	supersededBy?: {
+		timestamp: number;
+		responseId?: string;
+		provider: string;
+		model: string;
+	};
+}
+
 export interface ContextSnapshot {
 	promptTokens: number; // authoritative provider prompt/input tokens
 	nonMessageTokens: number; // estimated non-message total at send time
@@ -660,6 +677,7 @@ export interface AssistantMessage {
 	provider: Provider;
 	model: string;
 	contextSnapshot?: ContextSnapshot;
+	retryRecovery?: AssistantRetryRecovery;
 	responseId?: string; // Provider-specific response/message identifier when the upstream API exposes one
 	/**
 	 * Name of the upstream provider an aggregator routed this request to, as

package/src/usage/claude.ts

@@ -615,20 +615,40 @@ function scopeClaudeLimitsForModel(report: UsageReport, context: CredentialRanki
 }
 
 /**
- * Exclude Fable and Mythos tier weekly caps from proactive hard-blocking
- * (gating) because they are notoriously unreliable (they report 100% exhausted
- * while the account can still serve requests). They stay available for ranking
- * pressure in findWindowLimits via scopeClaudeLimitsForModel.
+ * A Fable/Mythos weekly row is trusted for gating only at full exhaustion
+ * (server `exhausted` status or used fraction >= 1) with a live reset
+ * timestamp. Anything below that stays untrusted: the counters are
+ * notoriously unreliable short of the cap (they report high utilization
+ * while the account can still serve requests).
+ */
+function isConfirmedExhaustedTierRow(limit: UsageLimit, nowMs: number): boolean {
+	const resetsAt = limit.window?.resetsAt;
+	if (typeof resetsAt !== "number" || !Number.isFinite(resetsAt) || resetsAt <= nowMs) return false;
+	if (limit.status === "exhausted") return true;
+	const fraction = resolveUsedFraction(limit);
+	return typeof fraction === "number" && fraction >= 1;
+}
+
+/**
+ * Scope limits for proactive hard-blocking (gating). Fable and Mythos tier
+ * weekly caps participate only when {@link isConfirmedExhaustedTierRow}
+ * confirms them, so a confirmed-dead account is skipped up front and a
+ * reactive 429 block extends to the tier reset in markUsageLimitReached,
+ * while unconfirmed rows remain ranking pressure only via
+ * scopeClaudeLimitsForModel.
  */
 function scopeClaudeLimitsForModelHardBlock(
 	report: UsageReport,
 	context: CredentialRankingContext | undefined,
 ): UsageLimit[] {
 	const kind = getClaudeModelKind(context);
-	const excludeHardBlock = kind === "fable" || kind === "mythos";
-	return report.limits.filter(
-		limit => limit.scope.shared === true || (kind !== undefined && limit.scope.tier === kind && !excludeHardBlock),
-	);
+	const requireConfirmedTierRow = kind === "fable" || kind === "mythos";
+	const nowMs = Date.now();
+	return report.limits.filter(limit => {
+		if (limit.scope.shared === true) return true;
+		if (kind === undefined || limit.scope.tier !== kind) return false;
+		return !requireConfirmedTierRow || isConfirmedExhaustedTierRow(limit, nowMs);
+	});
 }
 
 function rankingUsedFraction(limit: UsageLimit): number {

package/src/utils/schema/CONSTRAINTS.md

@@ -53,6 +53,7 @@ When strict mode is requested (`strict=true` at call site), the schema MUST sati
 
 6. **Provider payload strict flag must match effective strictness**
    - Callers MUST send `strict: true` only if enforcement succeeded (`effectiveStrict === true`).
+   - Callers MUST preserve an author's explicit `tool.strict === false` on the wire so that `strict: false` and omitted `strict` remain distinguishable — some OpenAI-compat backends over-fill optional fields when the flag is absent but respect it when set to `false` (#4336). Exceptions: `openai-responses` emits explicit `false` only while its `strictMode` gate and `PI_NO_STRICT` permit sending the strict field; `openai-codex-responses` gates explicit `false` on `!PI_NO_STRICT` so the documented global bypass keeps the `strict` key off the wire for Codex proxies that reject it; `openai-completions` emits explicit `false` only in `toolStrictMode === "mixed"` with `compat.supportsStrictMode !== false`, because the `all_strict → none` collapse and providers that reject the `strict` key rely on uniform absence.
 
 ---
 

package/src/utils/schema/normalize.ts

@@ -1014,6 +1014,137 @@ export function normalizeSchemaForMoonshot(value: unknown): unknown {
 	});
 }
 
+// ---------------------------------------------------------------------------
+// Ollama — Go schema parser compatibility
+// ---------------------------------------------------------------------------
+
+const OLLAMA_SCHEMA_ARRAY_KEYS = new Set(["anyOf", "oneOf", "allOf", "prefixItems"]);
+const OLLAMA_SCHEMA_MAP_KEYS = new Set([
+	"properties",
+	"patternProperties",
+	"dependencies",
+	"dependentSchemas",
+	"$defs",
+	"definitions",
+]);
+const OLLAMA_SCHEMA_VALUE_KEYS = new Set([
+	"items",
+	"additionalItems",
+	"contains",
+	"contentSchema",
+	"propertyNames",
+	"if",
+	"then",
+	"else",
+	"not",
+	"additionalProperties",
+	"unevaluatedItems",
+	"unevaluatedProperties",
+]);
+
+/**
+ * Widened stand-in for a `true` / `{}` subschema in an Ollama-bound tool.
+ *
+ * `toolWireSchema()` normalizes empty schemas to boolean `true` upstream so
+ * grammar-constrained samplers (llama.cpp, etc.) don't treat `{}` as
+ * "generate an empty object" (issue #1179). Ollama's Go tool parser can't
+ * unmarshal a boolean into its object-shaped `Schema` struct, so this
+ * sanitizer replaces every open subschema with an explicit union of every
+ * primitive JSON type. Both invariants survive: the wire has no boolean
+ * subschema (Go accepts it), and llama.cpp's grammar sees a real value
+ * union rather than a closed empty object.
+ */
+const OLLAMA_OPEN_SUBSCHEMA_WIDENING = Object.freeze({
+	anyOf: [
+		{ type: "string" },
+		{ type: "number" },
+		{ type: "boolean" },
+		{ type: "object" },
+		{ type: "array" },
+		{ type: "null" },
+	],
+});
+
+/**
+ * Rewrites standard JSON Schema forms that Ollama's Go `/api/chat` tool parser
+ * cannot unmarshal into its object-shaped `Schema` struct.
+ */
+export function sanitizeSchemaForOllama(schema: JsonObject): JsonObject {
+	const normalizeNode = (value: unknown): unknown => {
+		if (value === true) return OLLAMA_OPEN_SUBSCHEMA_WIDENING;
+		if (value === false) return { not: OLLAMA_OPEN_SUBSCHEMA_WIDENING };
+		if (!isJsonObject(value)) {
+			if (!Array.isArray(value)) return value;
+			let changed = false;
+			const output = value.map(item => {
+				const next = normalizeNode(item);
+				if (next !== item) changed = true;
+				return next;
+			});
+			return changed ? output : value;
+		}
+
+		let changed = false;
+		const output: JsonObject = {};
+		let typeAlternatives: JsonObject[] | undefined;
+		for (const key in value) {
+			if (!Object.hasOwn(value, key)) continue;
+			const child = value[key];
+			if ((key === "additionalProperties" || key === "unevaluatedProperties") && typeof child === "boolean") {
+				changed = true;
+				continue;
+			}
+			if (key === "type" && Array.isArray(child)) {
+				const variants = child.filter((entry): entry is string => typeof entry === "string");
+				const uniqueVariants = [...new Set(variants)];
+				const nonNull = uniqueVariants.filter(entry => entry !== "null");
+				if (nonNull.length <= 1) {
+					output.type = nonNull[0] ?? uniqueVariants[0] ?? child[0];
+				} else {
+					typeAlternatives = uniqueVariants.map(entry => ({ type: entry }));
+				}
+				changed = true;
+				continue;
+			}
+
+			let next = child;
+			if (OLLAMA_SCHEMA_MAP_KEYS.has(key) && isJsonObject(child)) {
+				let mapChanged = false;
+				const mapOutput: JsonObject = {};
+				for (const childKey in child) {
+					if (!Object.hasOwn(child, childKey)) continue;
+					const mapChild = child[childKey];
+					const normalizedChild = normalizeNode(mapChild);
+					if (normalizedChild !== mapChild) mapChanged = true;
+					mapOutput[childKey] = normalizedChild;
+				}
+				next = mapChanged ? mapOutput : child;
+			} else if (OLLAMA_SCHEMA_ARRAY_KEYS.has(key) && Array.isArray(child)) {
+				let arrayChanged = false;
+				const arrayOutput = child.map(item => {
+					const normalizedItem = normalizeNode(item);
+					if (normalizedItem !== item) arrayChanged = true;
+					return normalizedItem;
+				});
+				next = arrayChanged ? arrayOutput : child;
+			} else if (OLLAMA_SCHEMA_VALUE_KEYS.has(key)) {
+				next = normalizeNode(child);
+			}
+			if (next !== child) changed = true;
+			output[key] = next;
+		}
+
+		if (typeAlternatives) {
+			const existingAllOf = output.allOf;
+			const typeUnion = { anyOf: typeAlternatives };
+			output.allOf = Array.isArray(existingAllOf) ? [typeUnion, ...existingAllOf] : [typeUnion];
+		}
+
+		return changed ? output : value;
+	};
+	return normalizeNode(schema) as JsonObject;
+}
+
 // ---------------------------------------------------------------------------
 // OpenAI Responses — schema-valued normalization
 // ---------------------------------------------------------------------------