@oh-my-pi/pi-ai 16.5.0 → 16.5.2

package/src/error/auth-classify.ts

@@ -1,5 +1,5 @@
 import { extractHttpStatusFromError } from "@oh-my-pi/pi-utils";
-import { isOAuthExpiry } from "./flags";
+import { isOAuthExpiry, isUsageLimit } from "./flags";
 import { isUsageLimitOutcome } from "./rate-limit";
 
 /**
@@ -21,6 +21,7 @@ export function isDefinitiveOAuthFailure(errorMsg: string): boolean {
  * upstream-backoff lane.
  */
 export function isAuthRetryableError(error: unknown): boolean {
+	if (isUsageLimit(error)) return true;
 	const httpStatus = extractHttpStatusFromError(error);
 	if (httpStatus === 401) return true;
 	const message = error instanceof Error ? error.message : typeof error === "string" ? error : undefined;

package/src/error/flags.ts

@@ -18,6 +18,7 @@ export const Flag = {
 	StaleResponsesItem: 0x0010_0000,
 	MalformedFunctionCall: 0x0020_0000,
 	ProviderFinishError: 0x0040_0000,
+	ContentBlocked: 0x0000_8000,
 	ContextOverflow: 0x0080_0000,
 	AuthFailed: 0x0100_0000,
 	SilentAbort: 0x0200_0000,
@@ -41,6 +42,7 @@ const KIND_MASK =
 	Flag.StaleResponsesItem |
 	Flag.MalformedFunctionCall |
 	Flag.ProviderFinishError |
+	Flag.ContentBlocked |
 	Flag.ContextOverflow |
 	Flag.AuthFailed |
 	Flag.SilentAbort |
@@ -93,6 +95,7 @@ const AUTH_FAILURE_PATTERN =
 	/\b(?:401|403|unauthorized|forbidden|authentication|auth[_ ]?unavailable|no auth available|(?:invalid|no)[_ ]?api[_ ]?key)\b/i;
 const MALFORMED_FUNCTION_CALL_PATTERN = /\bmalformed.?function.?call\b/i;
 const PROVIDER_FINISH_ERROR_PATTERN = /\bProvider (?:returned error finish_reason|finish_reason:\s*error)\b/i;
+const CONTENT_FILTER_PATTERN = /\b(?:incomplete:\s*)?content_filter\b/i;
 const STALE_RESPONSE_ITEM_PATTERNS = [/\bItem with id ['"][^'"]+['"] not found\.?/i, /previous[ _]?response/i] as const;
 const STALE_RESPONSE_ITEM_DETAIL_PATTERN = /not[ _]?found|invalid|expired|stale|zero[ _-]?data[ _-]?retention/i;
 /**
@@ -174,6 +177,7 @@ const ERROR_KIND_LABELS: readonly [Flag, string][] = [
 	[Flag.StaleResponsesItem, "stale-responses-item"],
 	[Flag.MalformedFunctionCall, "malformed-function-call"],
 	[Flag.ProviderFinishError, "provider-finish-error"],
+	[Flag.ContentBlocked, "content-blocked"],
 	[Flag.ContextOverflow, "context-overflow"],
 	[Flag.AuthFailed, "auth-failed"],
 	[Flag.SilentAbort, "silent-abort"],
@@ -200,6 +204,7 @@ export function is(id: number | undefined, flag: Flag): boolean {
 }
 
 export function retriable(id: number | undefined, opts?: { replayUnsafe?: boolean }): boolean {
+	if (is(id, Flag.ContentBlocked)) return false;
 	if (is(id, Flag.MalformedFunctionCall)) return true;
 	if (opts?.replayUnsafe) return false;
 	return ((id ?? 0) & RETRIABLE_KINDS) !== 0;
@@ -292,6 +297,10 @@ function isProviderFinishErrorText(text: string): boolean {
 	return PROVIDER_FINISH_ERROR_PATTERN.test(text);
 }
 
+function isContentBlockedText(text: string): boolean {
+	return CONTENT_FILTER_PATTERN.test(text);
+}
+
 function matchesOverflowText(text: string): boolean {
 	return OVERFLOW_PATTERNS.some(p => p.test(text)) || OVERFLOW_NO_BODY_PATTERN.test(text);
 }
@@ -302,6 +311,7 @@ function classifyText(errorMessage: string | undefined, errorStatus: number | un
 		if (matchesOverflowText(errorMessage)) kinds |= Flag.ContextOverflow;
 		if (isMalformedFunctionCallText(errorMessage)) kinds |= Flag.MalformedFunctionCall;
 		if (isProviderFinishErrorText(errorMessage)) kinds |= Flag.ProviderFinishError;
+		if (isContentBlockedText(errorMessage)) kinds |= Flag.ContentBlocked;
 		if (isAuthFailureText(errorMessage)) kinds |= Flag.AuthFailed;
 
 		const statusClean = errorStatus ? errorStatus : (status({ message: errorMessage }) ?? undefined);

package/src/error/provider.ts

@@ -36,8 +36,8 @@ export class ProviderResponseError extends Error {
 		this.name = "ProviderResponseError";
 		this.provider = options.provider;
 		this.kind = options.kind ?? "output";
-		// A safety filter block is a terminal provider finish, not a transient fault.
-		if (this.kind === "content-blocked") attach(this, create(Flag.ProviderFinishError));
+		// A safety filter block is terminal and intentionally non-retryable.
+		if (this.kind === "content-blocked") attach(this, create(Flag.ContentBlocked));
 		// An incomplete stream (connection dropped / truncated before any terminal
 		// event) or an empty body never produced any content — the request didn't
 		// complete, so it is safe to retry and eligible for model fallback. The

package/src/index.ts

@@ -29,6 +29,7 @@ export * from "./stream";
 export * from "./types";
 export * from "./usage";
 export * from "./usage/claude";
+export * from "./usage/cursor";
 export * from "./usage/gemini";
 export * from "./usage/github-copilot";
 export * from "./usage/google-antigravity";

package/src/providers/cursor.ts

@@ -76,6 +76,7 @@ import {
 	RequestContextResultSchema,
 	RequestContextSchema,
 	RequestContextSuccessSchema,
+	RequestedModelSchema,
 	ResumeActionSchema,
 	SelectedContextSchema,
 	SelectedImageSchema,
@@ -2797,16 +2798,24 @@ function buildGrpcRequest(
 		turns,
 	});
 
+	const wireModelId = model.requestModelId ?? model.id;
+	const cursorMaxMode = model.cursorMaxMode === true;
 	const modelDetails = create(ModelDetailsSchema, {
-		modelId: model.id,
+		modelId: wireModelId,
 		displayModelId: model.id,
 		displayName: model.name,
+		...(cursorMaxMode ? { maxMode: true } : undefined),
+	});
+	const requestedModel = create(RequestedModelSchema, {
+		modelId: wireModelId,
+		maxMode: cursorMaxMode,
 	});
 
 	const runRequest = create(AgentRunRequestSchema, {
 		conversationState,
 		action,
 		modelDetails,
+		requestedModel,
 		conversationId: state.conversationId,
 	});
 

package/src/providers/openai-chat-server-schema.ts

@@ -114,6 +114,7 @@ export const toolChoiceSchema = type("'auto' | 'none' | 'required'")
 // ─── Messages ───────────────────────────────────────────────────────────────
 
 const baseContent = type("string").or(userContentPartSchema.array());
+const assistantContent = baseContent.or("null");
 
 export const systemMessageSchema = type({
 	role: "'system'",
@@ -132,7 +133,7 @@ export const userMessageSchema = type({
 
 export const assistantMessageSchema = type({
 	role: "'assistant'",
-	"content?": baseContent,
+	"content?": assistantContent,
 	"tool_calls?": toolCallSchema.array(),
 	// DeepSeek-style reasoning channel. The gateway emits it on the way out
 	// (encodeResponse/encodeStream); accept it back so thinking-mode

package/src/providers/openai-codex-responses.ts

@@ -100,6 +100,7 @@ import {
 	encodeResponsesToolCallId,
 	encodeTextSignatureV1,
 	finalizeCustomToolCallInputDone,
+	finalizeMessageText,
 	finalizePendingResponsesToolCalls,
 	finalizeReasoningThinking,
 	finalizeToolCallArgumentsDone,
@@ -691,6 +692,8 @@ class CodexStreamRuntime {
 	nativeOutputItems: Array<Record<string, unknown>> = [];
 	/** Sequential-cutoff summary sections/emitted text, global to the response (indices span reasoning items). */
 	cutoffSummaries: SequentialCutoffSummaryState = createSequentialCutoffSummaryState();
+	/** Summary deltas buffered while waiting to see whether atomic `.done` events arrive. */
+	pendingSummaryDeltas = new Map<CodexOpenItem, string[]>();
 	websocketStreamRetries = 0;
 	providerRetryAttempt = 0;
 	sawTerminalEvent = false;
@@ -723,6 +726,7 @@ class CodexStreamRuntime {
 		this.currentItem = null;
 		this.currentBlock = null;
 		this.nativeOutputItems.length = 0;
+		this.pendingSummaryDeltas.clear();
 		this.cutoffSummaries = createSequentialCutoffSummaryState();
 	}
 
@@ -744,6 +748,19 @@ class CodexStreamRuntime {
 		if (outputIndex !== undefined) return this.openItemsByOutputIndex.get(outputIndex) ?? null;
 		return this.currentEntry;
 	}
+	queueSummaryDelta(entry: CodexOpenItem | null | undefined, delta: string): void {
+		if (entry?.block?.type !== "thinking" || delta.length === 0) return;
+		const pending = this.pendingSummaryDeltas.get(entry) ?? [];
+		pending.push(delta);
+		this.pendingSummaryDeltas.set(entry, pending);
+	}
+
+	takeSummaryDeltas(entry: CodexOpenItem | null | undefined): string[] {
+		if (!entry) return [];
+		const pending = this.pendingSummaryDeltas.get(entry) ?? [];
+		this.pendingSummaryDeltas.delete(entry);
+		return pending;
+	}
 
 	closeOpenItem(entry: CodexOpenItem | null | undefined): void {
 		if (!entry) return;
@@ -1693,10 +1710,9 @@ class CodexStreamProcessor {
 
 	/**
 	 * Whether the request actually sent (post-`onPayload`) opted into
-	 * sequential-cutoff summary delivery: summaries then arrive as atomic
-	 * `response.reasoning_summary_text.done` events and incremental
-	 * `.delta`/`.part.*` events are ignored (mirrors codex-rs
-	 * `uses_sequential_cutoff_reasoning_summaries`).
+	 * sequential-cutoff summary delivery. Atomic `.done` events are preferred;
+	 * incremental deltas remain buffered as a compatibility fallback when a
+	 * transport emits them instead.
 	 */
 	get #sequentialCutoffSummaries(): boolean {
 		return this.runtime.requestBodyForState.stream_options?.reasoning_summary_delivery === "sequential_cutoff";
@@ -1772,18 +1788,19 @@ class CodexStreamProcessor {
 			}
 			return firstTokenTime;
 		}
-
 		if (eventType === "response.reasoning_summary_text.delta") {
-			if (this.#sequentialCutoffSummaries) return firstTokenTime;
-			if (this.runtime.currentItem?.type === "reasoning" && this.runtime.currentBlock?.type === "thinking") {
-				appendReasoningSummaryTextDelta(
-					this.runtime.currentItem,
-					this.runtime.currentBlock,
-					(rawEvent as { delta?: string }).delta || "",
-					stream,
-					output,
-					output.content.length - 1,
-				);
+			const entry = this.runtime.openItemForEvent(rawEvent);
+			const delta = typeof rawEvent.delta === "string" ? rawEvent.delta : "";
+			if (this.#sequentialCutoffSummaries) {
+				// Some Codex transports still emit incremental summary deltas even
+				// after opting into sequential-cutoff delivery. Buffer them until
+				// output_item.done so atomic `.done` events can supersede them
+				// without duplicate UI output.
+				this.runtime.queueSummaryDelta(entry, delta);
+				return firstTokenTime;
+			}
+			if (entry?.item.type === "reasoning" && entry.block?.type === "thinking") {
+				appendReasoningSummaryTextDelta(entry.item, entry.block, delta, stream, output, entry.contentIndex);
 			}
 			return firstTokenTime;
 		}
@@ -1793,6 +1810,7 @@ class CodexStreamProcessor {
 			if (!this.#sequentialCutoffSummaries) return firstTokenTime;
 			const entry = this.runtime.openItemForEvent(rawEvent);
 			if (entry?.item.type === "reasoning" && entry.block?.type === "thinking") {
+				this.runtime.takeSummaryDeltas(entry);
 				if (!firstTokenTime) firstTokenTime = performance.now();
 				const summaryIndex =
 					typeof rawEvent.summary_index === "number" && Number.isFinite(rawEvent.summary_index)
@@ -1827,15 +1845,13 @@ class CodexStreamProcessor {
 		}
 
 		if (eventType === "response.reasoning_summary_part.done") {
-			if (this.#sequentialCutoffSummaries) return firstTokenTime;
-			if (this.runtime.currentItem?.type === "reasoning" && this.runtime.currentBlock?.type === "thinking") {
-				appendReasoningSummaryPartDone(
-					this.runtime.currentItem,
-					this.runtime.currentBlock,
-					stream,
-					output,
-					output.content.length - 1,
-				);
+			const entry = this.runtime.openItemForEvent(rawEvent);
+			if (this.#sequentialCutoffSummaries) {
+				if (entry && this.runtime.pendingSummaryDeltas.has(entry)) this.runtime.queueSummaryDelta(entry, "\n\n");
+				return firstTokenTime;
+			}
+			if (entry?.item.type === "reasoning" && entry.block?.type === "thinking") {
+				appendReasoningSummaryPartDone(entry.item, entry.block, stream, output, entry.contentIndex);
 			}
 			return firstTokenTime;
 		}
@@ -1930,6 +1946,18 @@ class CodexStreamProcessor {
 		return firstTokenTime;
 	}
 
+	#flushSummaryDeltas(entry: CodexOpenItem | null): void {
+		if (entry?.block?.type !== "thinking") return;
+		for (const delta of this.runtime.takeSummaryDeltas(entry)) {
+			entry.block.thinking += delta;
+			this.stream.push({
+				type: "thinking_delta",
+				contentIndex: entry.contentIndex,
+				delta,
+				partial: this.output,
+			});
+		}
+	}
 	#handleOutputItemDone(rawEvent: Record<string, unknown>): void {
 		const { runtime, output, stream } = this;
 		const rawItem = rawEvent.item;
@@ -1948,6 +1976,7 @@ class CodexStreamProcessor {
 		const contentIndex = entry?.contentIndex ?? output.content.length - 1;
 
 		if (item.type === "reasoning" && block?.type === "thinking") {
+			this.#flushSummaryDeltas(entry);
 			block.thinking = finalizeReasoningThinking(
 				item,
 				block.thinking,
@@ -1965,9 +1994,7 @@ class CodexStreamProcessor {
 		}
 
 		if (item.type === "message" && block?.type === "text") {
-			block.text = item.content
-				.map(content => (content.type === "output_text" ? content.text : content.refusal))
-				.join("");
+			block.text = finalizeMessageText(item, block.text);
 			const phase = item.phase === "commentary" || item.phase === "final_answer" ? item.phase : undefined;
 			block.textSignature = encodeTextSignatureV1(item.id, phase);
 			stream.push({
@@ -3721,27 +3748,38 @@ async function openCodexSseEventStream(
 			sentModelsEtagHeader: headers.has(X_MODELS_ETAG_HEADER),
 		});
 	// `wrapCodexSseStream` arms the iterator-level idle watchdog only after this
-	// fetch resolves. A pre-response timer still bounds time-to-first-byte (a
-	// proxy that accepts the POST but never sends headers would otherwise hang
-	// forever, since `timeout: false` disables Bun's native ceiling — issue
-	// #2422). It MUST be cleared the instant headers arrive: an absolute
-	// `AbortSignal.timeout` would keep aborting the actively-streaming body.
-	const watchdog = armPreResponseTimeout(signal, firstEventTimeoutMs);
+	// fetch resolves. Each transport attempt needs its own pre-response timer:
+	// the retry loop's base signal remains reserved for caller cancellation, so
+	// an internal timeout stays retryable while an explicit abort fails fast.
+	let clearPreResponseTimeout: (() => void) | undefined;
+	const fetchAttempt: FetchImpl = async (input, init) => {
+		try {
+			return await (fetchOverride ?? fetch)(input, init);
+		} finally {
+			clearPreResponseTimeout?.();
+			clearPreResponseTimeout = undefined;
+		}
+	};
 	let response: Response;
 	try {
 		response = await fetchWithRetry(url, {
 			method: "POST",
 			headers,
 			body: JSON.stringify(body),
-			signal: watchdog.signal,
+			signal,
+			prepareInit: () => {
+				const watchdog = armPreResponseTimeout(signal, firstEventTimeoutMs);
+				clearPreResponseTimeout = watchdog.clear;
+				return { signal: watchdog.signal };
+			},
 			maxAttempts: CODEX_MAX_RETRIES + 1,
 			defaultDelayMs: attempt => CODEX_RETRY_DELAY_MS * (attempt + 1),
 			maxDelayMs: CODEX_RATE_LIMIT_BUDGET_MS,
-			fetch: fetchOverride,
+			fetch: fetchAttempt,
 			timeout: false,
 		});
 	} finally {
-		watchdog.clear();
+		clearPreResponseTimeout?.();
 	}
 	CODEX_DEBUG &&
 		logger.debug("[codex] codex response", {

package/src/providers/openai-shared.ts

@@ -1978,6 +1978,11 @@ export function appendMessageTextDelta(
 	}
 	stream.push({ type: "text_delta", contentIndex, delta, partial: output });
 }
+/** Chooses final message text while treating non-empty terminal content as authoritative. */
+export function finalizeMessageText(item: ResponseOutputMessage, streamedText: string): string {
+	if (!item.content?.length) return streamedText || "";
+	return item.content.map(part => (part.type === "output_text" ? (part.text ?? "") : (part.refusal ?? ""))).join("");
+}
 
 export function accumulateToolCallArgumentsDelta(
 	block: ResponsesToolCallBlock,
@@ -2455,9 +2460,7 @@ export async function processResponsesStream<TApi extends Api>(
 				closeOpenItem(event.output_index, item.id, entry);
 			} else if (item.type === "message") {
 				const block = entry?.block.type === "text" ? entry.block : undefined;
-				const text = item.content
-					.map(part => (part.type === "output_text" ? (part.text ?? "") : (part.refusal ?? "")))
-					.join("");
+				const text = finalizeMessageText(item, block?.text ?? "");
 				const textSignature = encodeTextSignatureV1(item.id, item.phase ?? undefined);
 				let contentIndex: number;
 				if (block) {

package/src/registry/oauth/anthropic.ts

@@ -79,15 +79,35 @@ interface AnthropicTokenResponse {
 	refresh_token: string;
 	expires_in: number;
 	account?: { uuid?: string; email_address?: string };
+	organization?: { uuid?: string; name?: string };
 }
 
 interface AnthropicBootstrapResponse {
 	oauth_account?: {
 		account_uuid?: string;
 		account_email?: string;
+		organization_uuid?: string;
+		organization_name?: string;
 	};
 }
 
+/**
+ * Account + organization identity slice resolved from the token response
+ * and/or the `/api/claude_cli/bootstrap` endpoint. The organization is the
+ * subscription workspace the token draws limits from — one account email can
+ * hold several (e.g. a Team seat plus a personal Max plan).
+ */
+interface AnthropicIdentity {
+	accountId?: string;
+	email?: string;
+	orgId?: string;
+	orgName?: string;
+}
+
+function nonEmpty(value: string | undefined): string | undefined {
+	return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+
 function parseOAuthTokenResponse(responseBody: string, operation: string): AnthropicTokenResponse {
 	try {
 		return JSON.parse(responseBody) as AnthropicTokenResponse;
@@ -100,28 +120,23 @@ function parseOAuthTokenResponse(responseBody: string, operation: string): Anthr
 }
 
 /**
- * Lift the OAuth response's `account: { uuid, email_address }` block onto
- * {@link OAuthCredentials} so downstream identity propagation (e.g.
- * `metadata.user_id.account_uuid`, usage tracking) works without a separate
- * `/api/oauth/profile` round-trip. Returns `undefined` for either field when
- * the response omits it or carries a non-string / empty value.
+ * Lift the OAuth response's `account: { uuid, email_address }` and
+ * `organization: { uuid, name }` blocks onto {@link OAuthCredentials} so
+ * downstream identity propagation (e.g. `metadata.user_id.account_uuid`,
+ * usage tracking, org-scoped credential identity) works without a separate
+ * `/api/oauth/profile` round-trip. Returns `undefined` for any field the
+ * response omits or carries as a non-string / empty value.
  */
-function extractAccountFromTokenResponse(data: AnthropicTokenResponse): {
-	accountId?: string;
-	email?: string;
-} {
-	const accountUuid = data.account?.uuid;
-	const emailAddress = data.account?.email_address;
+function extractAccountFromTokenResponse(data: AnthropicTokenResponse): AnthropicIdentity {
 	return {
-		accountId: typeof accountUuid === "string" && accountUuid.length > 0 ? accountUuid : undefined,
-		email: typeof emailAddress === "string" && emailAddress.length > 0 ? emailAddress : undefined,
+		accountId: nonEmpty(data.account?.uuid),
+		email: nonEmpty(data.account?.email_address),
+		orgId: nonEmpty(data.organization?.uuid),
+		orgName: nonEmpty(data.organization?.name),
 	};
 }
 
-async function fetchBootstrapIdentity(
-	accessToken: string,
-	fetchImpl: FetchImpl,
-): Promise<{ accountId?: string; email?: string }> {
+async function fetchBootstrapIdentity(accessToken: string, fetchImpl: FetchImpl): Promise<AnthropicIdentity> {
 	const url = `${BOOTSTRAP_URL}?entrypoint=cli&model=${encodeURIComponent(CLAUDE_CODE_BOOTSTRAP_MODEL)}`;
 	const response = await fetchImpl(url, {
 		method: "GET",
@@ -150,25 +165,36 @@ async function fetchBootstrapIdentity(
 			{ kind: "validation", provider: "anthropic", cause: error },
 		);
 	}
-	const accountUuid = data.oauth_account?.account_uuid;
-	const accountEmail = data.oauth_account?.account_email;
 	return {
-		accountId: typeof accountUuid === "string" && accountUuid.length > 0 ? accountUuid : undefined,
-		email: typeof accountEmail === "string" && accountEmail.length > 0 ? accountEmail : undefined,
+		accountId: nonEmpty(data.oauth_account?.account_uuid),
+		email: nonEmpty(data.oauth_account?.account_email),
+		orgId: nonEmpty(data.oauth_account?.organization_uuid),
+		orgName: nonEmpty(data.oauth_account?.organization_name),
 	};
 }
 
+/**
+ * Resolve account (and optionally organization) identity for a token
+ * response. `includeOrg` is login-only: the org an access token is scoped to
+ * is captured once when the credential is created and deliberately never
+ * refreshed afterwards — rewriting identity during background token
+ * refreshes could silently re-key stored credentials.
+ */
 async function resolveAccountIdentity(
 	data: AnthropicTokenResponse,
 	fetchImpl: FetchImpl,
-): Promise<{ accountId?: string; email?: string }> {
+	options?: { includeOrg?: boolean },
+): Promise<AnthropicIdentity> {
 	const identity = extractAccountFromTokenResponse(data);
-	if (identity.accountId && identity.email) return identity;
+	const orgSatisfied = !options?.includeOrg || identity.orgId !== undefined;
+	if (identity.accountId && identity.email && orgSatisfied) return identity;
 	try {
 		const bootstrap = await fetchBootstrapIdentity(data.access_token, fetchImpl);
 		return {
 			accountId: identity.accountId ?? bootstrap.accountId,
 			email: identity.email ?? bootstrap.email,
+			orgId: identity.orgId ?? bootstrap.orgId,
+			orgName: identity.orgName ?? bootstrap.orgName,
 		};
 	} catch {
 		return identity;
@@ -243,7 +269,9 @@ export class AnthropicOAuthFlow extends OAuthCallbackFlow {
 		}
 
 		const tokenData = parseOAuthTokenResponse(responseBody, "token exchange");
-		const { accountId, email } = await resolveAccountIdentity(tokenData, this.#fetch);
+		const { accountId, email, orgId, orgName } = await resolveAccountIdentity(tokenData, this.#fetch, {
+			includeOrg: true,
+		});
 
 		return {
 			refresh: tokenData.refresh_token,
@@ -251,6 +279,8 @@ export class AnthropicOAuthFlow extends OAuthCallbackFlow {
 			expires: Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000,
 			accountId,
 			email,
+			orgId,
+			orgName,
 		};
 	}
 }
@@ -299,6 +329,9 @@ export async function refreshAnthropicToken(
 	}
 
 	const data = parseOAuthTokenResponse(responseBody, "token refresh");
+	// Deliberately no `includeOrg` and no org fields on the result: the org a
+	// credential is scoped to is fixed at login. Callers merge refresh results
+	// over the stored credential, so omitting org here preserves it verbatim.
 	const { accountId, email } = await resolveAccountIdentity(data, fetchImpl);
 
 	return {

package/src/registry/oauth/oauth.html

@@ -305,7 +305,7 @@
 			if (serverState.ok) {
 				app.classList.add("success", "countdown");
 				title.textContent = "Authentication Successful";
-				message.innerHTML = "You have successfully logged in.<br>This window will close automatically.";
+				message.innerHTML = "You have successfully logged in.<br>You can now close this tab.";
 				setTimeout(() => window.close(), 3000);
 			} else {
 				app.classList.add("error");

package/src/registry/oauth/types.ts

@@ -10,6 +10,14 @@ export type OAuthCredentials = {
 	email?: string;
 	accountId?: string;
 	apiEndpoint?: string;
+	/**
+	 * Organization/workspace the token is scoped to (e.g. an Anthropic org
+	 * UUID). Captured once at login; token refreshes never rewrite it. Lets
+	 * one account email hold credentials for multiple subscriptions.
+	 */
+	orgId?: string;
+	/** Human-readable organization name for display (may embed the email). */
+	orgName?: string;
 };
 
 export type OAuthProvider = OAuthProviderUnion;

package/src/stream.ts

@@ -17,7 +17,7 @@ import { CATALOG_PROVIDERS, type ProviderCatalogEntry } from "@oh-my-pi/pi-catal
 import { CODEX_BASE_URL } from "@oh-my-pi/pi-catalog/wire/codex";
 import { $env, $pickenv, getConfigRootDir, isEnoent, logger, withExtraCaFetch } from "@oh-my-pi/pi-utils";
 import { getCustomApi } from "./api-registry";
-import { AUTH_RETRY_STEPS, isApiKeyResolver, resolveRetryKey } from "./auth-retry";
+import { createAuthRetryKeyState, isApiKeyResolver, resolveNextAuthRetryKey } from "./auth-retry";
 import * as AIError from "./error";
 import { ProviderHttpError } from "./error";
 import { isUsageLimitOutcome } from "./error/rate-limit";
@@ -978,17 +978,19 @@ function isRetryableUpstreamError(error: unknown, status: number | undefined, me
 	// per-minute caps) classify as RATE_LIMIT_EXCEEDED in
 	// `parseRateLimitReason` and stay in the provider's own backoff layer
 	// instead of burning siblings.
+	if (AIError.isUsageLimit(error)) return true;
 	if (status === 401) return true;
-	void error;
 	return isUsageLimitOutcome(status, message);
 }
 
 function createAssistantAuthError(message: AssistantMessage): Error {
 	const text = message.errorMessage ?? "Provider authentication failed";
 	const status = extractStatusFromAssistantError(message);
-	return status === undefined
-		? new AIError.ProviderResponseError(text, { kind: "runtime" })
-		: new ProviderHttpError(text, status);
+	const error =
+		status === undefined
+			? new AIError.ProviderResponseError(text, { kind: "runtime" })
+			: new ProviderHttpError(text, status);
+	return typeof message.errorId === "number" ? AIError.attach(error, message.errorId) : error;
 }
 
 function emitBufferedEvents(stream: AssistantMessageEventStream, events: AssistantMessageEvent[]): void {
@@ -1012,12 +1014,12 @@ export function streamSimple<TApi extends Api>(
 	if (apiKeyResolver) {
 		const outer = new AssistantMessageEventStream();
 		const signal = requestOptions?.signal;
-		// One inner attempt against a resolved string key. When
-		// `captureAuthFailure` is set, a retryable auth error that arrives before
-		// any replay-unsafe event is buffered and returned (so the caller can
-		// retry with a fresh key) instead of surfaced. The terminal attempt
-		// clears the flag and emits whatever it gets.
-		const runAttempt = async (apiKey: string, captureAuthFailure: boolean): Promise<AuthRetryFailure | undefined> => {
+		// One inner attempt against a resolved string key. A retryable auth error
+		// that arrives before any replay-unsafe event is buffered and returned
+		// (so the caller can retry with a fresh key) instead of surfaced. Once any
+		// non-start event escapes, retry is no longer safe and the failure is
+		// emitted directly.
+		const runAttempt = async (apiKey: string): Promise<AuthRetryFailure | undefined> => {
 			const bufferedEvents: AssistantMessageEvent[] = [];
 			let emittedReplayUnsafeEvent = false;
 			const flushBuffered = (): void => {
@@ -1034,7 +1036,6 @@ export function streamSimple<TApi extends Api>(
 					}
 					if (
 						!emittedReplayUnsafeEvent &&
-						captureAuthFailure &&
 						event.type === "error" &&
 						isRetryableUpstreamError(
 							event.error,
@@ -1054,7 +1055,6 @@ export function streamSimple<TApi extends Api>(
 			} catch (error) {
 				if (
 					!emittedReplayUnsafeEvent &&
-					captureAuthFailure &&
 					isRetryableUpstreamError(
 						error,
 						AIError.status(error),
@@ -1096,27 +1096,16 @@ export function streamSimple<TApi extends Api>(
 				outer.fail(new AIError.MissingApiKeyError(model.provider));
 				return;
 			}
-			let failure = await runAttempt(lastKey, true);
+			const retryState = createAuthRetryKeyState(lastKey);
+			let failure = await runAttempt(lastKey);
 			if (!failure) return;
-			// a/b/c policy: refresh the same account (lastChance=false), then
-			// switch to a sibling (lastChance=true). A step is skipped when the
-			// resolver yields the same key it just tried or `undefined`; the
-			// final step's attempt clears the capture flag so it emits directly.
-			for (let step = 0; step < AUTH_RETRY_STEPS.length; step++) {
+			while (true) {
 				// Caller aborted between attempts: don't mint a fresh token or fire
 				// another doomed request — emit the captured failure instead.
 				if (signal?.aborted) break;
-				const nextKey = await resolveRetryKey(
-					apiKeyResolver,
-					AUTH_RETRY_STEPS[step]!,
-					failure.error,
-					signal,
-					lastKey,
-				);
-				if (nextKey === undefined || nextKey === lastKey) continue;
-				lastKey = nextKey;
-				const isLastStep = step === AUTH_RETRY_STEPS.length - 1;
-				const next = await runAttempt(nextKey, !isLastStep);
+				const nextKey = await resolveNextAuthRetryKey(retryState, apiKeyResolver, failure.error, signal);
+				if (nextKey === undefined) break;
+				const next = await runAttempt(nextKey);
 				if (!next) return;
 				failure = next;
 			}