@oh-my-pi/pi-ai 17.0.1 → 17.0.2

package/CHANGELOG.md

@@ -2,9 +2,17 @@
 
 ## [Unreleased]
 
+## [17.0.2] - 2026-07-17
+
 ### Fixed
 
-- Automatically invalidate and rotate OAuth credentials when an "invalidated oauth token" error occurs
+- Automatically invalidate and rotate OAuth credentials when an "invalidated oauth token" error occurs.
+- Fixed auth-broker snapshot validation rejecting API keys stored via the `/login` flow, restoring support for gateway/broker setups serving login-sourced keys on custom hosts.
+- Fixed an issue where literal reasoning tags (e.g., `<think>`) inside Markdown code blocks or inline code were incorrectly treated as reasoning boundaries, which corrupted the rendered Markdown.
+- Classified HTTP 402 and "balance exhausted" quota responses as persistent usage limits, enabling automatic rotation of multi-account requests to a sibling credential.
+- Fixed `kimi-code` Anthropic-format requests ignoring custom provider base URLs.
+- Fixed an issue where GPT-5.6 Codex Responses-Lite requests failed with an HTTP 400 error due to invalid `tool_choice` parameters after tools were rewritten, by automatically downgrading forced hosted choices to `tool_choice: "auto"` while preserving explicit tool-use constraints.
+- Fixed Cursor streams prematurely reporting success before late CONNECT or gRPC terminal failures were observed, and resolved issues rejecting transport ends without a `turnEnded` signal.
 
 ## [17.0.1] - 2026-07-16
 

package/dist/types/auth-broker/wire-schemas.d.ts

@@ -29,6 +29,7 @@ export declare const remoteOauthCredentialSchema: import("arktype/internal/varia
 export declare const apiKeyCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
     type: "api_key";
     key: string;
+    source?: "login" | undefined;
 }, {}>;
 /** Discriminated union accepted on POST /v1/credential (writes). */
 export declare const writableAuthCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
@@ -46,6 +47,7 @@ export declare const writableAuthCredentialSchema: import("arktype/internal/vari
 } | {
     type: "api_key";
     key: string;
+    source?: "login" | undefined;
 }, {}>;
 /** Discriminated union returned in snapshots (refresh is sentinel for OAuth). */
 export declare const snapshotCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
@@ -63,6 +65,7 @@ export declare const snapshotCredentialSchema: import("arktype/internal/variants
 } | {
     type: "api_key";
     key: string;
+    source?: "login" | undefined;
 }, {}>;
 export declare const credentialSnapshotEntrySchema: import("arktype/internal/variants/object.ts").ObjectType<{
     id: number;
@@ -82,6 +85,7 @@ export declare const credentialSnapshotEntrySchema: import("arktype/internal/var
     } | {
         type: "api_key";
         key: string;
+        source?: "login" | undefined;
     };
     identityKey: string | null;
 }, {}>;
@@ -109,6 +113,7 @@ export declare const snapshotEntrySchema: import("arktype/internal/variants/obje
     } | {
         type: "api_key";
         key: string;
+        source?: "login" | undefined;
     };
     identityKey: string | null;
     rotatesInMs: number | null;
@@ -153,6 +158,7 @@ export declare const snapshotResponseSchema: import("arktype/internal/variants/o
         } | {
             type: "api_key";
             key: string;
+            source?: "login" | undefined;
         };
         identityKey: string | null;
         rotatesInMs: number | null;
@@ -193,6 +199,7 @@ export declare const snapshotStreamSnapshotEventSchema: import("arktype/internal
         } | {
             type: "api_key";
             key: string;
+            source?: "login" | undefined;
         };
         identityKey: string | null;
         rotatesInMs: number | null;
@@ -234,6 +241,7 @@ export declare const snapshotStreamEntryEventSchema: import("arktype/internal/va
         } | {
             type: "api_key";
             key: string;
+            source?: "login" | undefined;
         };
         identityKey: string | null;
         rotatesInMs: number | null;
@@ -287,6 +295,7 @@ export declare const snapshotStreamEventSchema: import("arktype/internal/variant
         } | {
             type: "api_key";
             key: string;
+            source?: "login" | undefined;
         };
         identityKey: string | null;
         rotatesInMs: number | null;
@@ -326,6 +335,7 @@ export declare const snapshotStreamEventSchema: import("arktype/internal/variant
         } | {
             type: "api_key";
             key: string;
+            source?: "login" | undefined;
         };
         identityKey: string | null;
         rotatesInMs: number | null;
@@ -427,6 +437,7 @@ export declare const credentialRefreshResponseSchema: import("arktype/internal/v
         } | {
             type: "api_key";
             key: string;
+            source?: "login" | undefined;
         };
         identityKey: string | null;
     };
@@ -469,6 +480,7 @@ export declare const credentialUploadRequestSchema: import("arktype/internal/var
     } | {
         type: "api_key";
         key: string;
+        source?: "login" | undefined;
     };
 }, {}>;
 export declare const credentialUploadResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
@@ -490,6 +502,7 @@ export declare const credentialUploadResponseSchema: import("arktype/internal/va
         } | {
             type: "api_key";
             key: string;
+            source?: "login" | undefined;
         };
         identityKey: string | null;
     }[];

package/dist/types/error/rate-limit.d.ts

@@ -20,6 +20,9 @@ export declare function calculateRateLimitBackoffMs(reason: RateLimitReason): nu
 /**
  * HTTP status codes that, absent richer body classification, represent an
  * account-local usage cap rather than a bad credential or a transient blip.
+ * HTTP 402 Payment Required is categorically an account-billing cap (xAI
+ * Grok Build "usage balance exhausted", DeepSeek "Insufficient Balance",
+ * OpenRouter credit exhaustion) — never a transient blip or bad credential.
  * Always combine with {@link isUsageLimitOutcome} when a message is available
  * — a 429 carrying transient rate-limit wording is NOT a usage cap.
  */
@@ -31,7 +34,7 @@ export declare function isUsageLimitStatus(status: number | undefined): boolean;
  *  1. Body matches {@link isUsageLimitError} (Codex `usage_limit_reached`,
  *     Anthropic account rate-limit, Google `resource_exhausted`, OpenAI
  *     `insufficient_quota`, …) → rotate.
- *  2. Status is not 429 → backoff (caller's domain).
+ *  2. Status is not a usage-limit status (429/402) → backoff (caller's domain).
  *  3. Body is absent or {@link isOpaqueStatusBody opaque} (just the status,
  *     empty JSON, HTTP framing only) → rotate conservatively: the server
  *     gave us nothing else to go on.
@@ -44,10 +47,11 @@ export declare function isUsageLimitStatus(status: number | undefined): boolean;
  */
 export declare function isUsageLimitOutcome(status: number | undefined, message: string | undefined): boolean;
 /**
- * A 429 body is opaque when it carries no signal beyond the status itself —
- * empty, whitespace-only, the status digits with HTTP/JSON framing, or
- * generic punctuation. Anything else (retry hints, capacity wording, error
- * descriptions) is informative enough to defer to the classifier.
+ * A usage-limit status body is opaque when it carries no signal beyond the
+ * status itself — empty, whitespace-only, the status digits with HTTP/JSON
+ * framing, or generic punctuation. Anything else (retry hints, capacity
+ * wording, error descriptions) is informative enough to defer to the
+ * classifier.
  */
 export declare function isOpaqueStatusBody(message: string): boolean;
 /**

package/dist/types/providers/cursor.d.ts

@@ -29,6 +29,8 @@ export interface BlockState {
         [kStreamingBlockIndex]: number;
     }) | null;
     currentToolCall: ToolCallState | null;
+    /** MCP call IDs executed through Cursor's exec channel before their stream block arrives. */
+    resolvedMcpToolCallIds: Set<string>;
     firstTokenTime: number | undefined;
     setTextBlock: (b: (TextContent & {
         [kStreamingBlockIndex]: number;

package/dist/types/providers/openai-codex/request-transformer.d.ts

@@ -77,6 +77,7 @@ export declare function resolveCodexResponsesLite(model: Model<"openai-codex-res
 export interface CodexLiteShapedBody {
     instructions?: unknown;
     tools?: unknown;
+    tool_choice?: unknown;
     input?: unknown;
     parallel_tool_calls?: unknown;
 }
@@ -85,9 +86,14 @@ export interface CodexLiteShapedBody {
  * `build_responses_request` with `use_responses_lite`): strips pinned image
  * detail, forces parallel tool calling off, moves tools into a leading
  * `additional_tools` developer item and the base instructions into a
- * developer message, then omits top-level `instructions`/`tools`. Shared by
- * normal turns and both remote-compaction paths — codex-rs routes
- * `/responses/compact` through the same builder.
+ * developer message, then omits top-level `instructions`/`tools`. Because the
+ * rewrite removes top-level `tools`, a forced hosted-tool choice (e.g.
+ * `{ type: "web_search" }`) would leave the backend unable to validate the
+ * choice against a tools collection and it rejects the request with HTTP 400
+ * (#5771). Such choices must fall back to `"auto"`; explicit string constraints
+ * such as `"none"` and `"required"` remain valid. Shared by normal turns and
+ * both remote-compaction paths — codex-rs routes `/responses/compact` through
+ * the same builder.
  */
 export declare function applyCodexResponsesLiteShape(body: CodexLiteShapedBody): void;
 export declare function transformRequestBody(body: RequestBody, model: Model<"openai-codex-responses">, options?: CodexRequestOptions, prompt?: {

package/dist/types/providers/openai-shared.d.ts

@@ -297,12 +297,14 @@ export declare function applyChatCompletionsReasoningParams(params: OpenAIComple
 }) | undefined): void;
 export declare function disableChatCompletionsReasoningForDialect(params: OpenAICompletionsParams, compat: ResolvedOpenAICompat): void;
 /**
- * Output-token clamp for the Z.AI/GLM-5.2 reasoning dialect: these hosts accept
- * the full model window on reasoning turns, so clamp to the model cap. Returns
- * `undefined` for every other model, leaving {@link resolveOpenAIOutputTokenParam}
- * on its default `OPENAI_MAX_OUTPUT_TOKENS` clamp.
+ * Provider-specific Chat Completions output clamp.
+ *
+ * Most OpenAI-compatible endpoints retain the conservative 64k ceiling from
+ * {@link resolveOpenAIOutputTokenParam}. Z.AI/GLM-5.2 reasoning and native
+ * Moonshot K3 explicitly accept their full advertised model caps, so those
+ * routes clamp to `model.maxTokens` instead.
  */
-export declare function resolveZaiReasoningOutputClamp(model: Model<"openai-completions">, compat: ResolvedOpenAICompat): number | undefined;
+export declare function resolveOpenAICompletionsOutputClamp(model: Model<"openai-completions">, compat: ResolvedOpenAICompat): number | undefined;
 /**
  * Enable `tool_stream` for Z.AI/GLM-5.2 reasoning models when tools are present
  * (GLM-5.2 streams tool-call arguments incrementally and needs the flag to do so).

package/dist/types/providers/transform-messages.d.ts

@@ -1,11 +1,7 @@
 import type { Api, AssistantMessage, Message, Model } from "../types.js";
-/**
- * Normalize tool call ID for cross-provider compatibility.
- * OpenAI Responses API generates IDs that are 450+ chars with special characters like `|`.
- * Anthropic APIs require IDs matching ^[a-zA-Z0-9_-]+$ (max 64 chars).
- *
- * For aborted/errored turns, this function:
- * - Preserves tool call structure (unlike converting to text summaries)
- * - Injects synthetic "aborted" tool results
- */
+export declare function redactSensitiveCredentials(text: string): string;
+export declare function redactSensitiveInObject(val: unknown): {
+    result: unknown;
+    changed: boolean;
+};
 export declare function transformMessages<TApi extends Api>(messages: Message[], model: Model<TApi>, normalizeToolCallId?: (id: string, model: Model<TApi>, source: AssistantMessage) => string, maxNormalizedToolCallIdLength?: number, duplicateToolCallIdSuffixPrefix?: string, targetCompat?: Model<TApi>["compat"]): Message[];

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "17.0.1",
+	"version": "17.0.2",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.1",
-		"@oh-my-pi/pi-catalog": "17.0.1",
-		"@oh-my-pi/pi-utils": "17.0.1",
-		"@oh-my-pi/pi-wire": "17.0.1",
+		"@oh-my-pi/pi-catalog": "17.0.2",
+		"@oh-my-pi/pi-utils": "17.0.2",
+		"@oh-my-pi/pi-wire": "17.0.2",
 		"arktype": "2.2.3",
 		"zod": "^4"
 	},

package/src/auth-broker/wire-schemas.ts

@@ -55,6 +55,7 @@ export const apiKeyCredentialSchema = type({
 	"+": "reject",
 	type: "'api_key'",
 	key: type("string").atLeastLength(1),
+	"source?": "'login'",
 });
 
 /** Discriminated union accepted on POST /v1/credential (writes). */

package/src/dialect/thinking.ts

@@ -32,6 +32,16 @@ export class ThinkingInbandScanner implements InbandScanner {
 	#thinking = "";
 	/** Fence-aware close-matcher while inside a ` ```thinking ` block; undefined otherwise. */
 	#fenced: FencedThinkingScanner | undefined;
+	/** Backtick count that opened the Markdown code span/fence we are inside; 0 when not in code. */
+	#codeTicks = 0;
+	/** True when {@link #codeTicks} opened a fenced block (closes on a fence line), not an inline span. */
+	#codeFenced = false;
+	/**
+	 * Leading-space count on the current output line, or -1 once a non-space
+	 * character has appeared. Starts at 0 (line start) so a fence opening the
+	 * stream — or one indented ≤3 spaces, as CommonMark allows — is recognized.
+	 */
+	#lineIndent = 0;
 
 	feed(text: string): InbandScanEvent[] {
 		if (text.length === 0) return [];
@@ -86,25 +96,93 @@ export class ThinkingInbandScanner implements InbandScanner {
 				this.#closeTag = "";
 				continue;
 			}
+			if (this.#codeTicks > 0) {
+				if (this.#emitCode(final, events)) continue;
+				break;
+			}
 
-			const tag = findEarliestOpen(this.#buffer);
-			if (!tag) {
-				const hold = final ? 0 : partialSuffixOverlapAny(this.#buffer, OPENS);
-				const emit = this.#buffer.slice(0, this.#buffer.length - hold);
-				if (emit.length > 0) events.push({ type: "text", text: emit });
-				this.#buffer = this.#buffer.slice(this.#buffer.length - hold);
+			const hit = scanVisible(this.#buffer, final);
+			if (hit.kind === "none") {
+				this.#emitText(this.#buffer, events);
+				this.#buffer = "";
+				break;
+			}
+			if (hit.index > 0) this.#emitText(this.#buffer.slice(0, hit.index), events);
+			if (hit.kind === "hold") {
+				this.#buffer = this.#buffer.slice(hit.index);
 				break;
 			}
-			if (tag.index > 0) events.push({ type: "text", text: this.#buffer.slice(0, tag.index) });
-			this.#buffer = this.#buffer.slice(tag.index + tag.open.length);
-			this.#closeTag = tag.close;
+			if (hit.kind === "code") {
+				const fenced = hit.ticks >= 3 && this.#lineIndent >= 0 && this.#lineIndent <= 3;
+				this.#emitText(this.#buffer.slice(hit.index, hit.index + hit.ticks), events);
+				this.#buffer = this.#buffer.slice(hit.index + hit.ticks);
+				this.#codeTicks = hit.ticks;
+				this.#codeFenced = fenced;
+				continue;
+			}
+			this.#buffer = this.#buffer.slice(hit.index + hit.tag.open.length);
+			this.#closeTag = hit.tag.close;
 			this.#thinking = "";
-			if (tag.fenced) this.#fenced = new FencedThinkingScanner();
+			if (hit.tag.fenced) this.#fenced = new FencedThinkingScanner();
 			events.push({ type: "thinkingStart" });
 		}
 		return events;
 	}
 
+	/**
+	 * Emit buffered content while inside a Markdown code region, suppressing
+	 * reasoning-tag detection. A fenced block closes only on a fence line (a line
+	 * of backticks ≥ the opener); an inline span closes on the first backtick run
+	 * of exactly the opener length. Returns true when the region closed and the
+	 * loop should continue, false when it held back and should break.
+	 */
+	#emitCode(final: boolean, events: InbandScanEvent[]): boolean {
+		if (this.#codeFenced) {
+			const end = findFenceCloseEnd(this.#buffer, this.#codeTicks, final);
+			if (end !== -1) {
+				this.#emitText(this.#buffer.slice(0, end), events);
+				this.#buffer = this.#buffer.slice(end);
+				this.#codeTicks = 0;
+				this.#codeFenced = false;
+				return true;
+			}
+			if (final) {
+				this.#emitText(this.#buffer, events);
+				this.#buffer = "";
+				this.#codeTicks = 0;
+				this.#codeFenced = false;
+				return false;
+			}
+			// Stream committed lines; hold only the last (possibly partial) fence line.
+			const lastNl = this.#buffer.lastIndexOf("\n");
+			if (lastNl !== -1) {
+				this.#emitText(this.#buffer.slice(0, lastNl + 1), events);
+				this.#buffer = this.#buffer.slice(lastNl + 1);
+			}
+			return false;
+		}
+		const close = findBacktickRun(this.#buffer, 0, this.#codeTicks);
+		if (close !== -1 && (final || close + this.#codeTicks < this.#buffer.length)) {
+			this.#emitText(this.#buffer.slice(0, close + this.#codeTicks), events);
+			this.#buffer = this.#buffer.slice(close + this.#codeTicks);
+			this.#codeTicks = 0;
+			return true;
+		}
+		// No committed close yet: emit text, holding a trailing backtick run that
+		// may still grow into — or past — the closing delimiter.
+		const hold = final ? 0 : trailingBacktickRun(this.#buffer);
+		this.#emitText(this.#buffer.slice(0, this.#buffer.length - hold), events);
+		this.#buffer = this.#buffer.slice(this.#buffer.length - hold);
+		if (final) this.#codeTicks = 0;
+		return false;
+	}
+
+	#emitText(text: string, events: InbandScanEvent[]): void {
+		if (text.length === 0) return;
+		events.push({ type: "text", text });
+		this.#lineIndent = trailingLineIndent(text, this.#lineIndent);
+	}
+
 	#emitThinking(delta: string, events: InbandScanEvent[]): void {
 		if (delta.length === 0) return;
 		this.#thinking += delta;
@@ -112,11 +190,103 @@ export class ThinkingInbandScanner implements InbandScanner {
 	}
 }
 
-function findEarliestOpen(buffer: string): (Tag & { index: number }) | undefined {
-	let best: (Tag & { index: number }) | undefined;
-	for (const tag of TAGS) {
-		const index = buffer.indexOf(tag.open);
-		if (index !== -1 && (!best || index < best.index)) best = { ...tag, index };
+/** Outcome of scanning idle visible text for the next reasoning-tag or code-span boundary. */
+type VisibleHit =
+	| { readonly kind: "tag"; readonly index: number; readonly tag: Tag }
+	| { readonly kind: "code"; readonly index: number; readonly ticks: number }
+	| { readonly kind: "hold"; readonly index: number }
+	| { readonly kind: "none" };
+
+/**
+ * Walk idle visible text for the earliest boundary: a leaked reasoning-tag open,
+ * a Markdown code-span/fence opener (a backtick run), or — when more chunks may
+ * follow — a held partial delimiter at the buffer tail.
+ *
+ * Reasoning tags win at any position so the gemini ` ```thinking ` fence is
+ * healed instead of being read as a code fence. Backtick runs enter code mode so
+ * a literal `<think>` inside inline code or a fenced block stays visible text.
+ */
+function scanVisible(buffer: string, final: boolean): VisibleHit {
+	for (let i = 0; i < buffer.length; i++) {
+		const tag = TAGS.find(candidate => buffer.startsWith(candidate.open, i));
+		if (tag) return { kind: "tag", index: i, tag };
+		if (!final) {
+			const rest = buffer.slice(i);
+			if (OPENS.some(open => open.length > rest.length && open.startsWith(rest))) {
+				return { kind: "hold", index: i };
+			}
+		}
+		if (buffer[i] === "`") {
+			const ticks = backtickRun(buffer, i);
+			if (!final && i + ticks === buffer.length) return { kind: "hold", index: i };
+			return { kind: "code", index: i, ticks };
+		}
+	}
+	return { kind: "none" };
+}
+
+/** Length of the maximal backtick run beginning at `from`. */
+function backtickRun(buffer: string, from: number): number {
+	let end = from;
+	while (end < buffer.length && buffer[end] === "`") end++;
+	return end - from;
+}
+
+/** Index of the first maximal backtick run of exactly `ticks` at/after `from`, else -1. */
+function findBacktickRun(buffer: string, from: number, ticks: number): number {
+	for (let i = buffer.indexOf("`", from); i !== -1; i = buffer.indexOf("`", i)) {
+		const run = backtickRun(buffer, i);
+		if (run === ticks) return i;
+		i += run;
 	}
-	return best;
+	return -1;
+}
+
+/** Length of a backtick run that ends at the buffer tail; 0 when the tail is not a backtick. */
+function trailingBacktickRun(buffer: string): number {
+	let start = buffer.length;
+	while (start > 0 && buffer[start - 1] === "`") start--;
+	return buffer.length - start;
+}
+
+/**
+ * Leading-space count of the line at the tail of `text`, continuing from the
+ * prior line's `indent` state (see {@link ThinkingInbandScanner.#lineIndent}).
+ * Returns -1 once any non-space character has appeared on the current line.
+ */
+function trailingLineIndent(text: string, prior: number): number {
+	const lastNl = text.lastIndexOf("\n");
+	let indent = lastNl === -1 ? prior : 0;
+	for (let i = lastNl + 1; i < text.length; i++) {
+		if (indent === -1) break;
+		indent = text[i] === " " ? indent + 1 : -1;
+	}
+	return indent;
+}
+
+/**
+ * Index just past the first closing fence line for a fenced block opened with
+ * `ticks` backticks, or -1 when none is committed yet. A closing fence is a whole
+ * line whose trimmed content is only backticks, at least `ticks` of them. A line
+ * without a terminating newline is committed only when `final` (no more input can
+ * extend it into a non-fence line).
+ */
+function findFenceCloseEnd(buffer: string, ticks: number, final: boolean): number {
+	for (let start = 0; start <= buffer.length; ) {
+		const nl = buffer.indexOf("\n", start);
+		const terminated = nl !== -1;
+		const line = buffer.slice(start, terminated ? nl : buffer.length).trim();
+		if (line.length >= ticks && isAllBackticks(line) && (terminated || final)) {
+			return terminated ? nl + 1 : buffer.length;
+		}
+		if (!terminated) break;
+		start = nl + 1;
+	}
+	return -1;
+}
+
+/** True when `text` is non-empty and every character is a backtick. */
+function isAllBackticks(text: string): boolean {
+	for (let i = 0; i < text.length; i++) if (text[i] !== "`") return false;
+	return text.length > 0;
 }

package/src/error/flags.ts

@@ -7,7 +7,7 @@ import {
 	ProviderHttpError,
 	STREAM_ENVELOPE_ERROR_PREFIX,
 } from "./classes";
-import { isOpaqueStatusBody, matchesUsageLimitText, parseRateLimitReason } from "./rate-limit";
+import { isOpaqueStatusBody, isUsageLimitStatus, matchesUsageLimitText, parseRateLimitReason } from "./rate-limit";
 
 export const Flag = {
 	Class: 0x1000,
@@ -318,7 +318,7 @@ function classifyText(errorMessage: string | undefined, errorStatus: number | un
 		const cleanMessage = errorMessage;
 		const isOpaque = isOpaqueStatusBody(cleanMessage);
 
-		const isLimitStatus = statusClean === 429;
+		const isLimitStatus = isUsageLimitStatus(statusClean);
 		if (
 			matchesUsageLimitText(cleanMessage) ||
 			(isLimitStatus && (isOpaque || parseRateLimitReason(cleanMessage) === "QUOTA_EXHAUSTED"))

package/src/error/rate-limit.ts

@@ -116,16 +116,19 @@ export function calculateRateLimitBackoffMs(reason: RateLimitReason): number {
 
 /** Detect usage/quota limit errors in error messages (persistent, requires credential switch). */
 const USAGE_LIMIT_PATTERN =
-	/usage.?limit|usage_limit_reached|usage_not_included|limit_reached|quota.?(?:exceeded|reached|insufficient)|额度不足|额度耗尽|resource.?exhausted|exhausted your capacity|quota will reset|insufficient.?(?:balance|quota)|run out of credits|out of credits|spending[- _]?limit|personal-team-blocked/i;
+	/usage.?limit|usage_limit_reached|usage_not_included|limit_reached|quota.?(?:exceeded|reached|insufficient)|额度不足|额度耗尽|resource.?exhausted|exhausted your capacity|quota will reset|insufficient.?(?:balance|quota)|balance.?exhausted|run out of credits|out of credits|spending[- _]?limit|personal-team-blocked/i;
 
 /**
  * HTTP status codes that, absent richer body classification, represent an
  * account-local usage cap rather than a bad credential or a transient blip.
+ * HTTP 402 Payment Required is categorically an account-billing cap (xAI
+ * Grok Build "usage balance exhausted", DeepSeek "Insufficient Balance",
+ * OpenRouter credit exhaustion) — never a transient blip or bad credential.
  * Always combine with {@link isUsageLimitOutcome} when a message is available
  * — a 429 carrying transient rate-limit wording is NOT a usage cap.
  */
 export function isUsageLimitStatus(status: number | undefined): boolean {
-	return status === 429;
+	return status === 429 || status === 402;
 }
 
 /**
@@ -135,7 +138,7 @@ export function isUsageLimitStatus(status: number | undefined): boolean {
  *  1. Body matches {@link isUsageLimitError} (Codex `usage_limit_reached`,
  *     Anthropic account rate-limit, Google `resource_exhausted`, OpenAI
  *     `insufficient_quota`, …) → rotate.
- *  2. Status is not 429 → backoff (caller's domain).
+ *  2. Status is not a usage-limit status (429/402) → backoff (caller's domain).
  *  3. Body is absent or {@link isOpaqueStatusBody opaque} (just the status,
  *     empty JSON, HTTP framing only) → rotate conservatively: the server
  *     gave us nothing else to go on.
@@ -154,14 +157,15 @@ export function isUsageLimitOutcome(status: number | undefined, message: string
 }
 
 /**
- * A 429 body is opaque when it carries no signal beyond the status itself —
- * empty, whitespace-only, the status digits with HTTP/JSON framing, or
- * generic punctuation. Anything else (retry hints, capacity wording, error
- * descriptions) is informative enough to defer to the classifier.
+ * A usage-limit status body is opaque when it carries no signal beyond the
+ * status itself — empty, whitespace-only, the status digits with HTTP/JSON
+ * framing, or generic punctuation. Anything else (retry hints, capacity
+ * wording, error descriptions) is informative enough to defer to the
+ * classifier.
  */
 export function isOpaqueStatusBody(message: string): boolean {
 	const cleaned = message
-		.replace(/\b429\b/g, "")
+		.replace(/\b(?:429|402)\b/g, "")
 		.replace(/\b(?:http|https|status|error|code|response|message)\b/gi, "");
 	return !/[a-z\d]{3,}/i.test(cleaned);
 }

package/src/providers/__tests__/kimi-code-thinking.test.ts

@@ -1,7 +1,9 @@
-import { describe, expect, it } from "bun:test";
+import { afterEach, describe, expect, it, vi } from "bun:test";
 import { getBundledModel } from "@oh-my-pi/pi-catalog";
+import * as kimiOauth from "../../registry/oauth/kimi";
 import type { Context } from "../../types";
 import type { MessageCreateParamsStreaming } from "../anthropic-wire";
+import { streamKimi } from "../kimi";
 import { streamOpenAIAnthropicShim } from "../openai-anthropic-shim";
 import {
 	applyChatCompletionsCompatPolicy,
@@ -10,6 +12,15 @@ import {
 } from "../openai-shared";
 
 const BASE_CHAT_COMPLETIONS_PARAMS: OpenAICompletionsParams = { messages: [], model: "unused", stream: true };
+const KIMI_HEADERS = Object.freeze({
+	"User-Agent": "KimiCLI/test",
+	"X-Msh-Platform": "kimi_cli",
+	"X-Msh-Version": "test",
+	"X-Msh-Device-Name": "test",
+	"X-Msh-Device-Model": "test",
+	"X-Msh-Os-Version": "test",
+	"X-Msh-Device-Id": "test",
+});
 const TITLE_CONTEXT: Context = {
 	systemPrompt: ["Generate a title."],
 	messages: [{ role: "user", content: "Explain the login failure", timestamp: 0 }],
@@ -27,8 +38,12 @@ const TITLE_CONTEXT: Context = {
 	],
 };
 
+afterEach(() => {
+	vi.restoreAllMocks();
+});
+
 describe("Kimi K2.7 Code thinking policy", () => {
-	it("omits disabled thinking for title-generator-style Kimi Code requests", () => {
+	it("expresses disabled thinking explicitly for title-generator-style Kimi Code requests", () => {
 		const model = getBundledModel<"openai-completions">("kimi-code", "kimi-for-coding");
 		const policy = resolveOpenAICompatPolicy(model, {
 			endpoint: "chat-completions",
@@ -39,11 +54,16 @@ describe("Kimi K2.7 Code thinking policy", () => {
 
 		applyChatCompletionsCompatPolicy(params, policy);
 
-		expect("thinking" in params).toBe(false);
-		expect(model.compat.supportsForcedToolChoice).toBe(false);
+		// Kimi's native hosts speak the z.ai binary thinking field: a disabled
+		// request carries `{ type: "disabled" }` rather than omitting the block.
+		expect((params as Record<string, unknown>).thinking).toEqual({ type: "disabled" });
+		// Thinking yields to a forced tool choice (#5758 review): the choice is
+		// honored and reasoning is turned off, instead of downgrading the choice.
+		expect(model.compat.supportsForcedToolChoice).toBe(true);
+		expect(model.compat.disableReasoningOnForcedToolChoice).toBe(true);
 	});
 
-	it("enables thinking and downgrades forced tool choice on Kimi Code's Anthropic endpoint", async () => {
+	it("keeps the forced tool choice and omits thinking on Kimi Code's Anthropic endpoint", async () => {
 		const model = getBundledModel<"openai-completions">("kimi-code", "kimi-for-coding");
 		let payload: MessageCreateParamsStreaming | undefined;
 		const stream = streamOpenAIAnthropicShim(
@@ -67,8 +87,43 @@ describe("Kimi K2.7 Code thinking policy", () => {
 
 		await stream.result();
 
-		expect(payload?.thinking?.type).toBe("enabled");
-		expect(payload?.tool_choice).toEqual({ type: "auto" });
+		// With reasoning disabled the Anthropic wire carries no thinking block,
+		// and the forced tool choice survives (thinking yields to the choice).
+		expect(payload?.thinking).toBeUndefined();
+		expect(payload?.tool_choice).toEqual({ type: "tool", name: "set_title" });
+	});
+
+	it("uses the configured Kimi base URL for Anthropic requests", async () => {
+		vi.spyOn(kimiOauth, "getKimiCommonHeaders").mockReturnValue(KIMI_HEADERS);
+		const bundledModel = getBundledModel<"openai-completions">("kimi-code", "kimi-for-coding");
+		const model = { ...bundledModel, baseUrl: "https://gateway.example.com/v1" };
+		let requestedUrl: string | undefined;
+		const stream = streamKimi(
+			model,
+			{
+				systemPrompt: [],
+				messages: [{ role: "user", content: "Reply OK", timestamp: 0 }],
+				tools: [],
+			},
+			{
+				format: "anthropic",
+				apiKey: "gateway-key",
+				fetch: async input => {
+					requestedUrl = String(input);
+					return new Response(
+						JSON.stringify({
+							type: "error",
+							error: { type: "authentication_error", message: "stop after URL capture" },
+						}),
+						{ status: 401, headers: { "content-type": "application/json" } },
+					);
+				},
+			},
+		);
+
+		await stream.result();
+
+		expect(requestedUrl).toBe("https://gateway.example.com/v1/messages");
 	});
 
 	it("omits disabled thinking for native Moonshot Kimi K2.7 Code variants", () => {

package/src/providers/cursor.ts

@@ -352,7 +352,30 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 		let heartbeatTimer: NodeJS.Timeout | null = null;
 		let debugResponseLogPromise: Promise<RequestDebugResponseLog | undefined> | undefined;
 		const h2Completion = Promise.withResolvers<void>();
-		let resolveH2: (() => void) | undefined = h2Completion.resolve;
+		let h2Settled = false;
+		let sawTurnEnded = false;
+		let endStreamError: Error | null = null;
+		const settleH2 = (error?: unknown): void => {
+			if (h2Settled) return;
+			h2Settled = true;
+			if (error !== undefined) {
+				h2Completion.reject(error);
+				return;
+			}
+			if (endStreamError) {
+				h2Completion.reject(endStreamError);
+				return;
+			}
+			if (!sawTurnEnded) {
+				h2Completion.reject(
+					new AIError.ProviderResponseError("Cursor stream ended before turnEnded", {
+						kind: "incomplete-stream",
+					}),
+				);
+				return;
+			}
+			h2Completion.resolve();
+		};
 
 		try {
 			const apiKey = options?.apiKey;
@@ -408,17 +431,17 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 			} else {
 				h2Client = http2.connect(baseUrl);
 			}
-			h2Client.on("error", h2Completion.reject);
+			h2Client.on("error", error => settleH2(error));
 
 			h2Request = h2Client.request(requestHeaders);
 
 			stream.push({ type: "start", partial: output });
 
 			let pendingBuffer = Buffer.alloc(0);
-			let endStreamError: Error | null = null;
 			let currentTextBlock: (TextContent & { [kStreamingBlockIndex]: number }) | null = null;
 			let currentThinkingBlock: (ThinkingContent & { [kStreamingBlockIndex]: number }) | null = null;
 			let currentToolCall: ToolCallState | null = null;
+			const resolvedMcpToolCallIds = new Set<string>();
 			const usageState: UsageState = { sawTokenDelta: false };
 
 			const state: BlockState = {
@@ -431,6 +454,7 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 				get currentToolCall() {
 					return currentToolCall;
 				},
+				resolvedMcpToolCallIds,
 				get firstTokenTime() {
 					return firstTokenTime;
 				},
@@ -505,12 +529,9 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 							log("error", "handleServerMessage", { error: String(error) });
 						});
 
-						// Resolve only on explicit turnEnded. stopReason defaults to "stop"
-						// and is not a reliable signal for stream completion.
-						if (isTurnEnded && resolveH2) {
-							const r = resolveH2;
-							resolveH2 = undefined;
-							r();
+						// Application completion is not protocol success; wait for a clean HTTP/2 end.
+						if (isTurnEnded) {
+							sawTurnEnded = true;
 						}
 					} catch (e) {
 						log("error", "parseServerMessage", { error: String(e) });
@@ -537,40 +558,29 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 			h2Request.on("trailers", trailers => {
 				const status = trailers["grpc-status"];
 				const msg = trailers["grpc-message"];
-				if (status && status !== "0") {
-					void closeDebugLog().finally(() => {
-						h2Completion.reject(
-							new AIError.ProviderResponseError(
-								`gRPC error ${status}: ${decodeURIComponent(String(msg || ""))}`,
-								{ kind: "envelope" },
-							),
-						);
-					});
+				if (status && status !== "0" && !endStreamError) {
+					endStreamError = new AIError.ProviderResponseError(
+						`gRPC error ${status}: ${decodeURIComponent(String(msg || ""))}`,
+						{ kind: "envelope" },
+					);
 				}
 			});
 
 			h2Request.on("end", () => {
-				resolveH2 = undefined;
 				void closeDebugLog()
-					.then(() => {
-						if (endStreamError) {
-							h2Completion.reject(endStreamError);
-							return;
-						}
-						h2Completion.resolve();
-					})
-					.catch(h2Completion.reject);
+					.then(() => settleH2())
+					.catch(error => settleH2(error));
 			});
 
 			h2Request.on("error", error => {
-				void closeDebugLog().finally(() => h2Completion.reject(error));
+				void closeDebugLog().finally(() => settleH2(error));
 			});
 
 			if (options?.signal) {
 				options.signal.addEventListener("abort", () => {
 					h2Request?.close();
 					void closeDebugLog().finally(() => {
-						h2Completion.reject(new AIError.AbortError());
+						settleH2(new AIError.AbortError());
 					});
 				});
 			}
@@ -640,6 +650,8 @@ export interface BlockState {
 	currentTextBlock: (TextContent & { [kStreamingBlockIndex]: number }) | null;
 	currentThinkingBlock: (ThinkingContent & { [kStreamingBlockIndex]: number }) | null;
 	currentToolCall: ToolCallState | null;
+	/** MCP call IDs executed through Cursor's exec channel before their stream block arrives. */
+	resolvedMcpToolCallIds: Set<string>;
 	firstTokenTime: number | undefined;
 	setTextBlock: (b: (TextContent & { [kStreamingBlockIndex]: number }) | null) => void;
 	setThinkingBlock: (b: (ThinkingContent & { [kStreamingBlockIndex]: number }) | null) => void;
@@ -1292,6 +1304,13 @@ async function handleExecServerMessage(
 		case "mcpArgs": {
 			const args = execMsg.message.value;
 			const mcpCall = decodeMcpCall(args);
+			if (execHandlers?.mcp) {
+				if (state.currentToolCall?.id === mcpCall.toolCallId) {
+					state.currentToolCall[kCursorExecResolved] = true;
+				} else {
+					state.resolvedMcpToolCallIds.add(mcpCall.toolCallId);
+				}
+			}
 			const { execResult } = await resolveExecHandler(
 				mcpCall,
 				execHandlers?.mcp?.bind(execHandlers),
@@ -2217,15 +2236,19 @@ export function processInteractionUpdate(
 			const mcpCall = toolCall.mcpToolCall;
 			if (mcpCall) {
 				const args = mcpCall.args || {};
+				const id = args.toolCallId || crypto.randomUUID();
 				const block: ToolCallState = {
 					type: "toolCall",
-					id: args.toolCallId || crypto.randomUUID(),
+					id,
 					name: args.name || args.toolName || "",
 					arguments: {},
 					[kStreamingBlockIndex]: output.content.length,
 					[kStreamingPartialJson]: "",
 					[kStreamingBlockKind]: "mcp",
 				};
+				if (state.resolvedMcpToolCallIds.delete(id)) {
+					block[kCursorExecResolved] = true;
+				}
 				output.content.push(block);
 				state.setToolCall(block);
 				stream.push({ type: "toolcall_start", contentIndex: output.content.length - 1, partial: output });

package/src/providers/gitlab-duo-workflow.ts

@@ -24,6 +24,7 @@ import { normalizeSystemPrompts } from "../utils";
 import { AssistantMessageEventStream } from "../utils/event-stream";
 import { toolWireSchema } from "../utils/schema/wire";
 import chatmlHistoryNote from "./gitlab-duo-workflow-chatml-note.md" with { type: "text" };
+import { redactSensitiveCredentials } from "./transform-messages";
 
 export const GITLAB_DUO_WORKFLOW_PROVIDER_ID = "gitlab-duo-agent";
 export const GITLAB_DUO_WORKFLOW_API = "gitlab-duo-agent";
@@ -2581,10 +2582,13 @@ function isGitLabDuoWorkflowChatMlGoal(context: Context): boolean {
 // conversation sequences the way `Human:`/`Assistant:` are.
 function buildGitLabDuoWorkflowGoal(context: Context): string {
 	const conversation = buildGitLabDuoWorkflowConversationHistory(context.messages);
+	// The goal transcript bypasses transformMessages, so apply the outbound
+	// credential redaction here — the same scrub the flow-config system slot
+	// already receives — before the payload leaves the process.
 	if (conversation.length <= 1) {
-		return extractLatestUserPrompt(context.messages);
+		return redactSensitiveCredentials(extractLatestUserPrompt(context.messages));
 	}
-	return renderGitLabDuoWorkflowChatMl(conversation);
+	return redactSensitiveCredentials(renderGitLabDuoWorkflowChatMl(conversation));
 }
 
 const GITLAB_DUO_WORKFLOW_CHATML_START = "<|im_start|>";

package/src/providers/kimi.ts

@@ -20,9 +20,6 @@ import {
 
 export type KimiApiFormat = OpenAIAnthropicApiFormat;
 
-// Note: Anthropic SDK appends /v1/messages, so base URL should not include /v1
-const KIMI_ANTHROPIC_BASE_URL = "https://api.kimi.com/coding";
-
 export interface KimiOptions extends OpenAIAnthropicShimOptions {
 	/** API format: "openai" or "anthropic". Default: "anthropic" */
 	format?: KimiApiFormat;
@@ -38,7 +35,7 @@ export function streamKimi(
 	options?: KimiOptions,
 ): AssistantMessageEventStream {
 	return streamOpenAIAnthropicShim(model, context, options, {
-		anthropicBaseUrl: KIMI_ANTHROPIC_BASE_URL,
+		anthropicBaseUrl: model.baseUrl.replace(/\/v1\/?$/, ""),
 		defaultFormat: "anthropic",
 		extraHeaders: getKimiCommonHeaders,
 	});

package/src/providers/openai-codex/request-transformer.ts

@@ -269,6 +269,7 @@ function stripImageDetails(input: unknown[]): void {
 export interface CodexLiteShapedBody {
 	instructions?: unknown;
 	tools?: unknown;
+	tool_choice?: unknown;
 	input?: unknown;
 	parallel_tool_calls?: unknown;
 }
@@ -278,9 +279,14 @@ export interface CodexLiteShapedBody {
  * `build_responses_request` with `use_responses_lite`): strips pinned image
  * detail, forces parallel tool calling off, moves tools into a leading
  * `additional_tools` developer item and the base instructions into a
- * developer message, then omits top-level `instructions`/`tools`. Shared by
- * normal turns and both remote-compaction paths — codex-rs routes
- * `/responses/compact` through the same builder.
+ * developer message, then omits top-level `instructions`/`tools`. Because the
+ * rewrite removes top-level `tools`, a forced hosted-tool choice (e.g.
+ * `{ type: "web_search" }`) would leave the backend unable to validate the
+ * choice against a tools collection and it rejects the request with HTTP 400
+ * (#5771). Such choices must fall back to `"auto"`; explicit string constraints
+ * such as `"none"` and `"required"` remain valid. Shared by normal turns and
+ * both remote-compaction paths — codex-rs routes `/responses/compact` through
+ * the same builder.
  */
 export function applyCodexResponsesLiteShape(body: CodexLiteShapedBody): void {
 	const input = Array.isArray(body.input) ? body.input : [];
@@ -297,6 +303,9 @@ export function applyCodexResponsesLiteShape(body: CodexLiteShapedBody): void {
 		});
 	}
 	body.input = [...prefix, ...input];
+	if (body.tool_choice !== "none" && body.tool_choice !== "required") {
+		body.tool_choice = "auto";
+	}
 	delete body.instructions;
 	delete body.tools;
 }

package/src/providers/openai-codex-responses.ts

@@ -112,7 +112,7 @@ import {
 	promoteResponsesToolUseStopReason,
 	type SequentialCutoffSummaryState,
 } from "./openai-shared";
-import { transformMessages } from "./transform-messages";
+import { redactSensitiveInObject, transformMessages } from "./transform-messages";
 
 export interface OpenAICodexResponsesOptions extends StreamOptions {
 	reasoning?: "none" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
@@ -3954,13 +3954,14 @@ function convertMessages(model: Model<"openai-codex-responses">, context: Contex
 				| Array<ResponseInput[number]>
 				| undefined;
 			if (historyItems) {
-				for (const item of historyItems) {
+				const redactedHistoryItems = redactSensitiveInObject(historyItems).result as Array<ResponseInput[number]>;
+				for (const item of redactedHistoryItems) {
 					const maybe = item as { type?: string; call_id?: string };
 					if (maybe.type === "custom_tool_call" && typeof maybe.call_id === "string") {
 						customCallIds.add(maybe.call_id);
 					}
 				}
-				messages.push(...historyItems);
+				messages.push(...redactedHistoryItems);
 				msgIndex += 1;
 				continue;
 			}

package/src/providers/openai-completions.ts

@@ -94,9 +94,9 @@ import {
 	type OpenAIStrictToolsState,
 	parseAzureDeploymentNameMap,
 	resolveOpenAICompatPolicy,
+	resolveOpenAICompletionsOutputClamp,
 	resolveOpenAIOutputTokenParam,
 	resolveOpenAIRequestSetup,
-	resolveZaiReasoningOutputClamp,
 	shouldRetryWithoutStrictTools,
 } from "./openai-shared";
 import { transformMessages } from "./transform-messages";
@@ -1571,7 +1571,7 @@ function buildParams(
 		omitMaxOutputTokens: model.omitMaxOutputTokens ?? false,
 		isOpenRouterHost: compat.isOpenRouterHost,
 		alwaysSendMaxTokens: compat.alwaysSendMaxTokens,
-		providerOutputClamp: resolveZaiReasoningOutputClamp(model, compat),
+		providerOutputClamp: resolveOpenAICompletionsOutputClamp(model, compat),
 	});
 	if (outputToken) {
 		if (outputToken.field === "max_tokens") {

package/src/providers/openai-responses.ts

@@ -594,7 +594,11 @@ const streamOpenAIResponsesOnce = (
 						error instanceof Error &&
 						/previous[ _]?response/i.test(error.message) &&
 						/zero[ _-]?data[ _-]?retention/i.test(error.message);
-					if (!zdrRejection && !isOpenAIResponsesStalePreviousResponseError(error)) {
+					const isPromptBlocked =
+						error instanceof Error &&
+						((error as { code?: string }).code === "invalid_prompt" ||
+							/invalid_prompt|Request blocked/i.test(error.message));
+					if (!zdrRejection && !isPromptBlocked && !isOpenAIResponsesStalePreviousResponseError(error)) {
 						throw error;
 					}
 					// Server rejected the chain baseline: reset, count the failure (or

package/src/providers/openai-shared.ts

@@ -1,6 +1,6 @@
 import type { Effort } from "@oh-my-pi/pi-catalog/effort";
 import { toFirepassWireModelId, toFireworksWireModelId } from "@oh-my-pi/pi-catalog/fireworks-model-id";
-import { isGlm52ReasoningEffortModelId } from "@oh-my-pi/pi-catalog/identity";
+import { isGlm52ReasoningEffortModelId, isKimiK3ModelId } from "@oh-my-pi/pi-catalog/identity";
 import { getSupportedEfforts } from "@oh-my-pi/pi-catalog/model-thinking";
 import { calculateCost } from "@oh-my-pi/pi-catalog/models";
 import type {
@@ -1025,16 +1025,24 @@ function isZaiReasoningEffortDialect(model: Model<"openai-completions">, compat:
 }
 
 /**
- * Output-token clamp for the Z.AI/GLM-5.2 reasoning dialect: these hosts accept
- * the full model window on reasoning turns, so clamp to the model cap. Returns
- * `undefined` for every other model, leaving {@link resolveOpenAIOutputTokenParam}
- * on its default `OPENAI_MAX_OUTPUT_TOKENS` clamp.
+ * Provider-specific Chat Completions output clamp.
+ *
+ * Most OpenAI-compatible endpoints retain the conservative 64k ceiling from
+ * {@link resolveOpenAIOutputTokenParam}. Z.AI/GLM-5.2 reasoning and native
+ * Moonshot K3 explicitly accept their full advertised model caps, so those
+ * routes clamp to `model.maxTokens` instead.
  */
-export function resolveZaiReasoningOutputClamp(
+export function resolveOpenAICompletionsOutputClamp(
 	model: Model<"openai-completions">,
 	compat: ResolvedOpenAICompat,
 ): number | undefined {
-	return isZaiReasoningEffortDialect(model, compat) ? (model.maxTokens ?? OPENAI_MAX_OUTPUT_TOKENS) : undefined;
+	if (isZaiReasoningEffortDialect(model, compat)) {
+		return model.maxTokens ?? OPENAI_MAX_OUTPUT_TOKENS;
+	}
+	if (model.provider === "moonshot" && isKimiK3ModelId(model.id)) {
+		return model.maxTokens ?? OPENAI_MAX_OUTPUT_TOKENS;
+	}
+	return undefined;
 }
 
 /**

package/src/providers/transform-messages.ts

@@ -1,5 +1,14 @@
 import { renderDemotedThinking } from "../dialect/demotion";
-import type { Api, AssistantMessage, Message, Model, ToolCall, ToolResultMessage, UserMessage } from "../types";
+import type {
+	Api,
+	AssistantMessage,
+	DeveloperMessage,
+	Message,
+	Model,
+	ToolCall,
+	ToolResultMessage,
+	UserMessage,
+} from "../types";
 import { isDemotedThinking, kDemotedThinking } from "../utils/block-symbols";
 
 const enum ToolCallStatus {
@@ -286,6 +295,156 @@ function normalizeAnthropicTargetToolCallId<TApi extends Api>(
  * - Preserves tool call structure (unlike converting to text summaries)
  * - Injects synthetic "aborted" tool results
  */
+const SENSITIVE_TOKEN_RE =
+	/(?<![a-zA-Z0-9_*-])(gh[opusr]_[a-zA-Z0-9_*]{36,}|github_pat_[a-zA-Z0-9_*]{36,}|glpat-[a-zA-Z0-9_*-]{20,}|sk-proj-[a-zA-Z0-9_*-]{36,}|sk-ant-[a-zA-Z0-9_*-]{36,}|sk-[a-zA-Z0-9_*-]{48,})(?![a-zA-Z0-9_*-])/gi;
+
+function hasPlausibleCredentialEntropy(token: string): boolean {
+	const lower = token.toLowerCase();
+	const prefixLength = lower.startsWith("github_pat_")
+		? "github_pat_".length
+		: lower.startsWith("glpat-")
+			? "glpat-".length
+			: lower.startsWith("sk-proj-")
+				? "sk-proj-".length
+				: lower.startsWith("sk-ant-")
+					? "sk-ant-".length
+					: lower.startsWith("gh")
+						? 4
+						: 3;
+	const secret = token.slice(prefixLength);
+	if (/^\*+$/.test(secret)) return true;
+	return [/[a-z]/, /[A-Z]/, /\d/, /[_-]/].filter(pattern => pattern.test(secret)).length >= 2;
+}
+
+export function redactSensitiveCredentials(text: string): string {
+	return text.replace(SENSITIVE_TOKEN_RE, match => {
+		if (!hasPlausibleCredentialEntropy(match)) return match;
+		const lower = match.toLowerCase();
+		if (lower.startsWith("gh")) {
+			return "[github_token_redacted]";
+		}
+		if (lower.startsWith("gl")) {
+			return "[gitlab_token_redacted]";
+		}
+		if (lower.startsWith("sk-ant-")) {
+			return "[anthropic_token_redacted]";
+		}
+		if (lower.startsWith("sk")) {
+			return "[openai_token_redacted]";
+		}
+		return "[token_redacted]";
+	});
+}
+
+export function redactSensitiveInObject(val: unknown): { result: unknown; changed: boolean } {
+	if (typeof val === "string") {
+		const redacted = redactSensitiveCredentials(val);
+		return { result: redacted, changed: redacted !== val };
+	}
+	if (Array.isArray(val)) {
+		let changed = false;
+		const result = val.map(item => {
+			const res = redactSensitiveInObject(item);
+			if (res.changed) changed = true;
+			return res.result;
+		});
+		return { result, changed };
+	}
+	if (val !== null && typeof val === "object") {
+		let changed = false;
+		const res: Record<string, unknown> = {};
+		for (const [k, v] of Object.entries(val)) {
+			const sub = redactSensitiveInObject(v);
+			if (sub.changed) changed = true;
+			res[k] = sub.result;
+		}
+		return { result: res, changed };
+	}
+	return { result: val, changed: false };
+}
+
+function redactSensitiveCredentialsInMessages(messages: Message[]): Message[] {
+	return messages.map((msg): Message => {
+		if (msg.role === "user" || msg.role === "developer") {
+			const userMsg = msg as UserMessage | DeveloperMessage;
+			if (typeof userMsg.content === "string") {
+				const redacted = redactSensitiveCredentials(userMsg.content);
+				if (redacted === userMsg.content) return msg;
+				return { ...userMsg, content: redacted } as Message;
+			}
+			const contentArray = userMsg.content;
+			let changed = false;
+			const content = contentArray.map((block): UserMessage["content"][number] => {
+				if (block.type === "text") {
+					const redacted = redactSensitiveCredentials(block.text);
+					if (redacted !== block.text) {
+						changed = true;
+						return { ...block, text: redacted };
+					}
+				}
+				return block;
+			});
+			return (changed ? { ...userMsg, content } : userMsg) as Message;
+		}
+
+		if (msg.role === "toolResult") {
+			const toolResultMsg = msg as ToolResultMessage;
+			let changed = false;
+			const content = toolResultMsg.content.map((block): ToolResultMessage["content"][number] => {
+				if (block.type === "text") {
+					const redacted = redactSensitiveCredentials(block.text);
+					if (redacted !== block.text) {
+						changed = true;
+						return { ...block, text: redacted };
+					}
+				}
+				return block;
+			});
+			return (changed ? { ...toolResultMsg, content } : toolResultMsg) as Message;
+		}
+
+		if (msg.role === "assistant") {
+			const assistantMsg = msg as AssistantMessage;
+			let changed = false;
+			const content = assistantMsg.content.map((block): AssistantMessage["content"][number] => {
+				if (block.type === "text") {
+					const redacted = redactSensitiveCredentials(block.text);
+					if (redacted !== block.text) {
+						changed = true;
+						return { ...block, text: redacted };
+					}
+				} else if (block.type === "thinking") {
+					const redacted = redactSensitiveCredentials(block.thinking);
+					if (redacted !== block.thinking) {
+						changed = true;
+						return { ...block, thinking: redacted, thinkingSignature: undefined };
+					}
+				} else if (block.type === "toolCall") {
+					if (block.arguments) {
+						const { result: redactedArgs, changed: argsChanged } = redactSensitiveInObject(block.arguments);
+						if (argsChanged) {
+							changed = true;
+							const castArgs =
+								redactedArgs && typeof redactedArgs === "object" && !Array.isArray(redactedArgs)
+									? (redactedArgs as Record<string, unknown>)
+									: undefined;
+							return {
+								...block,
+								arguments: castArgs,
+								thoughtSignature: undefined,
+							} as AssistantMessage["content"][number];
+						}
+					}
+				}
+				return block;
+			});
+			return (changed ? { ...assistantMsg, content } : assistantMsg) as Message;
+		}
+
+		return msg;
+	});
+}
+
 export function transformMessages<TApi extends Api>(
 	messages: Message[],
 	model: Model<TApi>,
@@ -294,6 +453,10 @@ export function transformMessages<TApi extends Api>(
 	duplicateToolCallIdSuffixPrefix = "_dup",
 	targetCompat: Model<TApi>["compat"] = model.compat,
 ): Message[] {
+	// Redact sensitive credential-like patterns from all outbound messages
+	// to prevent security block errors from LLM providers (e.g. invalid_prompt).
+	messages = redactSensitiveCredentialsInMessages(messages);
+
 	// Drop assistant `toolCall` blocks with empty/whitespace `id` or `name`
 	// (and their matched `toolResult` messages) before anything else looks at
 	// the history. Replays of these would 400 every provider — see

package/src/utils.ts

@@ -1,5 +1,6 @@
 import { $env } from "@oh-my-pi/pi-utils";
 import type { ResponseInput, ResponseInputItem } from "./providers/openai-responses-wire";
+import { redactSensitiveCredentials } from "./providers/transform-messages";
 import type { CacheRetention, OpenAIResponsesHistoryPayload, ProviderPayload } from "./types";
 
 type OpenAIResponsesReplayItem = ResponseInput[number];
@@ -9,7 +10,9 @@ export { isRecord } from "@oh-my-pi/pi-utils";
 export function normalizeSystemPrompts(systemPrompt: readonly string[] | string | undefined | null): string[] {
 	if (systemPrompt === undefined || systemPrompt === null) return [];
 	const prompts = Array.isArray(systemPrompt) ? systemPrompt : typeof systemPrompt === "string" ? [systemPrompt] : [];
-	return prompts.map(prompt => prompt.toWellFormed()).filter(prompt => prompt.trim().length > 0);
+	return prompts
+		.map(prompt => redactSensitiveCredentials(prompt.toWellFormed()))
+		.filter(prompt => prompt.trim().length > 0);
 }
 
 export function normalizeToolCallId(id: string): string {