@oh-my-pi/pi-ai 17.0.1 → 17.0.3

package/CHANGELOG.md

@@ -2,9 +2,28 @@
 
 ## [Unreleased]
 
+## [17.0.3] - 2026-07-17
+
 ### Fixed
 
+- Replaced the opaque `h2 is not supported` failure on the Cursor run transport with an actionable error naming the ALPN-stripping proxy as the cause and pointing at the `providers.cursor.baseUrl` HTTP/2 bridge workaround. The run RPC is HTTP/2-only, so behind a TLS-intercepting proxy that strips ALPN (e.g. Zscaler) bun cannot negotiate `h2` and the completion cannot proceed ([#5828](https://github.com/can1357/oh-my-pi/issues/5828)).
+- Restored the `createAssistantMessageEventStream()` root export used by legacy provider extensions ([#5879](https://github.com/can1357/oh-my-pi/issues/5879)).
+- Fixed parallel Responses tool-result images interleaving synthetic user messages before all pending outputs, preventing strict OpenRouter/Moonshot backends from rejecting follow-up requests. ([#5850](https://github.com/can1357/oh-my-pi/issues/5850))
+- Fixed Kimi Code K3 requests to send native named efforts (`low`, `high`, `max`) and use adaptive effort rather than generic token budgets on explicit Anthropic transport overrides ([#5893](https://github.com/can1357/oh-my-pi/issues/5893)).
 - Automatically invalidate and rotate OAuth credentials when an "invalidated oauth token" error occurs
+- Fixed Anthropic usage reports treating the organization response header as the account identity, which caused the 5h/7d status-line segment to disappear for OAuth credentials without stored organization metadata. ([#5698](https://github.com/can1357/oh-my-pi/issues/5698))
+
+## [17.0.2] - 2026-07-17
+
+### Fixed
+
+- Automatically invalidate and rotate OAuth credentials when an "invalidated oauth token" error occurs.
+- Fixed auth-broker snapshot validation rejecting API keys stored via the `/login` flow, restoring support for gateway/broker setups serving login-sourced keys on custom hosts.
+- Fixed an issue where literal reasoning tags (e.g., `<think>`) inside Markdown code blocks or inline code were incorrectly treated as reasoning boundaries, which corrupted the rendered Markdown.
+- Classified HTTP 402 and "balance exhausted" quota responses as persistent usage limits, enabling automatic rotation of multi-account requests to a sibling credential.
+- Fixed `kimi-code` Anthropic-format requests ignoring custom provider base URLs.
+- Fixed an issue where GPT-5.6 Codex Responses-Lite requests failed with an HTTP 400 error due to invalid `tool_choice` parameters after tools were rewritten, by automatically downgrading forced hosted choices to `tool_choice: "auto"` while preserving explicit tool-use constraints.
+- Fixed Cursor streams prematurely reporting success before late CONNECT or gRPC terminal failures were observed, and resolved issues rejecting transport ends without a `turnEnded` signal.
 
 ## [17.0.1] - 2026-07-16
 

package/dist/types/auth-broker/wire-schemas.d.ts

@@ -29,6 +29,7 @@ export declare const remoteOauthCredentialSchema: import("arktype/internal/varia
 export declare const apiKeyCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
     type: "api_key";
     key: string;
+    source?: "login" | undefined;
 }, {}>;
 /** Discriminated union accepted on POST /v1/credential (writes). */
 export declare const writableAuthCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
@@ -46,6 +47,7 @@ export declare const writableAuthCredentialSchema: import("arktype/internal/vari
 } | {
     type: "api_key";
     key: string;
+    source?: "login" | undefined;
 }, {}>;
 /** Discriminated union returned in snapshots (refresh is sentinel for OAuth). */
 export declare const snapshotCredentialSchema: import("arktype/internal/variants/object.ts").ObjectType<{
@@ -63,6 +65,7 @@ export declare const snapshotCredentialSchema: import("arktype/internal/variants
 } | {
     type: "api_key";
     key: string;
+    source?: "login" | undefined;
 }, {}>;
 export declare const credentialSnapshotEntrySchema: import("arktype/internal/variants/object.ts").ObjectType<{
     id: number;
@@ -82,6 +85,7 @@ export declare const credentialSnapshotEntrySchema: import("arktype/internal/var
     } | {
         type: "api_key";
         key: string;
+        source?: "login" | undefined;
     };
     identityKey: string | null;
 }, {}>;
@@ -109,6 +113,7 @@ export declare const snapshotEntrySchema: import("arktype/internal/variants/obje
     } | {
         type: "api_key";
         key: string;
+        source?: "login" | undefined;
     };
     identityKey: string | null;
     rotatesInMs: number | null;
@@ -153,6 +158,7 @@ export declare const snapshotResponseSchema: import("arktype/internal/variants/o
         } | {
             type: "api_key";
             key: string;
+            source?: "login" | undefined;
         };
         identityKey: string | null;
         rotatesInMs: number | null;
@@ -193,6 +199,7 @@ export declare const snapshotStreamSnapshotEventSchema: import("arktype/internal
         } | {
             type: "api_key";
             key: string;
+            source?: "login" | undefined;
         };
         identityKey: string | null;
         rotatesInMs: number | null;
@@ -234,6 +241,7 @@ export declare const snapshotStreamEntryEventSchema: import("arktype/internal/va
         } | {
             type: "api_key";
             key: string;
+            source?: "login" | undefined;
         };
         identityKey: string | null;
         rotatesInMs: number | null;
@@ -287,6 +295,7 @@ export declare const snapshotStreamEventSchema: import("arktype/internal/variant
         } | {
             type: "api_key";
             key: string;
+            source?: "login" | undefined;
         };
         identityKey: string | null;
         rotatesInMs: number | null;
@@ -326,6 +335,7 @@ export declare const snapshotStreamEventSchema: import("arktype/internal/variant
         } | {
             type: "api_key";
             key: string;
+            source?: "login" | undefined;
         };
         identityKey: string | null;
         rotatesInMs: number | null;
@@ -427,6 +437,7 @@ export declare const credentialRefreshResponseSchema: import("arktype/internal/v
         } | {
             type: "api_key";
             key: string;
+            source?: "login" | undefined;
         };
         identityKey: string | null;
     };
@@ -469,6 +480,7 @@ export declare const credentialUploadRequestSchema: import("arktype/internal/var
     } | {
         type: "api_key";
         key: string;
+        source?: "login" | undefined;
     };
 }, {}>;
 export declare const credentialUploadResponseSchema: import("arktype/internal/variants/object.ts").ObjectType<{
@@ -490,6 +502,7 @@ export declare const credentialUploadResponseSchema: import("arktype/internal/va
         } | {
             type: "api_key";
             key: string;
+            source?: "login" | undefined;
         };
         identityKey: string | null;
     }[];

package/dist/types/error/rate-limit.d.ts

@@ -20,6 +20,9 @@ export declare function calculateRateLimitBackoffMs(reason: RateLimitReason): nu
 /**
  * HTTP status codes that, absent richer body classification, represent an
  * account-local usage cap rather than a bad credential or a transient blip.
+ * HTTP 402 Payment Required is categorically an account-billing cap (xAI
+ * Grok Build "usage balance exhausted", DeepSeek "Insufficient Balance",
+ * OpenRouter credit exhaustion) — never a transient blip or bad credential.
  * Always combine with {@link isUsageLimitOutcome} when a message is available
  * — a 429 carrying transient rate-limit wording is NOT a usage cap.
  */
@@ -31,7 +34,7 @@ export declare function isUsageLimitStatus(status: number | undefined): boolean;
  *  1. Body matches {@link isUsageLimitError} (Codex `usage_limit_reached`,
  *     Anthropic account rate-limit, Google `resource_exhausted`, OpenAI
  *     `insufficient_quota`, …) → rotate.
- *  2. Status is not 429 → backoff (caller's domain).
+ *  2. Status is not a usage-limit status (429/402) → backoff (caller's domain).
  *  3. Body is absent or {@link isOpaqueStatusBody opaque} (just the status,
  *     empty JSON, HTTP framing only) → rotate conservatively: the server
  *     gave us nothing else to go on.
@@ -44,10 +47,11 @@ export declare function isUsageLimitStatus(status: number | undefined): boolean;
  */
 export declare function isUsageLimitOutcome(status: number | undefined, message: string | undefined): boolean;
 /**
- * A 429 body is opaque when it carries no signal beyond the status itself —
- * empty, whitespace-only, the status digits with HTTP/JSON framing, or
- * generic punctuation. Anything else (retry hints, capacity wording, error
- * descriptions) is informative enough to defer to the classifier.
+ * A usage-limit status body is opaque when it carries no signal beyond the
+ * status itself — empty, whitespace-only, the status digits with HTTP/JSON
+ * framing, or generic punctuation. Anything else (retry hints, capacity
+ * wording, error descriptions) is informative enough to defer to the
+ * classifier.
  */
 export declare function isOpaqueStatusBody(message: string): boolean;
 /**

package/dist/types/providers/cursor.d.ts

@@ -13,6 +13,20 @@ export interface CursorOptions extends StreamOptions {
     execHandlers?: CursorExecHandlers;
     onToolResult?: CursorToolResultHandler;
 }
+/**
+ * Maps an opaque HTTP/2 negotiation failure into an actionable error.
+ *
+ * bun only opens an HTTP/2 session when TLS-ALPN negotiates `h2`. Behind a
+ * TLS-intercepting proxy that strips ALPN (e.g. Zscaler), the handshake yields
+ * no `h2` protocol and bun throws `ERR_HTTP2_ERROR: h2 is not supported`. The
+ * Cursor run RPC is HTTP/2-only (the ALB rejects HTTP/1.1 with 464), so there
+ * is no h1 fallback the way model discovery has one — the run simply cannot
+ * proceed. Replace the opaque message with one that names the cause and points
+ * at the `providers.cursor.baseUrl` workaround.
+ *
+ * Non-ALPN errors pass through untouched.
+ */
+export declare function mapH2TransportError(error: unknown, baseUrl: string): unknown;
 export declare const streamCursor: StreamFunction<"cursor-agent">;
 export type ToolCallState = ToolCall & {
     [kStreamingBlockIndex]: number;
@@ -29,6 +43,8 @@ export interface BlockState {
         [kStreamingBlockIndex]: number;
     }) | null;
     currentToolCall: ToolCallState | null;
+    /** MCP call IDs executed through Cursor's exec channel before their stream block arrives. */
+    resolvedMcpToolCallIds: Set<string>;
     firstTokenTime: number | undefined;
     setTextBlock: (b: (TextContent & {
         [kStreamingBlockIndex]: number;

package/dist/types/providers/kimi.d.ts

@@ -5,15 +5,15 @@
  * - OpenAI: https://api.kimi.com/coding/v1/chat/completions
  * - Anthropic: https://api.kimi.com/coding/v1/messages
  *
- * The Anthropic API is generally more stable and recommended.
- * Note: Kimi calculates TPM rate limits based on max_tokens, not actual output.
+ * Each discovered model selects its server-declared protocol; legacy models
+ * without protocol metadata retain the Anthropic-compatible default.
  */
 import type { Api, Context, Model } from "../types.js";
 import type { AssistantMessageEventStream } from "../utils/event-stream.js";
 import { type OpenAIAnthropicApiFormat, type OpenAIAnthropicShimOptions } from "./openai-anthropic-shim.js";
 export type KimiApiFormat = OpenAIAnthropicApiFormat;
 export interface KimiOptions extends OpenAIAnthropicShimOptions {
-    /** API format: "openai" or "anthropic". Default: "anthropic" */
+    /** Explicit API format override. Defaults to the model's discovered protocol. */
     format?: KimiApiFormat;
 }
 /**

package/dist/types/providers/openai-anthropic-shim.d.ts

@@ -7,7 +7,7 @@
  * format, optional extra headers); the streaming/forwarding plumbing lives
  * here once.
  */
-import type { Context, Model, SimpleStreamOptions } from "../types.js";
+import type { Context, Model, SimpleStreamOptions, ThinkingControlMode } from "../types.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
 export type OpenAIAnthropicApiFormat = "openai" | "anthropic";
 export interface OpenAIAnthropicShimOptions extends SimpleStreamOptions {
@@ -21,6 +21,8 @@ export interface OpenAIAnthropicShimConfig {
     openaiBaseUrl?: string;
     /** Default API format when caller does not specify one. */
     defaultFormat: OpenAIAnthropicApiFormat;
+    /** Thinking transport used when this provider's Anthropic endpoint differs from generic budget semantics. */
+    anthropicThinkingMode?: ThinkingControlMode;
     /** Provider-specific headers (e.g. auth/session) merged ahead of user-supplied headers. */
     extraHeaders?: () => Record<string, string>;
 }

package/dist/types/providers/openai-codex/request-transformer.d.ts

@@ -77,6 +77,7 @@ export declare function resolveCodexResponsesLite(model: Model<"openai-codex-res
 export interface CodexLiteShapedBody {
     instructions?: unknown;
     tools?: unknown;
+    tool_choice?: unknown;
     input?: unknown;
     parallel_tool_calls?: unknown;
 }
@@ -85,9 +86,14 @@ export interface CodexLiteShapedBody {
  * `build_responses_request` with `use_responses_lite`): strips pinned image
  * detail, forces parallel tool calling off, moves tools into a leading
  * `additional_tools` developer item and the base instructions into a
- * developer message, then omits top-level `instructions`/`tools`. Shared by
- * normal turns and both remote-compaction paths — codex-rs routes
- * `/responses/compact` through the same builder.
+ * developer message, then omits top-level `instructions`/`tools`. Because the
+ * rewrite removes top-level `tools`, a forced hosted-tool choice (e.g.
+ * `{ type: "web_search" }`) would leave the backend unable to validate the
+ * choice against a tools collection and it rejects the request with HTTP 400
+ * (#5771). Such choices must fall back to `"auto"`; explicit string constraints
+ * such as `"none"` and `"required"` remain valid. Shared by normal turns and
+ * both remote-compaction paths — codex-rs routes `/responses/compact` through
+ * the same builder.
  */
 export declare function applyCodexResponsesLiteShape(body: CodexLiteShapedBody): void;
 export declare function transformRequestBody(body: RequestBody, model: Model<"openai-codex-responses">, options?: CodexRequestOptions, prompt?: {

package/dist/types/providers/openai-shared.d.ts

@@ -200,6 +200,7 @@ export type OpenAICompletionsParams = Omit<ChatCompletionCreateParamsStreaming,
     repetition_penalty?: number;
     thinking?: {
         type: "enabled" | "disabled";
+        effort?: string;
         keep?: "all";
     };
     enable_thinking?: boolean;
@@ -297,12 +298,14 @@ export declare function applyChatCompletionsReasoningParams(params: OpenAIComple
 }) | undefined): void;
 export declare function disableChatCompletionsReasoningForDialect(params: OpenAICompletionsParams, compat: ResolvedOpenAICompat): void;
 /**
- * Output-token clamp for the Z.AI/GLM-5.2 reasoning dialect: these hosts accept
- * the full model window on reasoning turns, so clamp to the model cap. Returns
- * `undefined` for every other model, leaving {@link resolveOpenAIOutputTokenParam}
- * on its default `OPENAI_MAX_OUTPUT_TOKENS` clamp.
+ * Provider-specific Chat Completions output clamp.
+ *
+ * Most OpenAI-compatible endpoints retain the conservative 64k ceiling from
+ * {@link resolveOpenAIOutputTokenParam}. Z.AI/GLM-5.2 reasoning and native
+ * Moonshot K3 explicitly accept their full advertised model caps, so those
+ * routes clamp to `model.maxTokens` instead.
  */
-export declare function resolveZaiReasoningOutputClamp(model: Model<"openai-completions">, compat: ResolvedOpenAICompat): number | undefined;
+export declare function resolveOpenAICompletionsOutputClamp(model: Model<"openai-completions">, compat: ResolvedOpenAICompat): number | undefined;
 /**
  * Enable `tool_stream` for Z.AI/GLM-5.2 reasoning models when tools are present
  * (GLM-5.2 streams tool-call arguments incrementally and needs the flag to do so).
@@ -380,6 +383,7 @@ export interface BuildResponsesInputOptions<TApi extends Api> {
 }
 export declare function buildResponsesInput<TApi extends Api>(options: BuildResponsesInputOptions<TApi>): ResponseInput;
 export declare function convertResponsesAssistantMessage<TApi extends Api>(assistantMsg: AssistantMessage, model: Model<TApi>, msgIndex: number, knownCallIds: Set<string>, includeThinkingSignatures?: boolean, customCallIds?: Set<string>, preserveMessageIds?: boolean, supportsCustomToolCalls?: boolean, customToolWireNameMap?: ReadonlyMap<string, string>): ResponseInput;
+/** Appends one tool result while keeping consecutive outputs ahead of its synthetic image messages. */
 export declare function appendResponsesToolResultMessages<TApi extends Api>(messages: ResponseInput, toolResult: ToolResultMessage, model: Model<TApi>, strictResponsesPairing: boolean, supportsImageDetailOriginal: boolean, knownCallIds: ReadonlySet<string>, customCallIds?: ReadonlySet<string>, supportsCustomToolCalls?: boolean): void;
 /**
  * Per-block accumulation helpers shared by the two Responses decode loops —

package/dist/types/providers/transform-messages.d.ts

@@ -1,11 +1,7 @@
 import type { Api, AssistantMessage, Message, Model } from "../types.js";
-/**
- * Normalize tool call ID for cross-provider compatibility.
- * OpenAI Responses API generates IDs that are 450+ chars with special characters like `|`.
- * Anthropic APIs require IDs matching ^[a-zA-Z0-9_-]+$ (max 64 chars).
- *
- * For aborted/errored turns, this function:
- * - Preserves tool call structure (unlike converting to text summaries)
- * - Injects synthetic "aborted" tool results
- */
+export declare function redactSensitiveCredentials(text: string): string;
+export declare function redactSensitiveInObject(val: unknown): {
+    result: unknown;
+    changed: boolean;
+};
 export declare function transformMessages<TApi extends Api>(messages: Message[], model: Model<TApi>, normalizeToolCallId?: (id: string, model: Model<TApi>, source: AssistantMessage) => string, maxNormalizedToolCallIdLength?: number, duplicateToolCallIdSuffixPrefix?: string, targetCompat?: Model<TApi>["compat"]): Message[];

package/dist/types/types.d.ts

@@ -376,7 +376,7 @@ export interface SimpleStreamOptions extends Omit<StreamOptions, "apiKey"> {
     toolChoice?: ToolChoice;
     /** OpenAI service tier for processing priority/cost control. Ignored by non-OpenAI providers. */
     serviceTier?: ServiceTier;
-    /** API format for Kimi Code provider: "openai" or "anthropic" (default: "anthropic") */
+    /** Explicit Kimi Code API format override; omitted uses live per-model protocol metadata. */
     kimiApiFormat?: "openai" | "anthropic";
     /** API format for Synthetic provider: "openai" or "anthropic" (default: "openai") */
     syntheticApiFormat?: "openai" | "anthropic";

package/dist/types/utils/event-stream.d.ts

@@ -35,3 +35,5 @@ export declare class AssistantMessageEventStream extends EventStream<AssistantMe
     push(event: AssistantMessageEvent): void;
     end(result?: AssistantMessage): void;
 }
+/** Create an assistant-message event stream for legacy extension providers. */
+export declare function createAssistantMessageEventStream(): AssistantMessageEventStream;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "17.0.1",
+	"version": "17.0.3",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.1",
-		"@oh-my-pi/pi-catalog": "17.0.1",
-		"@oh-my-pi/pi-utils": "17.0.1",
-		"@oh-my-pi/pi-wire": "17.0.1",
+		"@oh-my-pi/pi-catalog": "17.0.3",
+		"@oh-my-pi/pi-utils": "17.0.3",
+		"@oh-my-pi/pi-wire": "17.0.3",
 		"arktype": "2.2.3",
 		"zod": "^4"
 	},

package/src/auth-broker/wire-schemas.ts

@@ -55,6 +55,7 @@ export const apiKeyCredentialSchema = type({
 	"+": "reject",
 	type: "'api_key'",
 	key: type("string").atLeastLength(1),
+	"source?": "'login'",
 });
 
 /** Discriminated union accepted on POST /v1/credential (writes). */

package/src/dialect/thinking.ts

@@ -32,6 +32,16 @@ export class ThinkingInbandScanner implements InbandScanner {
 	#thinking = "";
 	/** Fence-aware close-matcher while inside a ` ```thinking ` block; undefined otherwise. */
 	#fenced: FencedThinkingScanner | undefined;
+	/** Backtick count that opened the Markdown code span/fence we are inside; 0 when not in code. */
+	#codeTicks = 0;
+	/** True when {@link #codeTicks} opened a fenced block (closes on a fence line), not an inline span. */
+	#codeFenced = false;
+	/**
+	 * Leading-space count on the current output line, or -1 once a non-space
+	 * character has appeared. Starts at 0 (line start) so a fence opening the
+	 * stream — or one indented ≤3 spaces, as CommonMark allows — is recognized.
+	 */
+	#lineIndent = 0;
 
 	feed(text: string): InbandScanEvent[] {
 		if (text.length === 0) return [];
@@ -86,25 +96,93 @@ export class ThinkingInbandScanner implements InbandScanner {
 				this.#closeTag = "";
 				continue;
 			}
+			if (this.#codeTicks > 0) {
+				if (this.#emitCode(final, events)) continue;
+				break;
+			}
 
-			const tag = findEarliestOpen(this.#buffer);
-			if (!tag) {
-				const hold = final ? 0 : partialSuffixOverlapAny(this.#buffer, OPENS);
-				const emit = this.#buffer.slice(0, this.#buffer.length - hold);
-				if (emit.length > 0) events.push({ type: "text", text: emit });
-				this.#buffer = this.#buffer.slice(this.#buffer.length - hold);
+			const hit = scanVisible(this.#buffer, final);
+			if (hit.kind === "none") {
+				this.#emitText(this.#buffer, events);
+				this.#buffer = "";
+				break;
+			}
+			if (hit.index > 0) this.#emitText(this.#buffer.slice(0, hit.index), events);
+			if (hit.kind === "hold") {
+				this.#buffer = this.#buffer.slice(hit.index);
 				break;
 			}
-			if (tag.index > 0) events.push({ type: "text", text: this.#buffer.slice(0, tag.index) });
-			this.#buffer = this.#buffer.slice(tag.index + tag.open.length);
-			this.#closeTag = tag.close;
+			if (hit.kind === "code") {
+				const fenced = hit.ticks >= 3 && this.#lineIndent >= 0 && this.#lineIndent <= 3;
+				this.#emitText(this.#buffer.slice(hit.index, hit.index + hit.ticks), events);
+				this.#buffer = this.#buffer.slice(hit.index + hit.ticks);
+				this.#codeTicks = hit.ticks;
+				this.#codeFenced = fenced;
+				continue;
+			}
+			this.#buffer = this.#buffer.slice(hit.index + hit.tag.open.length);
+			this.#closeTag = hit.tag.close;
 			this.#thinking = "";
-			if (tag.fenced) this.#fenced = new FencedThinkingScanner();
+			if (hit.tag.fenced) this.#fenced = new FencedThinkingScanner();
 			events.push({ type: "thinkingStart" });
 		}
 		return events;
 	}
 
+	/**
+	 * Emit buffered content while inside a Markdown code region, suppressing
+	 * reasoning-tag detection. A fenced block closes only on a fence line (a line
+	 * of backticks ≥ the opener); an inline span closes on the first backtick run
+	 * of exactly the opener length. Returns true when the region closed and the
+	 * loop should continue, false when it held back and should break.
+	 */
+	#emitCode(final: boolean, events: InbandScanEvent[]): boolean {
+		if (this.#codeFenced) {
+			const end = findFenceCloseEnd(this.#buffer, this.#codeTicks, final);
+			if (end !== -1) {
+				this.#emitText(this.#buffer.slice(0, end), events);
+				this.#buffer = this.#buffer.slice(end);
+				this.#codeTicks = 0;
+				this.#codeFenced = false;
+				return true;
+			}
+			if (final) {
+				this.#emitText(this.#buffer, events);
+				this.#buffer = "";
+				this.#codeTicks = 0;
+				this.#codeFenced = false;
+				return false;
+			}
+			// Stream committed lines; hold only the last (possibly partial) fence line.
+			const lastNl = this.#buffer.lastIndexOf("\n");
+			if (lastNl !== -1) {
+				this.#emitText(this.#buffer.slice(0, lastNl + 1), events);
+				this.#buffer = this.#buffer.slice(lastNl + 1);
+			}
+			return false;
+		}
+		const close = findBacktickRun(this.#buffer, 0, this.#codeTicks);
+		if (close !== -1 && (final || close + this.#codeTicks < this.#buffer.length)) {
+			this.#emitText(this.#buffer.slice(0, close + this.#codeTicks), events);
+			this.#buffer = this.#buffer.slice(close + this.#codeTicks);
+			this.#codeTicks = 0;
+			return true;
+		}
+		// No committed close yet: emit text, holding a trailing backtick run that
+		// may still grow into — or past — the closing delimiter.
+		const hold = final ? 0 : trailingBacktickRun(this.#buffer);
+		this.#emitText(this.#buffer.slice(0, this.#buffer.length - hold), events);
+		this.#buffer = this.#buffer.slice(this.#buffer.length - hold);
+		if (final) this.#codeTicks = 0;
+		return false;
+	}
+
+	#emitText(text: string, events: InbandScanEvent[]): void {
+		if (text.length === 0) return;
+		events.push({ type: "text", text });
+		this.#lineIndent = trailingLineIndent(text, this.#lineIndent);
+	}
+
 	#emitThinking(delta: string, events: InbandScanEvent[]): void {
 		if (delta.length === 0) return;
 		this.#thinking += delta;
@@ -112,11 +190,103 @@ export class ThinkingInbandScanner implements InbandScanner {
 	}
 }
 
-function findEarliestOpen(buffer: string): (Tag & { index: number }) | undefined {
-	let best: (Tag & { index: number }) | undefined;
-	for (const tag of TAGS) {
-		const index = buffer.indexOf(tag.open);
-		if (index !== -1 && (!best || index < best.index)) best = { ...tag, index };
+/** Outcome of scanning idle visible text for the next reasoning-tag or code-span boundary. */
+type VisibleHit =
+	| { readonly kind: "tag"; readonly index: number; readonly tag: Tag }
+	| { readonly kind: "code"; readonly index: number; readonly ticks: number }
+	| { readonly kind: "hold"; readonly index: number }
+	| { readonly kind: "none" };
+
+/**
+ * Walk idle visible text for the earliest boundary: a leaked reasoning-tag open,
+ * a Markdown code-span/fence opener (a backtick run), or — when more chunks may
+ * follow — a held partial delimiter at the buffer tail.
+ *
+ * Reasoning tags win at any position so the gemini ` ```thinking ` fence is
+ * healed instead of being read as a code fence. Backtick runs enter code mode so
+ * a literal `<think>` inside inline code or a fenced block stays visible text.
+ */
+function scanVisible(buffer: string, final: boolean): VisibleHit {
+	for (let i = 0; i < buffer.length; i++) {
+		const tag = TAGS.find(candidate => buffer.startsWith(candidate.open, i));
+		if (tag) return { kind: "tag", index: i, tag };
+		if (!final) {
+			const rest = buffer.slice(i);
+			if (OPENS.some(open => open.length > rest.length && open.startsWith(rest))) {
+				return { kind: "hold", index: i };
+			}
+		}
+		if (buffer[i] === "`") {
+			const ticks = backtickRun(buffer, i);
+			if (!final && i + ticks === buffer.length) return { kind: "hold", index: i };
+			return { kind: "code", index: i, ticks };
+		}
+	}
+	return { kind: "none" };
+}
+
+/** Length of the maximal backtick run beginning at `from`. */
+function backtickRun(buffer: string, from: number): number {
+	let end = from;
+	while (end < buffer.length && buffer[end] === "`") end++;
+	return end - from;
+}
+
+/** Index of the first maximal backtick run of exactly `ticks` at/after `from`, else -1. */
+function findBacktickRun(buffer: string, from: number, ticks: number): number {
+	for (let i = buffer.indexOf("`", from); i !== -1; i = buffer.indexOf("`", i)) {
+		const run = backtickRun(buffer, i);
+		if (run === ticks) return i;
+		i += run;
 	}
-	return best;
+	return -1;
+}
+
+/** Length of a backtick run that ends at the buffer tail; 0 when the tail is not a backtick. */
+function trailingBacktickRun(buffer: string): number {
+	let start = buffer.length;
+	while (start > 0 && buffer[start - 1] === "`") start--;
+	return buffer.length - start;
+}
+
+/**
+ * Leading-space count of the line at the tail of `text`, continuing from the
+ * prior line's `indent` state (see {@link ThinkingInbandScanner.#lineIndent}).
+ * Returns -1 once any non-space character has appeared on the current line.
+ */
+function trailingLineIndent(text: string, prior: number): number {
+	const lastNl = text.lastIndexOf("\n");
+	let indent = lastNl === -1 ? prior : 0;
+	for (let i = lastNl + 1; i < text.length; i++) {
+		if (indent === -1) break;
+		indent = text[i] === " " ? indent + 1 : -1;
+	}
+	return indent;
+}
+
+/**
+ * Index just past the first closing fence line for a fenced block opened with
+ * `ticks` backticks, or -1 when none is committed yet. A closing fence is a whole
+ * line whose trimmed content is only backticks, at least `ticks` of them. A line
+ * without a terminating newline is committed only when `final` (no more input can
+ * extend it into a non-fence line).
+ */
+function findFenceCloseEnd(buffer: string, ticks: number, final: boolean): number {
+	for (let start = 0; start <= buffer.length; ) {
+		const nl = buffer.indexOf("\n", start);
+		const terminated = nl !== -1;
+		const line = buffer.slice(start, terminated ? nl : buffer.length).trim();
+		if (line.length >= ticks && isAllBackticks(line) && (terminated || final)) {
+			return terminated ? nl + 1 : buffer.length;
+		}
+		if (!terminated) break;
+		start = nl + 1;
+	}
+	return -1;
+}
+
+/** True when `text` is non-empty and every character is a backtick. */
+function isAllBackticks(text: string): boolean {
+	for (let i = 0; i < text.length; i++) if (text[i] !== "`") return false;
+	return text.length > 0;
 }

package/src/error/flags.ts

@@ -7,7 +7,7 @@ import {
 	ProviderHttpError,
 	STREAM_ENVELOPE_ERROR_PREFIX,
 } from "./classes";
-import { isOpaqueStatusBody, matchesUsageLimitText, parseRateLimitReason } from "./rate-limit";
+import { isOpaqueStatusBody, isUsageLimitStatus, matchesUsageLimitText, parseRateLimitReason } from "./rate-limit";
 
 export const Flag = {
 	Class: 0x1000,
@@ -318,7 +318,7 @@ function classifyText(errorMessage: string | undefined, errorStatus: number | un
 		const cleanMessage = errorMessage;
 		const isOpaque = isOpaqueStatusBody(cleanMessage);
 
-		const isLimitStatus = statusClean === 429;
+		const isLimitStatus = isUsageLimitStatus(statusClean);
 		if (
 			matchesUsageLimitText(cleanMessage) ||
 			(isLimitStatus && (isOpaque || parseRateLimitReason(cleanMessage) === "QUOTA_EXHAUSTED"))