@oh-my-pi/pi-ai 17.0.7 → 17.0.9

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## [Unreleased]
 
+## [17.0.9] - 2026-07-23
+
+### Added
+
+- Added Synthetic (synthetic.new) usage provider: `/usage` now reports the rolling 5-hour request limit and weekly credit quota via `GET /v2/quotas`, including per-tick regeneration rates in the window labels.
+- Added optional `UsageWindow.resetLabel` so rolling windows can render their countdown with an accurate verb (e.g. "tick in 12m" / "regen in 51m" instead of "resets in") — both quota windows on Synthetic regenerate incrementally rather than hard-resetting.
+
+### Fixed
+
+- Fixed GitHub Copilot OpenAI-compatible requests being rejected when the session's native OpenAI service tier was set to `priority` ([#5160](https://github.com/can1357/oh-my-pi/pull/5160) by [@audreyt](https://github.com/audreyt)).
+- Fixed OpenAI Responses token-cap truncations suppressing fully streamed function and custom tool calls whose inputs are complete.
+- Added SuperGrok (`xai-oauth`) usage tracking for weekly credits, product limits, and positive on-demand caps.
+
+## [17.0.8] - 2026-07-22
+
+### Fixed
+
+- Fixed Gemini Flash Cloud Code Assist empty-response retries when responses contain only intercepted planning-leak JSON.
+- Fixed Antigravity auto-routing to correctly fail over to the sandbox endpoint when the daily endpoint exhausts its retries.
+- Fixed OpenAI-compatible providers configured with auth: none incorrectly sending an Authorization: Bearer N/A header, which broke custom endpoints using alternative authentication headers.
+- Fixed auth-gateway model listings exposing duplicate or ambiguous model IDs by ensuring only provider-qualified routing IDs are advertised.
+- Improved connection error handling by classifying generic connection failures as transient, allowing them to be retried, while keeping explicit authentication rejections non-retryable.
+- Fixed custom Anthropic base URLs losing native thinking signatures during continuation requests.
+- Fixed Alibaba Coding Plan Custom login rejecting valid API keys on endpoints that do not serve the default validation model by validating against the model catalog instead.
+
 ## [17.0.6] - 2026-07-20
 
 ### Fixed

package/dist/types/error/flags.d.ts

@@ -73,7 +73,13 @@ export declare function classifyMessage(message: {
 export declare function attach<E extends object>(error: E, id: number): E;
 export declare function isContextOverflow(message: AssistantMessage, contextWindow?: number): boolean;
 export declare function stringify(id: number | undefined): string;
-/** Transient stream corruption where the response was truncated mid-JSON. */
+/**
+ * Transient stream corruption where the response was truncated mid-JSON.
+ *
+ * Strings (persisted `stopDetails.explanation`/`errorMessage` diagnostics) are matched with the
+ * stricter {@link STREAM_PARSE_DIAGNOSTIC_PATTERN} — bare "truncated"/"end of file" text is too
+ * low-signal to trust once detached from a live transport `Error`, which keeps the broad pattern.
+ */
 export declare function isTransientStreamParseError(error: unknown): boolean;
 /** Any malformed stream-envelope error (prefix-tagged or out-of-order events). */
 export declare function isStreamEnvelopeError(error: unknown): boolean;

package/dist/types/index.d.ts

@@ -39,6 +39,8 @@ export * from "./usage/ollama.js";
 export * from "./usage/openai-codex.js";
 export * from "./usage/openai-codex-reset.js";
 export * from "./usage/opencode-go.js";
+export * from "./usage/synthetic.js";
+export * from "./usage/xai-oauth.js";
 export * from "./usage/zai.js";
 export * from "./utils/anthropic-auth.js";
 export * from "./utils/event-stream.js";

package/dist/types/providers/__tests__/keyless-auth-header.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/providers/openai-shared.d.ts

@@ -7,6 +7,15 @@ import type { CapturedHttpErrorResponse } from "../utils/http-inspector.js";
 import type { ChatCompletionCreateParamsStreaming } from "./openai-chat-wire.js";
 import type { InputItem } from "./openai-codex/request-transformer.js";
 import type { ResponseContentPartAddedEvent, ResponseCreateParamsStreaming, ResponseInput, ResponseInputContent, ResponseInputItem, ResponseOutputItem, ResponseOutputMessage, ResponseReasoningItem, ResponseStatus, ResponseStreamEvent } from "./openai-responses-wire.js";
+/**
+ * Keyless-provider sentinel. Custom providers configured with `auth: none`
+ * (models.yml) have no credential, so the coding-agent resolves their API key
+ * to this literal instead of a real secret. Providers must treat it as "no
+ * credential" and suppress any credential-bearing header (e.g. `Authorization:
+ * Bearer …`) rather than forwarding the sentinel on the wire. See #6188; the
+ * google-vertex and amazon-bedrock transports apply the same guard inline.
+ */
+export declare const NO_AUTH_SENTINEL = "N/A";
 export interface OpenAIModelIdentity {
     provider: string;
     id: string;
@@ -482,7 +491,7 @@ export declare function finalizePendingResponsesToolCalls(output: AssistantMessa
  * re-samples instead of ending. Callers set `output.stopReason` from the wire
  * status first via {@link mapOpenAIResponsesStopReason}.
  */
-export declare function promoteResponsesToolUseStopReason(output: AssistantMessage, endTurn: boolean | undefined): void;
+export declare function promoteResponsesToolUseStopReason(output: AssistantMessage, endTurn: boolean | undefined, promoteIncompleteToolUse?: boolean): void;
 /** Initial empty `AssistantMessage` that streaming providers accumulate into. */
 export declare function createInitialResponsesAssistantMessage(api: Api, provider: string, modelId: string): AssistantMessage;
 /** Extension fields we add on top of `ResponseCreateParamsStreaming` across the Responses-family providers. */

package/dist/types/registry/oauth/xai-oauth.d.ts

@@ -1,16 +1,13 @@
 import type { FetchImpl } from "../../types.js";
 import type { OAuthController, OAuthCredentials } from "./types.js";
+export declare function validateXAIEndpoint(url: string, field: string): string;
 /**
- * Validate an xAI OIDC endpoint against its scheme and host.
- *
- * The discovery response is long-lived and its token endpoint receives every
- * future refresh token. Rejecting non-HTTPS or non-`x.ai` / `*.x.ai` hosts
- * pins that endpoint to the xAI auth origin.
- *
- * @throws Error with message `Invalid xAI <field>: <url>` when the URL fails
- *         either scheme or host validation.
+ * Pin SuperGrok billing URLs to HTTPS `grok.com` / `*.grok.com`.
+ * The CLI billing proxy is intentionally not on `*.x.ai`.
  */
-export declare function validateXAIEndpoint(url: string, field: string): string;
+export declare function validateXAIBillingEndpoint(url: string, field?: string): string;
+/** Decode an xAI access-token JWT payload without verifying its signature. */
+export declare function parseXAIAccessTokenPayload(jwt: string): Record<string, unknown> | null;
 /**
  * Check whether a JWT access token is at or past its `exp` claim (with an
  * optional refresh-skew margin).
@@ -19,6 +16,25 @@ export declare function validateXAIEndpoint(url: string, field: string): string;
  * not token validation.
  */
 export declare function isXAIAccessTokenExpiring(jwt: string, skewSeconds?: number): boolean;
+/** Extract the stable xAI subject UUID from an access token. */
+export declare function extractXAIAccessTokenSubject(jwt: string): string | undefined;
+export interface XAIOAuthIdentity {
+    accountId?: string;
+    email?: string;
+    name?: string;
+}
+/** Fetch optional OIDC userinfo for a valid xAI access token. */
+export declare function fetchXAIOAuthIdentity(accessToken: string, fetchOverride?: FetchImpl, signal?: AbortSignal): Promise<XAIOAuthIdentity | null>;
+/** Build the SuperGrok CLI billing URL. */
+export declare function buildXAICliBillingUrl(format?: string): string;
+/**
+ * Headers for SuperGrok CLI billing (`cli-chat-proxy.grok.com`).
+ * Official Grok CLI also sends `X-XAI-Token-Auth: xai-grok-cli` on this host;
+ * include it so billing stays on the same product gate as chat inference.
+ */
+export declare function getXAICliBillingHeaders(options: {
+    accessToken: string;
+}): Record<string, string>;
 /** Log in to xAI Grok with the RFC 8628 device authorization grant. */
 export declare function loginXAIOAuth(ctrl: OAuthController): Promise<OAuthCredentials>;
 /**

package/dist/types/types.d.ts

@@ -108,7 +108,8 @@ type ServiceTierModel = Pick<Model, "provider" | "api" | "id">;
  * `openai/`); Claude on Bedrock/Vertex (api `anthropic-messages`) is the
  * anthropic family even though its provider is `amazon-bedrock`/`google-vertex`.
  * Custom OpenAI-compatible relays that serve OpenAI model ids are OpenAI family
- * too unless that provider owns a separate tier control such as Fireworks.
+ * too unless the provider owns a separate tier control (Fireworks) or rejects
+ * OpenAI's service-tier field (GitHub Copilot).
  */
 export declare function serviceTierFamily(model: ServiceTierModel): ServiceTierFamily | undefined;
 /**

package/dist/types/usage/synthetic.d.ts

@@ -0,0 +1,2 @@
+import type { UsageProvider } from "../usage.js";
+export declare const syntheticUsageProvider: UsageProvider;

package/dist/types/usage/xai-oauth.d.ts

@@ -0,0 +1,9 @@
+/**
+ * SuperGrok (`xai-oauth`) subscription usage provider.
+ *
+ * Reads weekly credit and product utilization from the Grok CLI billing
+ * endpoint. Only OAuth access credentials are accepted; paid API keys are a
+ * separate product and must never be sent here.
+ */
+import type { UsageProvider } from "../usage.js";
+export declare const xaiOauthUsageProvider: UsageProvider;

package/dist/types/usage.d.ts

@@ -11,6 +11,12 @@ export interface UsageWindow {
     durationMs?: number;
     /** Absolute reset timestamp in milliseconds since epoch. */
     resetsAt?: number;
+    /**
+     * Verb rendered before the {@link resetsAt} countdown (e.g. "tick", "regen").
+     * Defaults to "resets" — override for rolling windows where the timestamp is
+     * an incremental regeneration step rather than a full window reset.
+     */
+    resetLabel?: string;
 }
 /** Quantitative usage data. */
 export interface UsageAmount {
@@ -157,6 +163,7 @@ export declare const usageWindowSchema: import("arktype/internal/variants/object
     label: string;
     durationMs?: number | undefined;
     resetsAt?: number | undefined;
+    resetLabel?: string | undefined;
 }, {}>;
 export declare const usageAmountSchema: import("arktype/internal/variants/object.ts").ObjectType<{
     used?: number | undefined;
@@ -194,6 +201,7 @@ export declare const usageLimitSchema: import("arktype/internal/variants/object.
         label: string;
         durationMs?: number | undefined;
         resetsAt?: number | undefined;
+        resetLabel?: string | undefined;
     } | undefined;
     amount: {
         used?: number | undefined;
@@ -240,6 +248,7 @@ export declare const usageReportSchema: import("arktype/internal/variants/object
             label: string;
             durationMs?: number | undefined;
             resetsAt?: number | undefined;
+            resetLabel?: string | undefined;
         } | undefined;
         amount: {
             used?: number | undefined;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "17.0.7",
+	"version": "17.0.9",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.1",
-		"@oh-my-pi/pi-catalog": "17.0.7",
-		"@oh-my-pi/pi-utils": "17.0.7",
-		"@oh-my-pi/pi-wire": "17.0.7",
+		"@oh-my-pi/pi-catalog": "17.0.9",
+		"@oh-my-pi/pi-utils": "17.0.9",
+		"@oh-my-pi/pi-wire": "17.0.9",
 		"arktype": "2.2.3",
 		"zod": "^4"
 	},

package/src/auth-gateway/server.ts

@@ -726,13 +726,19 @@ async function handleCredentialsCheck(storage: AuthStorage, signal: AbortSignal)
 }
 
 function handleModelsList(opts: AuthGatewayBootOptions): Response {
-	const list = opts.listModels ? Array.from(opts.listModels()) : [];
-	const data = list.map(model => ({
-		id: model.id,
-		object: "model" as const,
-		owned_by: model.provider,
-		api: model.api,
-	}));
+	const seen = new Set<string>();
+	const data: Array<{ id: string; object: "model"; owned_by: string; api: Api }> = [];
+	for (const model of opts.listModels?.() ?? []) {
+		const id = `${model.provider}/${model.id}`;
+		if (seen.has(id)) continue;
+		seen.add(id);
+		data.push({
+			id,
+			object: "model",
+			owned_by: model.provider,
+			api: model.api,
+		});
+	}
 	return json(200, { object: "list", data });
 }
 

package/src/auth-storage.ts

@@ -11,7 +11,7 @@ import { Database, type Statement } from "bun:sqlite";
 import { createHash } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { getAgentDbPath, logger } from "@oh-my-pi/pi-utils";
+import { $env, getAgentDbPath, logger } from "@oh-my-pi/pi-utils";
 import type { ApiKeyResolver } from "./auth-retry";
 import * as AIError from "./error";
 import { isUsageLimitOutcome } from "./error/rate-limit";
@@ -57,6 +57,8 @@ import {
 	listCodexResetCredits,
 } from "./usage/openai-codex-reset";
 import { opencodeGoUsageProvider } from "./usage/opencode-go";
+import { syntheticUsageProvider } from "./usage/synthetic";
+import { xaiOauthUsageProvider } from "./usage/xai-oauth";
 import { zaiRankingStrategy, zaiUsageProvider } from "./usage/zai";
 
 const USAGE_RANKING_METRIC_EPSILON = 1e-9;
@@ -596,6 +598,8 @@ const DEFAULT_USAGE_PROVIDERS: UsageProvider[] = [
 	opencodeGoUsageProvider,
 	githubCopilotUsageProvider,
 	cursorUsageProvider,
+	syntheticUsageProvider,
+	xaiOauthUsageProvider,
 ];
 
 const DEFAULT_USAGE_PROVIDER_MAP = new Map<Provider, UsageProvider>(
@@ -3227,6 +3231,29 @@ export class AuthStorage {
 				entries = dedupedEntries;
 			}
 
+			// SuperGrok billing only accepts OAuth bearers. Catalog envVars for
+			// xai-oauth are [XAI_OAUTH_TOKEN, XAI_API_KEY], so the generic path
+			// would (a) build api_key usage requests from stored keys / the paid
+			// API env var and (b) never fall through to XAI_OAUTH_TOKEN when a
+			// non-OAuth row is the only stored credential. Skip api_key material
+			// and only env-fallback to the dedicated OAuth bearer.
+			if (providerId === "xai-oauth") {
+				let hasUsableStoredOAuthCredential = false;
+				for (const entry of entries) {
+					if (entry.credential.type !== "oauth") continue;
+					const request = this.#buildUsageRequestForOauth(provider, entry.credential, baseUrl);
+					if (providerImpl.supports && !providerImpl.supports(request)) continue;
+					requests.push(request);
+					hasUsableStoredOAuthCredential = true;
+				}
+				const oauthToken = $env.XAI_OAUTH_TOKEN?.trim();
+				if (!hasUsableStoredOAuthCredential && oauthToken) {
+					const request = this.#buildUsageRequest(provider, { type: "oauth", accessToken: oauthToken }, baseUrl);
+					if (!providerImpl.supports || providerImpl.supports(request)) requests.push(request);
+				}
+				continue;
+			}
+
 			if (entries.length === 0) {
 				const runtimeKey = this.#runtimeOverrides.get(providerId);
 				const envKey = getEnvApiKey(providerId);

package/src/error/flags.ts

@@ -90,7 +90,7 @@ const TRANSIENT_ENVELOPE_PATTERN = /anthropic stream envelope error:/i;
 const TRANSIENT_ENVELOPE_BEFORE_START_PATTERN = /before message_start/i;
 export const STREAM_READ_ERROR_PATTERN = /stream[_ -]?read[_ -]?error/i;
 export const TRANSIENT_TRANSPORT_PATTERN =
-	/overloaded|provider.?returned.?error|rate.?limit|too many requests|429|500|502|503|504|service.?unavailable|server.?error|internal.?error|retry your request|network.?error|connection.?error|connection.?refused|other side closed|fetch failed|upstream.?connect|upstream.?request.?failed|reset before headers|socket hang up|timed? out|timeout|terminated|retry delay|stream stall|no error details in response|HTTP2(?:StreamReset|RefusedStream|EnhanceYourCalm)|malformed.?function.?call/i;
+	/overloaded|provider.?returned.?error|rate.?limit|too many requests|429|500|502|503|504|service.?unavailable|server.?error|internal.?error|retry your request|network.?error|connection.?error|connection.?refused|unable.?to.?connect\.\s*is the computer able to access the url\?|other side closed|fetch failed|upstream.?connect|upstream.?request.?failed|reset before headers|socket hang up|timed? out|timeout|terminated|retry delay|stream stall|no error details in response|HTTP2(?:StreamReset|RefusedStream|EnhanceYourCalm)|malformed.?function.?call/i;
 const AUTH_FAILURE_PATTERN =
 	/\b(?:401|403|unauthorized|forbidden|authentication|auth[_ ]?unavailable|no auth available|(?:invalid|no)[_ ]?api[_ ]?key)\b/i;
 const MALFORMED_FUNCTION_CALL_PATTERN = /\bmalformed.?function.?call\b/i;
@@ -505,10 +505,19 @@ export function stringify(id: number | undefined): string {
 
 const STREAM_PARSE_TRUNCATION_PATTERN =
 	/unterminated string|unexpected end of json input|unexpected end of data|unexpected eof|end of file|eof while parsing|truncated/i;
+const STREAM_PARSE_DIAGNOSTIC_PATTERN =
+	/(?:json parse error:\s*(?:unterminated string|unexpected end of json input|unexpected end of data|unexpected eof|end of file|eof while parsing|truncated)|json\.parse:\s*(?:unterminated string|unexpected end of data)|unexpected end of json input|unexpected eof|eof while parsing)/i;
 const STREAM_EVENT_ORDER_PATTERN = /stream event order|before message_start/i;
 
-/** Transient stream corruption where the response was truncated mid-JSON. */
+/**
+ * Transient stream corruption where the response was truncated mid-JSON.
+ *
+ * Strings (persisted `stopDetails.explanation`/`errorMessage` diagnostics) are matched with the
+ * stricter {@link STREAM_PARSE_DIAGNOSTIC_PATTERN} — bare "truncated"/"end of file" text is too
+ * low-signal to trust once detached from a live transport `Error`, which keeps the broad pattern.
+ */
 export function isTransientStreamParseError(error: unknown): boolean {
+	if (typeof error === "string") return STREAM_PARSE_DIAGNOSTIC_PATTERN.test(error);
 	return error instanceof Error && STREAM_PARSE_TRUNCATION_PATTERN.test(error.message);
 }
 

package/src/index.ts

@@ -39,6 +39,8 @@ export * from "./usage/ollama";
 export * from "./usage/openai-codex";
 export * from "./usage/openai-codex-reset";
 export * from "./usage/opencode-go";
+export * from "./usage/synthetic";
+export * from "./usage/xai-oauth";
 export * from "./usage/zai";
 export * from "./utils/anthropic-auth";
 export * from "./utils/event-stream";

package/src/providers/__tests__/keyless-auth-header.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, test } from "bun:test";
+import { NO_AUTH_SENTINEL, resolveOpenAIRequestSetup } from "../openai-shared";
+
+describe("resolveOpenAIRequestSetup keyless auth", () => {
+	test("omits Authorization for the keyless (auth: none) sentinel, keeping custom headers", () => {
+		const setup = resolveOpenAIRequestSetup(
+			{
+				provider: "qwen",
+				id: "Qwen3.6-35B-A3B",
+				baseUrl: "http://localhost:8788",
+				headers: { "x-api-key": "real-key" },
+			},
+			{ apiKey: NO_AUTH_SENTINEL, messages: [] },
+		);
+		expect(setup.headers.Authorization).toBeUndefined();
+		expect(setup.headers["x-api-key"]).toBe("real-key");
+	});
+
+	test("still injects Bearer for a real key", () => {
+		const setup = resolveOpenAIRequestSetup(
+			{ provider: "custom", id: "m", baseUrl: "http://localhost:8788" },
+			{ apiKey: "sk-real", messages: [] },
+		);
+		expect(setup.headers.Authorization).toBe("Bearer sk-real");
+	});
+
+	test("caller-supplied Authorization in model.headers is preserved even when keyless", () => {
+		const setup = resolveOpenAIRequestSetup(
+			{
+				provider: "qwen",
+				id: "m",
+				baseUrl: "http://localhost:8788",
+				headers: { Authorization: "Bearer custom-token" },
+			},
+			{ apiKey: NO_AUTH_SENTINEL, messages: [] },
+		);
+		expect(setup.headers.Authorization).toBe("Bearer custom-token");
+	});
+});

package/src/providers/__tests__/kimi-code-thinking.test.ts

@@ -161,7 +161,7 @@ describe("Kimi K3 thinking transport", () => {
 	it("downgrades named tool choice to required for K3 thinking", async () => {
 		vi.spyOn(kimiOauth, "getKimiCommonHeaders").mockReturnValue(KIMI_HEADERS);
 		const bundledModel = getBundledModel<"openai-completions">("kimi-code", "k3");
-		expect(bundledModel.compat.thinkingFormat).toBe("zai");
+		expect(bundledModel.compat.thinkingFormat).toBe("kimi");
 		let payload: unknown;
 		const capturePayload = async (
 			model: Model<"openai-completions">,

package/src/providers/google-gemini-cli.ts

@@ -815,9 +815,6 @@ export const streamGoogleGeminiCli: StreamFunction<"google-gemini-cli"> = (
 									if (isBuffering) {
 										const buffered = consumePlanningBuffer(textBuffer, toolNames);
 										if (buffered.kind !== "incomplete") {
-											if (buffered.kind === "leak") {
-												sawLeak = true;
-											}
 											const visibleSignature = bufferedTextSignature;
 											isBuffering = false;
 											textBuffer = "";
@@ -896,9 +893,7 @@ export const streamGoogleGeminiCli: StreamFunction<"google-gemini-cli"> = (
 
 				if (isBuffering && textBuffer !== "") {
 					const buffered = consumePlanningBuffer(textBuffer, toolNames, true);
-					if (buffered.kind === "leak") {
-						sawLeak = true;
-					}
+
 					if (buffered.kind !== "incomplete") {
 						feedVisibleText(buffered.visibleText, bufferedTextSignature);
 					}
@@ -910,11 +905,10 @@ export const streamGoogleGeminiCli: StreamFunction<"google-gemini-cli"> = (
 				flushVisibleText(bufferedTextSignature);
 				endCurrentBlock();
 
-				return hasMeaningfulGoogleContent(output) || sawLeak;
+				return hasMeaningfulGoogleContent(output);
 			};
 
 			let receivedContent = false;
-			let sawLeak = false;
 
 			for (let i = 0; i < endpoints.length; i++) {
 				const endpoint = endpoints[i];
@@ -1055,10 +1049,15 @@ export const streamGoogleGeminiCli: StreamFunction<"google-gemini-cli"> = (
 					break;
 				} catch (error) {
 					const status = extractHttpStatusFromError(error);
-					if (AIError.isTransientStatus(status)) {
-						if (!isLastEndpoint && !started) {
-							continue;
-						}
+					if (
+						!isLastEndpoint &&
+						!started &&
+						(AIError.isTransientStatus(status) ||
+							(status === undefined &&
+								!(error instanceof AIError.ProviderResponseError && error.kind === "output") &&
+								AIError.retriable(AIError.classify(error))))
+					) {
+						continue;
 					}
 					throw error;
 				}

package/src/providers/openai-shared.ts

@@ -101,6 +101,16 @@ import type {
 import { transformMessages } from "./transform-messages";
 import { joinTextWithImagePlaceholder, NON_VISION_IMAGE_PLACEHOLDER, partitionVisionContent } from "./vision-guard";
 
+/**
+ * Keyless-provider sentinel. Custom providers configured with `auth: none`
+ * (models.yml) have no credential, so the coding-agent resolves their API key
+ * to this literal instead of a real secret. Providers must treat it as "no
+ * credential" and suppress any credential-bearing header (e.g. `Authorization:
+ * Bearer …`) rather than forwarding the sentinel on the wire. See #6188; the
+ * google-vertex and amazon-bedrock transports apply the same guard inline.
+ */
+export const NO_AUTH_SENTINEL = "N/A";
+
 export interface OpenAIModelIdentity {
 	provider: string;
 	id: string;
@@ -279,7 +289,15 @@ export function resolveOpenAIRequestSetup(
 		baseUrl = baseUrl ?? ($env.OPENAI_BASE_URL?.trim() || options.defaultBaseUrl);
 	}
 	const requestHeaders = { ...headers };
-	headers.Authorization ??= `Bearer ${apiKey}`;
+	// A keyless provider (`auth: none` in models.yml) resolves to the `N/A`
+	// sentinel rather than a real key. Injecting `Authorization: Bearer N/A`
+	// breaks custom endpoints that authenticate via their own headers (e.g.
+	// `headers.x-api-key`) and reject the bogus bearer — mirror the sentinel
+	// guards in google-vertex / amazon-bedrock and send no Authorization here
+	// (#6188). A caller-supplied Authorization in `model.headers` still wins.
+	if (apiKey !== NO_AUTH_SENTINEL) {
+		headers.Authorization ??= `Bearer ${apiKey}`;
+	}
 	return { copilotPremiumRequests, baseUrl, headers, query, requestHeaders };
 }
 
@@ -2483,6 +2501,7 @@ export async function processResponsesStream<TApi extends Api>(
 			const entry = lookupOpenToolCallAlias(event, "custom_tool_call");
 			if (entry?.item.type === "custom_tool_call" && entry.block.type === "toolCall") {
 				finalizeCustomToolCallInputDone(entry.block, event.input);
+				entry.block[kStreamingArgumentsDone] = true;
 			}
 		} else if (event.type === "response.output_item.done") {
 			const item = structuredCloneJSON(event.item);
@@ -2602,6 +2621,10 @@ export async function processResponsesStream<TApi extends Api>(
 			}
 		} else if (terminalEvent) {
 			const response = terminalEvent.response;
+			const shouldPromoteIncompleteToolUse =
+				response?.status === "incomplete" &&
+				response.incomplete_details?.reason === "max_output_tokens" &&
+				hasExecutableIncompleteResponsesToolCalls(output);
 			finalizePendingResponsesToolCalls(output);
 			if (response?.id) {
 				output.responseId = response.id;
@@ -2638,7 +2661,11 @@ export async function processResponsesStream<TApi extends Api>(
 					kind: "content-blocked",
 				});
 			}
-			promoteResponsesToolUseStopReason(output, (response as { end_turn?: boolean } | undefined)?.end_turn);
+			promoteResponsesToolUseStopReason(
+				output,
+				(response as { end_turn?: boolean } | undefined)?.end_turn,
+				shouldPromoteIncompleteToolUse,
+			);
 			options?.onCompleted?.();
 			// `response.completed`/`response.incomplete`/`response.done` is the last event of a
 			// Responses stream. Stop pulling instead of waiting for the server to
@@ -2694,6 +2721,28 @@ export function mapOpenAIResponsesStopReason(status: ResponseStatus | undefined)
 	}
 }
 
+function hasExecutableIncompleteResponsesToolCalls(output: AssistantMessage): boolean {
+	let hasToolCall = false;
+	for (const block of output.content) {
+		if (block.type !== "toolCall") continue;
+		hasToolCall = true;
+		const pending = block as ToolCall & {
+			[kStreamingPartialJson]?: string;
+			[kStreamingArgumentsDone]?: boolean;
+		};
+		const rawArguments = pending[kStreamingPartialJson];
+		// `output_item.done` is not positive completion proof: our Responses
+		// compatibility encoder force-closes still-open calls before forwarding an
+		// upstream `length` stop. Only an explicit arguments/input-done event sets
+		// this marker; an open ordinary call can instead prove completion with its
+		// retained strict-complete JSON.
+		if (pending[kStreamingArgumentsDone]) continue;
+		if (pending.customWireName !== undefined || rawArguments === undefined) return false;
+		if (classifyJsonPrefix(rawArguments) !== "complete") return false;
+	}
+	return hasToolCall;
+}
+
 /**
  * Finalize any streamed toolCall block whose `output_item.done` never arrived
  * (lossy proxy, or a terminal event that raced the per-item done): parse the
@@ -2727,8 +2776,15 @@ export function finalizePendingResponsesToolCalls(output: AssistantMessage): voi
  * re-samples instead of ending. Callers set `output.stopReason` from the wire
  * status first via {@link mapOpenAIResponsesStopReason}.
  */
-export function promoteResponsesToolUseStopReason(output: AssistantMessage, endTurn: boolean | undefined): void {
-	if (output.content.some(block => block.type === "toolCall") && output.stopReason === "stop") {
+export function promoteResponsesToolUseStopReason(
+	output: AssistantMessage,
+	endTurn: boolean | undefined,
+	promoteIncompleteToolUse = false,
+): void {
+	if (
+		output.content.some(block => block.type === "toolCall") &&
+		(output.stopReason === "stop" || (promoteIncompleteToolUse && output.stopReason === "length"))
+	) {
 		output.stopReason = "toolUse";
 	}
 	if (endTurn === false && output.stopReason === "stop") {

package/src/registry/alibaba-coding-plan.ts

@@ -71,13 +71,22 @@ export async function loginAlibabaCodingPlan(options: OAuthController): Promise<
 	}
 
 	options.onProgress?.("Validating API key...");
-	await apiKeyValidation.validateOpenAICompatibleApiKey({
-		provider: "Alibaba Coding Plan",
-		apiKey: trimmed,
-		baseUrl,
-		model: VALIDATION_MODEL,
-		signal: options.signal,
-	});
+	if (choice === "3") {
+		await apiKeyValidation.validateApiKeyAgainstModelsEndpoint({
+			provider: "Alibaba Coding Plan",
+			apiKey: trimmed,
+			modelsUrl: `${baseUrl}/models`,
+			signal: options.signal,
+		});
+	} else {
+		await apiKeyValidation.validateOpenAICompatibleApiKey({
+			provider: "Alibaba Coding Plan",
+			apiKey: trimmed,
+			baseUrl,
+			model: VALIDATION_MODEL,
+			signal: options.signal,
+		});
+	}
 
 	return {
 		access: trimmed,