@oh-my-pi/pi-ai 17.0.8 → 17.1.0

package/dist/types/registry/registry.d.ts

@@ -14,6 +14,10 @@ declare const ALL: ({
     readonly name: "Alibaba Coding Plan";
     readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<import("./oauth/index.js").OAuthCredentials>;
     readonly getApiKey: (credentials: import("./oauth/index.js").OAuthCredentials) => string;
+} | {
+    readonly id: "alibaba-token-plan";
+    readonly name: "QwenCloud Token Plan";
+    readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
 } | {
     readonly id: "amazon-bedrock";
     readonly name: "Amazon Bedrock";
@@ -143,6 +147,10 @@ declare const ALL: ({
     readonly id: "lm-studio";
     readonly name: "LM Studio (Local OpenAI-compatible)";
     readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
+} | {
+    readonly id: "meta";
+    readonly name: "Meta Model API";
+    readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
 } | {
     readonly id: "minimax";
     readonly name: "MiniMax";
@@ -292,6 +300,13 @@ declare const ALL: ({
     readonly id: "zai";
     readonly name: "Z.AI (GLM Coding Plan)";
     readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
+} | {
+    readonly id: "zai-coding-plan";
+    readonly name: "Z.AI (GLM Coding Plan · Sign in)";
+    readonly storeCredentialsAs: "zai";
+    readonly callbackPort: 54548;
+    readonly pasteCodeFlow: true;
+    readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string | import("./oauth/index.js").OAuthCredentials>;
 } | {
     readonly id: "zenmux";
     readonly name: "ZenMux";

package/dist/types/registry/zai.d.ts

@@ -5,3 +5,11 @@ export declare const zaiProvider: {
     readonly name: "Z.AI (GLM Coding Plan)";
     readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
 };
+export declare const zaiCodingPlanProvider: {
+    readonly id: "zai-coding-plan";
+    readonly name: "Z.AI (GLM Coding Plan · Sign in)";
+    readonly storeCredentialsAs: "zai";
+    readonly callbackPort: 54548;
+    readonly pasteCodeFlow: true;
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string | import("./oauth/index.js").OAuthCredentials>;
+};

package/dist/types/types.d.ts

@@ -188,6 +188,15 @@ export interface CodexCompactionMetadata {
 export interface CodexCompactionRequestContext extends CodexCompactionMetadata {
     operationId: string;
 }
+/** OpenAI's GPT-5.6+ explicit prompt-cache controls. */
+export interface OpenAIPromptCacheOptions {
+    /** `explicit` disables OpenAI's automatic latest-message breakpoint. */
+    mode: "implicit" | "explicit";
+    /** The only currently supported minimum breakpoint lifetime. */
+    ttl?: "30m";
+    /** By default, mark one existing block from stable history; `none` suppresses that marker. */
+    breakpoint?: "latest-stable-message" | "none";
+}
 export interface StreamOptions {
     temperature?: number;
     topP?: number;
@@ -258,6 +267,18 @@ export interface StreamOptions {
      * `x-grok-conv-id`; when omitted, they fall back to `sessionId`.
      */
     promptCacheKey?: string;
+    /**
+     * OpenAI GPT-5.6+ prompt-cache policy. Ignored by providers that do not
+     * support explicit OpenAI cache breakpoints; explicit mode fails locally on
+     * incompatible OpenAI-compatible endpoints.
+     */
+    promptCache?: OpenAIPromptCacheOptions;
+    /**
+     * Disable OpenAI Responses server-side turn chaining for this request.
+     * Diagnostic callers that compare independent requests can set this to
+     * `false` so `previous_response_id` cannot explain a result.
+     */
+    statefulResponses?: boolean;
     /**
      * Provider-scoped mutable state store for this agent session.
      * Providers can use this to persist transport/session state between turns.
@@ -393,6 +414,12 @@ export interface SimpleStreamOptions extends Omit<StreamOptions, "apiKey"> {
      * or the catalog entry already names the variant).
      */
     openrouterVariant?: string;
+    /**
+     * Caller-owned Google context-cache resource name. Forwarded only to the
+     * direct Gemini GenerateContent and Vertex GenerateContent APIs; all other
+     * providers ignore it. Callers own the cache lifecycle and compatibility.
+     */
+    cachedContent?: string;
     /** Antigravity endpoint routing mode: "auto" (default with failover), "production", "sandbox". */
     antigravityEndpointMode?: "auto" | "production" | "sandbox";
     /**

package/dist/types/usage/alibaba-token-plan.d.ts

@@ -0,0 +1,3 @@
+import type { CredentialRankingStrategy, UsageProvider } from "../usage.js";
+export declare const alibabaTokenPlanUsageProvider: UsageProvider;
+export declare const alibabaTokenPlanRankingStrategy: CredentialRankingStrategy;

package/dist/types/usage/synthetic.d.ts

@@ -0,0 +1,2 @@
+import type { UsageProvider } from "../usage.js";
+export declare const syntheticUsageProvider: UsageProvider;

package/dist/types/usage/xai-oauth.d.ts

@@ -0,0 +1,12 @@
+/**
+ * SuperGrok (`xai-oauth`) subscription usage provider.
+ *
+ * Reads utilization from the Grok CLI billing endpoint. Prefer the legacy
+ * weekly `format=credits` payload (creditUsagePercent / productUsage). When
+ * xAI marks the account as unified billing and omits those fields, fall back
+ * to the default monthly included-quota shape (`monthlyLimit` / `used`).
+ * Only OAuth access credentials are accepted; paid API keys are a separate
+ * product and must never be sent here.
+ */
+import type { UsageProvider } from "../usage.js";
+export declare const xaiOauthUsageProvider: UsageProvider;

package/dist/types/usage.d.ts

@@ -11,6 +11,12 @@ export interface UsageWindow {
     durationMs?: number;
     /** Absolute reset timestamp in milliseconds since epoch. */
     resetsAt?: number;
+    /**
+     * Verb rendered before the {@link resetsAt} countdown (e.g. "tick", "regen").
+     * Defaults to "resets" — override for rolling windows where the timestamp is
+     * an incremental regeneration step rather than a full window reset.
+     */
+    resetLabel?: string;
 }
 /** Quantitative usage data. */
 export interface UsageAmount {
@@ -157,6 +163,7 @@ export declare const usageWindowSchema: import("arktype/internal/variants/object
     label: string;
     durationMs?: number | undefined;
     resetsAt?: number | undefined;
+    resetLabel?: string | undefined;
 }, {}>;
 export declare const usageAmountSchema: import("arktype/internal/variants/object.ts").ObjectType<{
     used?: number | undefined;
@@ -194,6 +201,7 @@ export declare const usageLimitSchema: import("arktype/internal/variants/object.
         label: string;
         durationMs?: number | undefined;
         resetsAt?: number | undefined;
+        resetLabel?: string | undefined;
     } | undefined;
     amount: {
         used?: number | undefined;
@@ -240,6 +248,7 @@ export declare const usageReportSchema: import("arktype/internal/variants/object
             label: string;
             durationMs?: number | undefined;
             resetsAt?: number | undefined;
+            resetLabel?: string | undefined;
         } | undefined;
         amount: {
             used?: number | undefined;
@@ -315,6 +324,8 @@ export interface UsageProvider {
     supports?(params: UsageFetchParams): boolean;
     /** True when fetchUsage contacts upstream and can authenticate the credential for health checks. */
     validatesCredentials?: boolean;
+    /** Whether a failed refresh may serve the previous successful report. Defaults to true. */
+    retainLastGoodOnFailure?: boolean;
 }
 /** Request context used when ranking usage for a specific model. */
 export interface CredentialRankingContext {

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "17.0.8",
+	"version": "17.1.0",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.1",
-		"@oh-my-pi/pi-catalog": "17.0.8",
-		"@oh-my-pi/pi-utils": "17.0.8",
-		"@oh-my-pi/pi-wire": "17.0.8",
+		"@oh-my-pi/pi-catalog": "17.1.0",
+		"@oh-my-pi/pi-utils": "17.1.0",
+		"@oh-my-pi/pi-wire": "17.1.0",
 		"arktype": "2.2.3",
 		"zod": "^4"
 	},

package/src/auth-broker/discover.ts

@@ -18,7 +18,7 @@ import { YAML } from "bun";
 import { AuthStorage } from "../auth-storage";
 import * as AIError from "../error";
 import { AuthBrokerClient } from "./client";
-import { RemoteAuthCredentialStore } from "./remote-store";
+import { type AuthBrokerAccountPool, RemoteAuthCredentialStore } from "./remote-store";
 import { readAuthBrokerSnapshotCache, writeAuthBrokerSnapshotCache } from "./snapshot-cache";
 import { DEFAULT_SNAPSHOT_CACHE_TTL_MS, type SnapshotResponse } from "./types";
 
@@ -37,6 +37,8 @@ export interface DiscoverAuthStorageOptions {
 	configValueResolver?: (config: string) => Promise<string | undefined>;
 	cachePath?: string;
 	sourceLabel?: string;
+	/** Programmatic pool for SDK hosts. Takes precedence over the environment file. */
+	accountPool?: AuthBrokerAccountPool;
 }
 
 /** Path to the local bearer token file. Created by `omp auth-broker token`. */
@@ -112,6 +114,57 @@ async function readConfigYaml(agentDir: string): Promise<ConfigSnapshot> {
 	return {};
 }
 
+export async function loadAuthBrokerAccountPool(): Promise<AuthBrokerAccountPool | undefined> {
+	const filePath = process.env.OMP_AUTH_BROKER_ACCOUNT_POOL_FILE?.trim();
+	if (!filePath) return undefined;
+
+	let parsed: unknown;
+	try {
+		parsed = await Bun.file(filePath).json();
+	} catch (error) {
+		throw new AIError.ConfigurationError(`Unable to read OMP_AUTH_BROKER_ACCOUNT_POOL_FILE at ${filePath}`, {
+			cause: error,
+		});
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+		throw new AIError.ConfigurationError("OMP_AUTH_BROKER_ACCOUNT_POOL_FILE must contain a JSON object");
+	}
+
+	const accountPool = new Map<string, ReadonlySet<string>>();
+	for (const [provider, value] of Object.entries(parsed)) {
+		const normalizedProvider = provider.trim();
+		if (normalizedProvider.length === 0) {
+			throw new AIError.ConfigurationError("OMP_AUTH_BROKER_ACCOUNT_POOL_FILE contains an empty provider id");
+		}
+		if (provider !== normalizedProvider) {
+			throw new AIError.ConfigurationError(
+				"OMP_AUTH_BROKER_ACCOUNT_POOL_FILE contains a provider id with surrounding whitespace",
+			);
+		}
+		if (!Array.isArray(value)) {
+			throw new AIError.ConfigurationError(
+				`OMP_AUTH_BROKER_ACCOUNT_POOL_FILE entry for ${provider} must be an array of identity keys`,
+			);
+		}
+		const identities = new Set<string>();
+		for (const identity of value) {
+			if (typeof identity !== "string" || identity.length === 0) {
+				throw new AIError.ConfigurationError(
+					`OMP_AUTH_BROKER_ACCOUNT_POOL_FILE entry for ${provider} contains an invalid identity key`,
+				);
+			}
+			if (identity !== identity.trim()) {
+				throw new AIError.ConfigurationError(
+					`OMP_AUTH_BROKER_ACCOUNT_POOL_FILE entry for ${provider} contains an identity key with surrounding whitespace`,
+				);
+			}
+			identities.add(identity);
+		}
+		accountPool.set(provider, identities);
+	}
+	return accountPool;
+}
+
 function resolveSnapshotTtlMs(): number {
 	const raw = process.env.OMP_AUTH_BROKER_SNAPSHOT_TTL_MS;
 	if (raw === undefined) return DEFAULT_SNAPSHOT_CACHE_TTL_MS;
@@ -183,6 +236,7 @@ export async function discoverAuthStorage(options: DiscoverAuthStorageOptions =
 	});
 
 	if (brokerConfig) {
+		const accountPool = options.accountPool ?? (await loadAuthBrokerAccountPool());
 		const client = new AuthBrokerClient({ url: brokerConfig.url, token: brokerConfig.token });
 		const cachePath = options.cachePath ?? getAuthBrokerSnapshotCachePath();
 		const ttlMs = resolveSnapshotTtlMs();
@@ -226,6 +280,7 @@ export async function discoverAuthStorage(options: DiscoverAuthStorageOptions =
 			client,
 			initialSnapshot,
 			onSnapshot: persist,
+			accountPool,
 		});
 		const storage = new AuthStorage(store, {
 			configValueResolver: options.configValueResolver,

package/src/auth-broker/remote-store.ts

@@ -31,6 +31,23 @@ import type {
 	SnapshotStreamEvent,
 } from "./types";
 
+/**
+ * Per-provider OAuth identities visible to this trusted broker client.
+ * Missing providers are unrestricted; an empty set excludes that provider's
+ * OAuth credentials. API keys are never filtered.
+ */
+export type AuthBrokerAccountPool = ReadonlyMap<string, ReadonlySet<string>>;
+
+function isCredentialInAccountPool(
+	entry: Pick<SnapshotEntry, "provider" | "credential" | "identityKey">,
+	accountPool: AuthBrokerAccountPool | undefined,
+): boolean {
+	if (entry.credential.type !== "oauth") return true;
+	const identities = accountPool?.get(entry.provider);
+	if (identities === undefined) return true;
+	return entry.identityKey !== null && identities.has(entry.identityKey);
+}
+
 /**
  * Client-side TTL for the aggregate `/v1/usage` response. The broker dedups
  * upstream `/usage` hits via AuthStorage's 5-minute per-credential cache plus
@@ -205,16 +222,23 @@ export interface RemoteAuthCredentialStoreOptions {
 	 */
 	streamSnapshots?: boolean;
 	/**
-	 * Called after broker-sourced full snapshots are applied. The constructor's
-	 * initial snapshot intentionally does not trigger this hook.
+	 * Called with each broker-sourced raw full snapshot after the filtered
+	 * public view is applied. The constructor's initial snapshot intentionally
+	 * does not trigger this hook.
 	 */
 	onSnapshot?: (snapshot: SnapshotResponse, generation: number) => void;
+	/**
+	 * OAuth identities visible through this store. This is a trusted-client
+	 * routing policy, not broker authorization.
+	 */
+	accountPool?: AuthBrokerAccountPool;
 }
 
 export class RemoteAuthCredentialStore implements AuthCredentialStore {
 	readonly #client: AuthBrokerClient;
 	readonly #streamSnapshots: boolean;
 	readonly #onSnapshot?: (snapshot: SnapshotResponse, generation: number) => void;
+	readonly #accountPool?: AuthBrokerAccountPool;
 	#snapshot: SnapshotResponse = emptySnapshot();
 	#snapshotReceivedAt = Date.now();
 	#generation = 0;
@@ -239,6 +263,9 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 	constructor(opts: RemoteAuthCredentialStoreOptions) {
 		this.#client = opts.client;
 		this.#streamSnapshots = opts.streamSnapshots ?? true;
+		this.#accountPool = opts.accountPool
+			? new Map([...opts.accountPool].map(([provider, identities]) => [provider, new Set(identities)]))
+			: undefined;
 		this.#applySnapshot(opts.initialSnapshot ?? emptySnapshot(), opts.initialSnapshot?.generation ?? 0);
 		this.#onSnapshot = opts.onSnapshot;
 		void this.#runBackground();
@@ -255,7 +282,9 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 	#applySnapshot(snapshot: SnapshotResponse, generation: number, protectNewBlocks = true): void {
 		const nowMs = Date.now();
 		const previousCredentials = this.#snapshot.credentials;
-		const credentials = snapshot.credentials.map(entry => this.#normalizeSnapshotEntryBlocks(entry, nowMs));
+		const credentials = snapshot.credentials
+			.filter(entry => isCredentialInAccountPool(entry, this.#accountPool))
+			.map(entry => this.#normalizeSnapshotEntryBlocks(entry, nowMs));
 		if (snapshotBlocksChanged(previousCredentials, credentials)) this.#invalidateUsageCache();
 		if (protectNewBlocks) this.#protectNewSnapshotBlocks(previousCredentials, credentials, nowMs);
 		this.#snapshot = { ...snapshot, credentials };
@@ -264,7 +293,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		const onSnapshot = this.#onSnapshot;
 		if (!onSnapshot) return;
 		try {
-			onSnapshot(this.#snapshot, generation);
+			onSnapshot(snapshot, generation);
 		} catch (error) {
 			logger.debug("auth-broker snapshot callback failed", { error: String(error) });
 		}
@@ -383,6 +412,10 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		generation: number,
 		serverNowMs: number,
 	): void {
+		if (!isCredentialInAccountPool(entry, this.#accountPool)) {
+			this.#removeStreamCredential(entry.id, refresher, generation, serverNowMs);
+			return;
+		}
 		const incoming = this.#normalizeSnapshotEntryBlocks(entry, Date.now());
 		const index = this.#snapshot.credentials.findIndex(candidate => candidate.id === incoming.id);
 		const previousBlocks = index === -1 ? undefined : this.#snapshot.credentials[index]?.blocks;
@@ -577,7 +610,11 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		if (entry.credential.type !== "oauth") {
 			throw new AIError.AuthBrokerError(`Broker returned non-OAuth credential for id=${credentialId}`);
 		}
-		this.#applyCredentialEntry(entry);
+		if (!this.#applyCredentialEntry(entry)) {
+			throw new AIError.AuthBrokerError(
+				`Broker refreshed credential id=${credentialId} outside the configured account pool`,
+			);
+		}
 		this.#maybeRefreshSnapshot("suspect credential refresh");
 	}
 
@@ -677,20 +714,27 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 				.map(entry => [entry.id, entry.blocks] as const),
 		);
 		const others = this.#snapshot.credentials.filter(entry => entry.provider !== provider);
-		const incoming = entries.map(entry => credentialEntryWithBlocks(entry, existingBlocks.get(entry.id)));
+		const incoming = entries
+			.filter(entry => isCredentialInAccountPool(entry, this.#accountPool))
+			.map(entry => credentialEntryWithBlocks(entry, existingBlocks.get(entry.id)));
 		this.#snapshot = { ...this.#snapshot, credentials: [...others, ...incoming] };
 	}
-	#applyCredentialEntry(entry: AuthCredentialSnapshotEntry): void {
+	#applyCredentialEntry(entry: AuthCredentialSnapshotEntry): boolean {
+		if (!isCredentialInAccountPool(entry, this.#accountPool)) {
+			this.#removeCredentialById(entry.id);
+			return false;
+		}
 		const index = this.#snapshot.credentials.findIndex(candidate => candidate.id === entry.id);
 		const existingBlocks = index === -1 ? undefined : this.#snapshot.credentials[index]?.blocks;
 		const incoming = credentialEntryWithBlocks(entry, existingBlocks);
 		if (index === -1) {
 			this.#snapshot = { ...this.#snapshot, credentials: [...this.#snapshot.credentials, incoming] };
-			return;
+			return true;
 		}
 		const credentials = [...this.#snapshot.credentials];
 		credentials[index] = incoming;
 		this.#snapshot = { ...this.#snapshot, credentials };
+		return true;
 	}
 
 	#removeProviderEntries(provider: string): void {
@@ -837,14 +881,19 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		signal?: AbortSignal,
 	): Promise<OAuthCredentials> {
 		const { entry } = await this.#client.refreshCredential(credentialId, signal);
+		if (entry.credential.type !== "oauth") {
+			throw new AIError.AuthBrokerError(`Broker returned non-OAuth credential for id=${credentialId}`);
+		}
+		if (!this.#applyCredentialEntry(entry)) {
+			throw new AIError.AuthBrokerError(
+				`Broker refreshed credential id=${credentialId} outside the configured account pool`,
+			);
+		}
 		if (!this.#streamingActive) {
 			await this.refreshSnapshot().catch(error => {
 				logger.debug("auth-broker snapshot refresh after credential refresh failed", { error: String(error) });
 			});
 		}
-		if (entry.credential.type !== "oauth") {
-			throw new AIError.AuthBrokerError(`Broker returned non-OAuth credential for id=${credentialId}`);
-		}
 		const refreshed = entry.credential;
 		return {
 			access: refreshed.access,
@@ -865,7 +914,8 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 	 */
 	async fetchUsageReports(signal?: AbortSignal): Promise<UsageReport[] | null> {
 		const reports = await this.#raceWithSignal(this.#loadUsageReports(), signal);
-		return reports ? this.#applyUsageOverlays(reports) : null;
+		if (!reports) return null;
+		return this.#filterUsageReports(this.#applyUsageOverlays(reports));
 	}
 
 	/**
@@ -883,12 +933,27 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		signal?: AbortSignal,
 	): Promise<UsageReport | null> {
 		const reports = await this.#raceWithSignal(this.#loadUsageReports(), signal);
-		const matched = reports ? matchUsageReport(reports, provider, credential) : null;
+		const visibleReports = reports ? this.#filterUsageReports(reports) : null;
+		const matched = visibleReports ? matchUsageReport(visibleReports, provider, credential) : null;
 		const overlay = this.#getActiveUsageOverlay(provider, credential);
 		if (matched && overlay) return mergeUsageReports(matched, overlay);
 		return overlay ?? matched;
 	}
 
+	#filterUsageReports(reports: UsageReport[]): UsageReport[] {
+		const accountPool = this.#accountPool;
+		if (!accountPool) return reports;
+		return reports.filter(report => {
+			if (!accountPool.has(report.provider)) return true;
+			return this.#snapshot.credentials.some(
+				entry =>
+					entry.provider === report.provider &&
+					entry.credential.type === "oauth" &&
+					usageReportMatchesCredential(report, entry.credential),
+			);
+		});
+	}
+
 	ingestUsageReport(provider: Provider, credential: OAuthCredential, report: UsageReport): boolean {
 		const key = usageOverlayKey(provider, credential);
 		if (!key) return false;
@@ -1059,6 +1124,21 @@ function matchUsageReport(reports: UsageReport[], provider: Provider, credential
 	return null;
 }
 
+function usageReportMatchesCredential(report: UsageReport, credential: OAuthCredential): boolean {
+	const metadata = (report.metadata ?? {}) as Record<string, unknown>;
+	const credentialOrg = credential.orgId?.trim().toLowerCase();
+	const reportOrg = readMetadataString(metadata, "orgId")?.toLowerCase();
+	if (credentialOrg !== reportOrg) return false;
+
+	const accountId = credential.accountId?.trim().toLowerCase();
+	const email = credential.email?.trim().toLowerCase();
+	const projectId = credential.projectId?.trim().toLowerCase();
+	if (accountId || email || projectId) {
+		return reportMatchesIdentity(report, accountId, email, projectId);
+	}
+	return credentialOrg !== undefined;
+}
+
 function findMatchingReportIndex(reports: UsageReport[], overlay: UsageReport): number {
 	const all = reports
 		.map((report, index) => ({ report, index }))