@oh-my-pi/pi-ai 17.0.9 → 17.1.1

package/CHANGELOG.md

@@ -2,6 +2,53 @@
 
 ## [Unreleased]
 
+## [17.1.1] - 2026-07-24
+
+### Added
+
+- Added `setCodexAttestationProvider` API for injecting `x-oai-attestation` headers in ChatGPT-OAuth Codex requests
+- Added OAuth account session pinning and active status tracking in storage
+- Added OpenAI Responses native computer-use transport, including batched actions and exact `computer_call`/`computer_call_output` replay with pending/acknowledged safety checks and `image_url`/`file_id` output references. Models without native support receive the same action surface as a regular function tool; provider-specific tool-choice forcing is used where supported.
+- Added `PI_CODEX_RESPONSES_LITE` to override the catalog-selected Codex Responses transport for diagnostics (`1`/`true` forces Lite; `0`/`false` forces the standard body).
+- Added caller-owned `cachedContent` on `google-generative-ai` and `google-vertex` GenerateContent options: pass an opaque cache resource name through the shared builder (blank values rejected); no create/refresh/delete lifecycle and no guessed model/project/location validation; existing `cachedContentTokenCount` → `Usage.cacheRead` normalization is unchanged.
+- Added Anthropic extra-usage reporting across `omp usage`, interactive `/usage`, and ACP `/usage`: the OAuth usage endpoint's authoritative `spend` payload (or legacy `extra_usage` fallback when absent) is normalized into a `Claude Extra Usage` USD row; capped accounts show limit/remaining/fractions and status, while uncapped spend exposes only its absolute used amount—rendered as `$… used` in CLI/TUI and `123.45 usd used` in ACP—without a fabricated cap, percentage, or status. ([#5575](https://github.com/can1357/oh-my-pi/issues/5575))
+- Added process-scoped OAuth account pools for trusted auth-broker clients via `OMP_AUTH_BROKER_ACCOUNT_POOL_FILE`, consistently filtering snapshots, streaming updates, refreshes, and usage reports to selected OAuth identities while leaving API-key credentials and the shared encrypted snapshot cache unrestricted.
+- Added opt-in Vercel AI Gateway automatic prompt caching for OpenAI Chat Completions while preserving `only` and `order` routing preferences.
+- Added Vercel AI Gateway Responses cache anchors and cache lifetimes, emitted only with automatic caching.
+- Added opt-in OpenAI GPT-5.6 explicit prompt-cache controls for Responses and Chat Completions. Existing requests remain implicit; the policy marks at most one existing stable-history block and is rejected locally on unsupported explicit routes.
+- Forwarded `statefulResponses` through `streamSimple`, so diagnostic callers can explicitly disable OpenAI Responses `previous_response_id` chaining.
+- Added native QwenCloud Token Plan API-key login, model discovery, and an optional interactive console-Cookie prompt for 5-hour and 7-day quota reporting ([#6151](https://github.com/can1357/oh-my-pi/issues/6151)).
+- Added model-scoped usage health and same-provider reselection for native coding-plan credential pools, preserving OAuth/login-pool precedence, scoped broker blocks, sibling rotation state, and conservative unknown-account handling while excluding ordinary configured API keys ([#5018](https://github.com/can1357/oh-my-pi/issues/5018)).
+
+### Fixed
+
+- Fixed stateful OpenAI Responses explicit cache breakpoints being restored onto edited historical messages, ensuring full replays recompute the latest stable cache boundary.
+- Fixed ChatGPT Codex standard and Lite transports rejecting or hiding native computer-use payloads by unrolling the tool definition, forced choice, `computer_call`, and `computer_call_output` into ordinary function-tool forms.
+
+## [17.1.0] - 2026-07-24
+
+### Added
+
+- Added support for caller-owned `cachedContent` on Google Generative AI and Google Vertex AI `GenerateContent` options, allowing passing of opaque cache resource names.
+- Added Anthropic extra-usage reporting across CLI, interactive, and ACP usage endpoints, normalizing the authoritative `spend` payload into a 'Claude Extra Usage' USD row with accurate limit, remaining, and status details.
+- Added process-scoped OAuth account pools for trusted auth-broker clients via `OMP_AUTH_BROKER_ACCOUNT_POOL_FILE` to filter snapshots, updates, refreshes, and usage reports to selected OAuth identities.
+- Added opt-in Vercel AI Gateway automatic prompt caching for OpenAI Chat Completions, including support for cache anchors and cache lifetimes.
+- Added opt-in explicit prompt-cache controls for OpenAI GPT-5.6+ Responses and Chat Completions, supporting stable boundary selection, stateful Responses markers, and future GPT-5.x/6.x models.
+- Added support for forwarding `statefulResponses` through `streamSimple` to allow diagnostic callers to explicitly disable OpenAI Responses `previous_response_id` chaining.
+- Added native QwenCloud Token Plan support, including API-key login, model discovery, and an optional interactive console-Cookie prompt for quota reporting.
+- Added interactive Meta Model API key login and support for `MODEL_API_KEY` and `META_API_KEY` environment variables.
+- Added model-scoped usage health tracking and same-provider reselection for native coding-plan credential pools.
+
+### Fixed
+
+- Fixed AWS Bedrock cache checkpoints to use resolved model compatibility, falling back to the provider-default 5-minute cache for unsupported 1-hour retentions, emitting AWS-recommended explicit checkpoints for Nova models (Lite, Micro, Pro, Premier, Nova 2 Lite), and honoring configured checkpoint maxima.
+- Fixed Pi-native and compatibility-wrapper requests dropping cache controls required by `omp bench --cache` to preserve explicit prompt-cache affinity and allow disabling OpenAI Responses chaining.
+- Fixed outbound credential-pattern redaction running unconditionally; it is now opt-in via `configureCredentialRedaction` and disabled by default.
+- Fixed SuperGrok (`xai-oauth`) `/usage` reporting for unified-billing accounts by falling back to the default monthly limit and usage payload when credit usage percentages are absent.
+- Fixed sessions wedging with a `400 Invalid signature in thinking block` error when switching Anthropic-compatible providers by stripping signatures whose issuing provider differs from the target.
+- Fixed OAuth callback servers aborting login on premature invalid callbacks, and restricted `localhost` callback listeners to the IPv4 loopback interface.
+- Fixed Google Gemini CLI and Antigravity OAuth login hanging indefinitely during Cloud Code Assist project provisioning by introducing request timeouts, cancellation checks, and bounded polling.
+
 ## [17.0.9] - 2026-07-23
 
 ### Added

package/README.md

@@ -73,6 +73,8 @@ Unified LLM API with automatic model discovery, provider configuration, token an
 - **Xiaomi MiMo** (requires `XIAOMI_API_KEY`)
 - **ZenMux** (requires `ZENMUX_API_KEY`)
 - **Qwen Portal** (supports `QWEN_OAUTH_TOKEN` or `QWEN_PORTAL_API_KEY`)
+- **QwenCloud Token Plan** (supports `/login alibaba-token-plan`, `ALIBABA_TOKEN_PLAN_API_KEY`, or `BAILIAN_TOKEN_PLAN_API_KEY`; interactive login optionally stores a `home.qwencloud.com` Cookie request header for best-effort 5-hour and 7-day quota reporting)
+  To enable quota reporting, sign in to the Token Plan dashboard, copy the `Cookie` request-header value from a `home.qwencloud.com` request in browser developer tools, and paste it at the second login prompt. Press Enter to skip; the Cookie is sensitive and session-lived, so rerun login when it expires.
 - **Cloudflare AI Gateway** (requires `CLOUDFLARE_AI_GATEWAY_API_KEY` and provider-specific gateway base URL)
 - **Ollama** (local OpenAI-compatible runtime; optional `OLLAMA_API_KEY`)
 - **Ollama Cloud** (hosted native Ollama API; requires `OLLAMA_CLOUD_API_KEY`)
@@ -953,6 +955,7 @@ In Node.js environments, you can set environment variables to avoid passing API
 | Ollama         | `OLLAMA_API_KEY` (optional for local deployments)                            |
 | Ollama Cloud   | `OLLAMA_CLOUD_API_KEY`                                                     |
 | Qwen Portal    | `QWEN_OAUTH_TOKEN` or `QWEN_PORTAL_API_KEY`                                  |
+| QwenCloud Token Plan | `ALIBABA_TOKEN_PLAN_API_KEY` or `BAILIAN_TOKEN_PLAN_API_KEY`                   |
 | zAI            | `ZAI_API_KEY`                                                                |
 | Umans AI Coding Plan | `UMANS_AI_CODING_PLAN_API_KEY`                                           |
 | MiniMax Code   | `MINIMAX_CODE_API_KEY` (international) or `MINIMAX_CODE_CN_API_KEY` (China) |

package/dist/types/auth-broker/discover.d.ts

@@ -1,4 +1,5 @@
 import { AuthStorage } from "../auth-storage.js";
+import { type AuthBrokerAccountPool } from "./remote-store.js";
 export interface AuthBrokerClientConfig {
     url: string;
     token: string;
@@ -12,9 +13,12 @@ export interface DiscoverAuthStorageOptions {
     configValueResolver?: (config: string) => Promise<string | undefined>;
     cachePath?: string;
     sourceLabel?: string;
+    /** Programmatic pool for SDK hosts. Takes precedence over the environment file. */
+    accountPool?: AuthBrokerAccountPool;
 }
 /** Path to the local bearer token file. Created by `omp auth-broker token`. */
 export declare function getAuthBrokerTokenFilePath(): string;
+export declare function loadAuthBrokerAccountPool(): Promise<AuthBrokerAccountPool | undefined>;
 /**
  * Resolve broker connection configuration using the same precedence as the TUI:
  *

package/dist/types/auth-broker/remote-store.d.ts

@@ -4,6 +4,12 @@ import type { Provider } from "../types.js";
 import type { UsageReport } from "../usage.js";
 import { type AuthBrokerClient } from "./client.js";
 import type { SnapshotResponse } from "./types.js";
+/**
+ * Per-provider OAuth identities visible to this trusted broker client.
+ * Missing providers are unrestricted; an empty set excludes that provider's
+ * OAuth credentials. API keys are never filtered.
+ */
+export type AuthBrokerAccountPool = ReadonlyMap<string, ReadonlySet<string>>;
 export interface RemoteAuthCredentialStoreOptions {
     client: AuthBrokerClient;
     /**
@@ -17,10 +23,16 @@ export interface RemoteAuthCredentialStoreOptions {
      */
     streamSnapshots?: boolean;
     /**
-     * Called after broker-sourced full snapshots are applied. The constructor's
-     * initial snapshot intentionally does not trigger this hook.
+     * Called with each broker-sourced raw full snapshot after the filtered
+     * public view is applied. The constructor's initial snapshot intentionally
+     * does not trigger this hook.
      */
     onSnapshot?: (snapshot: SnapshotResponse, generation: number) => void;
+    /**
+     * OAuth identities visible through this store. This is a trusted-client
+     * routing policy, not broker authorization.
+     */
+    accountPool?: AuthBrokerAccountPool;
 }
 export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
     #private;

package/dist/types/auth-gateway/types.d.ts

@@ -1,5 +1,5 @@
 import type { Effort } from "@oh-my-pi/pi-catalog/effort";
-import type { AssistantMessage, AssistantMessageEventStream, CacheRetention, Context, ServiceTier, TokenTaskBudget } from "../types.js";
+import type { AssistantMessage, AssistantMessageEventStream, CacheRetention, Context, OpenAIResponseInclude, ServiceTier, TokenTaskBudget } from "../types.js";
 /**
  * Wire types for the omp auth-gateway.
  *
@@ -14,6 +14,8 @@ import type { AssistantMessage, AssistantMessageEventStream, CacheRetention, Con
 export declare const DEFAULT_AUTH_GATEWAY_BIND = "127.0.0.1:4000";
 export type AuthGatewayToolChoice = "auto" | "none" | "required" | {
     name: string;
+} | {
+    type: "computer";
 };
 export interface AuthGatewayParsedRequestOptions {
     maxOutputTokens?: number;
@@ -39,6 +41,8 @@ export interface AuthGatewayParsedRequestOptions {
     toolChoice?: AuthGatewayToolChoice;
     /** OpenAI `parallel_tool_calls`. */
     parallelToolCalls?: boolean;
+    /** OpenAI Responses fields requested in the response payload. */
+    include?: OpenAIResponseInclude[];
     /** Effort-level reasoning request (OpenAI Responses / Chat `reasoning_effort`). */
     reasoning?: Effort;
     /** Force-disable reasoning (Anthropic `thinking: { type: "disabled" }`). */

package/dist/types/auth-storage.d.ts

@@ -457,6 +457,27 @@ export interface UsageLimitMarkResult {
     switched: boolean;
     retryAtMs?: number;
 }
+export type ModelUsageHealthState = "healthy" | "reserve" | "depleted" | "unknown";
+export interface ModelUsageAccountHealth {
+    credentialId: number;
+    credentialType: AuthCredential["type"];
+    /** True when this credential is currently sticky for options.sessionId. */
+    selected?: true;
+    state: ModelUsageHealthState;
+    remainingFraction?: number;
+    resetsAt?: number;
+}
+export interface ModelUsageHealth {
+    state: ModelUsageHealthState;
+    accounts: ModelUsageAccountHealth[];
+}
+export interface ModelUsageHealthOptions {
+    modelId?: string;
+    sessionId?: string;
+    baseUrl?: string;
+    reserveFraction: number;
+    signal?: AbortSignal;
+}
 type AuthApiKeyOptions = {
     baseUrl?: string;
     modelId?: string;
@@ -552,6 +573,8 @@ export interface OAuthAccountSummary {
     /** Organization/workspace the credential is scoped to (Anthropic/ChatGPT multi-subscription). */
     orgId?: string;
     orgName?: string;
+    /** True when this account is the session-sticky OAuth credential requested by `listOAuthAccounts`. */
+    active: boolean;
 }
 export interface InvalidateCredentialMatchingOptions {
     signal?: AbortSignal;
@@ -825,6 +848,30 @@ export declare class AuthStorage {
      * providers without a usage API) — the latter never warrants a usage row.
      */
     usageProviderFor(provider: Provider): UsageProvider | undefined;
+    /**
+     * Return model ids whose live reports map to a quantitative usage scope.
+     * Provider strategies supply model/tier mapping when available; otherwise
+     * only explicitly matching model ids and account-wide shared limits count.
+     * Label-only or ambiguous tier limits are excluded rather than guessed.
+     */
+    getUsageReportingModelIds(provider: Provider, modelIds: readonly string[], reports: readonly UsageReport[]): string[];
+    /**
+     * Inspect the credential pool that {@link getApiKey} would use for one model
+     * without advancing round-robin state or changing session stickiness.
+     *
+     * Pool aggregation is deliberately conservative: one healthy sibling makes
+     * the model healthy, while any unknown sibling prevents a depleted/reserve
+     * conclusion. Static runtime/config/env credentials return unknown because
+     * they bypass the managed account pool.
+     */
+    getModelUsageHealth(provider: Provider, options: ModelUsageHealthOptions): Promise<ModelUsageHealth>;
+    /**
+     * Release a session's sticky credential so its next {@link getApiKey} call
+     * re-runs native pool ranking. This never blocks or penalizes the released
+     * account; usage-aware routing uses it when another sibling has more
+     * headroom, before considering a model/provider fallback.
+     */
+    releaseSessionCredentialForReselection(provider: string, sessionId: string): boolean;
     fetchUsageReports(options?: {
         baseUrlResolver?: (provider: Provider) => string | undefined;
         /** Caller's cancel signal; only rejects this caller, never the shared upstream fetch. */
@@ -912,8 +959,20 @@ export declare class AuthStorage {
      * order, WITHOUT refreshing any token. The array position (0-based) is the
      * selector accepted by {@link AuthStorage.getOAuthAccessAt}; a "pick the Nth
      * account" UI should render `position + 1`.
+     *
+     * When `sessionId` is supplied, the session-sticky OAuth credential is marked
+     * `active`. No account is active before that session has resolved or pinned a
+     * credential.
+     */
+    listOAuthAccounts(provider: string, sessionId?: string): OAuthAccountSummary[];
+    /**
+     * Pin one stored OAuth account as this session's preferred credential.
+     *
+     * The durable credential id keeps the pin stable across credential refreshes,
+     * storage reordering, and process restarts. Normal auth retry and usage-limit
+     * handling may still route around an unavailable account.
      */
-    listOAuthAccounts(provider: string): OAuthAccountSummary[];
+    pinSessionOAuthAccount(provider: string, sessionId: string, credentialId: number): boolean;
     /**
      * Resolve every stored OAuth credential for `provider` independently.
      *

package/dist/types/providers/google-shared.d.ts

@@ -37,6 +37,17 @@ export interface GoogleSharedStreamOptions extends StreamOptions {
     hideThinkingSummary?: boolean;
     /** Gemini/Vertex serving tier (`flex`/`priority`); other values are omitted. */
     serviceTier?: ServiceTier;
+    /**
+     * Caller-owned Google context-cache resource name for GenerateContent.
+     * Passed through opaquely as the wire `cachedContent` field on
+     * `google-generative-ai` and `google-vertex` only. OMP does not create,
+     * refresh, validate model/project/location compatibility, or delete the
+     * resource — callers own that lifecycle.
+     *
+     * @see https://ai.google.dev/api/generate-content
+     * @see `@google/genai` `GenerateContentConfig.cachedContent`
+     */
+    cachedContent?: string;
 }
 /**
  * Determines whether a streamed Gemini `Part` should be treated as "thinking".

package/dist/types/providers/openai-chat-wire.d.ts

@@ -99,12 +99,20 @@ export interface ChatCompletionContentPartText {
     text: string;
     /** Always `text`. */
     type: "text";
+    /** Explicit OpenAI prompt-cache breakpoint. */
+    prompt_cache_breakpoint?: {
+        mode: "explicit";
+    };
 }
 /** Image content part. */
 export interface ChatCompletionContentPartImage {
     image_url: ChatCompletionContentPartImageImageURL;
     /** Always `image_url`. */
     type: "image_url";
+    /** Explicit OpenAI prompt-cache breakpoint. */
+    prompt_cache_breakpoint?: {
+        mode: "explicit";
+    };
 }
 /** SDK `ChatCompletionContentPartImage.ImageURL`. */
 export interface ChatCompletionContentPartImageImageURL {
@@ -118,6 +126,10 @@ export interface ChatCompletionContentPartInputAudio {
     input_audio: ChatCompletionContentPartInputAudioInputAudio;
     /** Always `input_audio`. */
     type: "input_audio";
+    /** Explicit OpenAI prompt-cache breakpoint. */
+    prompt_cache_breakpoint?: {
+        mode: "explicit";
+    };
 }
 /** SDK `ChatCompletionContentPartInputAudio.InputAudio`. */
 export interface ChatCompletionContentPartInputAudioInputAudio {
@@ -131,6 +143,10 @@ export interface ChatCompletionContentPartFile {
     file: ChatCompletionContentPartFileFile;
     /** Always `file`. */
     type: "file";
+    /** Explicit OpenAI prompt-cache breakpoint. */
+    prompt_cache_breakpoint?: {
+        mode: "explicit";
+    };
 }
 /** SDK `ChatCompletionContentPart.File.File`. */
 export interface ChatCompletionContentPartFileFile {
@@ -147,6 +163,10 @@ export interface ChatCompletionContentPartRefusal {
     refusal: string;
     /** Always `refusal`. */
     type: "refusal";
+    /** Explicit OpenAI prompt-cache breakpoint. */
+    prompt_cache_breakpoint?: {
+        mode: "explicit";
+    };
 }
 /** User-message content part union. */
 export type ChatCompletionContentPart = ChatCompletionContentPartText | ChatCompletionContentPartImage | ChatCompletionContentPartInputAudio | ChatCompletionContentPartFile;
@@ -598,6 +618,11 @@ export interface ChatCompletionCreateParamsBase {
     prompt_cache_key?: string;
     /** Retention policy for the prompt cache; `24h` enables extended caching. */
     prompt_cache_retention?: "in_memory" | "24h" | null;
+    /** Explicit prompt-cache mode and minimum lifetime for GPT-5.6+ models. */
+    prompt_cache_options?: {
+        mode: "implicit" | "explicit";
+        ttl?: "30m";
+    };
     /** Constrains effort on reasoning for reasoning models. */
     reasoning_effort?: ReasoningEffort | null;
     /** Output format: text, JSON mode, or Structured Outputs JSON schema. */

package/dist/types/providers/openai-codex/request-transformer.d.ts

@@ -35,6 +35,10 @@ export interface InputItem {
     name?: string;
     output?: unknown;
     arguments?: unknown;
+    action?: unknown;
+    actions?: unknown;
+    pending_safety_checks?: unknown;
+    acknowledged_safety_checks?: unknown;
     /** `additional_tools` developer item payload (Responses Lite). */
     tools?: unknown;
 }
@@ -65,8 +69,10 @@ export interface RequestBody {
 }
 /**
  * Resolve whether a Codex request uses the Responses Lite transport: an
- * explicit option wins, otherwise the model's catalog flag (codex-rs
- * `model_info.use_responses_lite`) decides.
+ * explicit option wins, then the `PI_CODEX_RESPONSES_LITE` env override
+ * (`1`/`true` forces Lite, `0`/`false` forces the full Responses body),
+ * otherwise the model's catalog flag (codex-rs `model_info.use_responses_lite`)
+ * decides.
  */
 export declare function resolveCodexResponsesLite(model: Model<"openai-codex-responses">, requested: boolean | undefined): boolean;
 /**

package/dist/types/providers/openai-codex-responses.d.ts

@@ -7,7 +7,6 @@ export interface OpenAICodexResponsesOptions extends StreamOptions {
     /** `reasoning.context` replay scope; defaults to `all_turns` when unset. The `all_turns` value is gated to gpt-5.4+ Codex models — older ids reject it, so it is suppressed and `context` omitted. */
     reasoningContext?: CodexReasoningContext;
     textVerbosity?: "low" | "medium" | "high";
-    include?: string[];
     codexMode?: boolean;
     toolChoice?: ToolChoice;
     preferWebsockets?: boolean;
@@ -64,6 +63,28 @@ export declare function createOpenAICodexCompactionRequestContext(options: {
     context: CodexCompactionContext | undefined;
     implementation: "responses" | "responses_compaction_v2" | "responses_compact";
 }): CodexCompactionRequestContext | undefined;
+/**
+ * Host integration boundary for just-in-time `x-oai-attestation` header
+ * values (codex-rs `AttestationProvider`). Resolves to the full header value
+ * — an `{"v":1,"s":0,"t":"v1.…"}` envelope — or `undefined` when no
+ * attestation should be sent.
+ */
+export type CodexAttestationProvider = () => Promise<string | undefined>;
+/**
+ * Install the process-wide attestation hook consulted for upstream Codex
+ * requests (codex-rs stores its provider on `ModelClient` construction). The
+ * hook is only consulted for ChatGPT-OAuth credentials and runs just-in-time
+ * per request; WebSocket handshakes resolve once per connection because the
+ * header is connection-scoped there.
+ */
+export declare function setCodexAttestationProvider(provider: CodexAttestationProvider | undefined): void;
+/**
+ * Resolve the `x-oai-attestation` header value for one upstream request.
+ * Gated on ChatGPT-OAuth credentials (a Codex JWT carries `chatgpt_account_id`;
+ * codex-rs gates on `auth.is_chatgpt_auth()`). A throwing hook degrades to no
+ * header rather than failing the request.
+ */
+export declare function getCodexAttestationHeader(accountId: string | undefined): Promise<string | undefined>;
 type CodexTransport = "sse" | "websocket";
 /** Shape of the Codex request sent on the latest provider turn. */
 export interface OpenAICodexTurnRequestDiagnostics {

package/dist/types/providers/openai-completions.d.ts

@@ -1,6 +1,7 @@
 import type { ResolvedOpenAICompat } from "@oh-my-pi/pi-catalog/types";
 import type { AssistantMessage, Context, Model, ServiceTier, StreamFunction, StreamOptions, ToolChoice } from "../types.js";
 import type { ChatCompletionMessageParam } from "./openai-chat-wire.js";
+import { type OpenAIPromptCacheOptions } from "./openai-shared.js";
 export { applyOpenRouterRoutingVariant } from "./openai-shared.js";
 /**
  * Identify "real progress" stream chunks vs. keepalives, role-only preambles,
@@ -33,6 +34,8 @@ export interface OpenAICompletionsOptions extends StreamOptions {
      * with the variant baked in).
      */
     openrouterVariant?: string;
+    /** Opt-in GPT-5.6+ prompt-cache policy. Unsupported explicit mode fails locally. */
+    promptCache?: OpenAIPromptCacheOptions;
 }
 /**
  * Public entry: wrap the single-attempt streamer with bounded empty-completion