@oh-my-pi/pi-ai 17.1.8 → 17.2.1

package/dist/types/providers/cursor.d.ts

@@ -3,10 +3,10 @@ import { type JsonValue } from "@bufbuild/protobuf";
 import type { McpToolDefinition } from "@oh-my-pi/pi-catalog/discovery/cursor-gen/agent_pb";
 import { type AgentServerMessage, type ConversationStateStructure } from "@oh-my-pi/pi-catalog/discovery/cursor-gen/agent_pb";
 import type { AssistantMessage, CursorExecHandlerResult, CursorExecHandlers, CursorExecPairing, CursorTodoSyncHandler, CursorToolResultHandler, Message, StreamFunction, StreamOptions, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage } from "../types.js";
-import { kCursorExecResolved, kStreamingBlockIndex, kStreamingBlockKind, kStreamingLastParseLen, kStreamingPartialJson } from "../utils/block-symbols.js";
+import { kCursorExecResolved, kStreamingBlockIndex, kStreamingBlockKind, kStreamingEnvelopeId, kStreamingLastParseLen, kStreamingPartialJson } from "../utils/block-symbols.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
 export declare const CURSOR_API_URL = "https://api2.cursor.sh";
-export declare const CURSOR_CLIENT_VERSION = "cli-2026.01.09-231024f";
+export declare const CURSOR_CLIENT_VERSION = "cli-2026.07.23-e383d2b";
 export interface CursorOptions extends StreamOptions {
     customSystemPrompt?: string;
     conversationId?: string;
@@ -32,7 +32,8 @@ export type ToolCallState = ToolCall & {
     [kStreamingBlockIndex]: number;
     [kStreamingPartialJson]?: string;
     [kStreamingLastParseLen]?: number;
-    [kStreamingBlockKind]: "mcp" | "todo" | "cursor-exec";
+    [kStreamingBlockKind]: "mcp" | "todo" | "cursor-exec" | "connect-scm";
+    [kStreamingEnvelopeId]?: string;
     [kCursorExecResolved]?: true;
 };
 export interface BlockState {
@@ -43,6 +44,17 @@ export interface BlockState {
         [kStreamingBlockIndex]: number;
     }) | null;
     currentToolCall: ToolCallState | null;
+    /**
+     * Open streamed tool-call blocks, keyed by the interaction envelope's
+     * `call_id`.
+     *
+     * Cursor interleaves calls: two `toolCallStarted` frames can arrive before
+     * either completes. A single "current" slot would let the second overwrite
+     * the first, orphaning a block that nothing then settles. Every keyed block
+     * stays reachable until its own completion, and `currentToolCall` remains
+     * only as the fallback for frames that carry no `call_id`.
+     */
+    openToolCalls: Map<string, ToolCallState>;
     /** MCP call IDs synthesized from exec frames before their redundant streamed block arrives. */
     resolvedMcpToolCallIds: Set<string>;
     firstTokenTime: number | undefined;
@@ -102,6 +114,44 @@ export declare function resolveExecHandler<TArgs, TResult>(args: TArgs, handler:
  * specific recovery hint.
  */
 export declare function emptyGrepPatternRejection(pattern: string | undefined, glob: string | undefined): string | null;
+/**
+ * Retain a freshly opened streamed tool-call block.
+ *
+ * Keyed by the interaction envelope's `call_id`, which is the only key every
+ * `ToolCall*Update` for that call shares. The block's own `id` is deliberately
+ * not the key: MCP, Pi and connect-SCM blocks are filed under the id carried
+ * inside the call's `args`, because that is what the exec channel pairs its
+ * result under and what the transcript files the visible block under.
+ *
+ * `currentToolCall` is still set, as the fallback for frames that carry no
+ * `call_id` (proto3-optional, and unset on what older builds send).
+ */
+/**
+ * Close every tool-call block still open when the stream ends.
+ *
+ * Not just the last one started: with interleaved calls several can be open at
+ * once, and an unclosed block leaves its live card animating and its call
+ * unpaired.
+ *
+ * Only blocks fed by a streamed argument buffer get reparsed. Todo,
+ * connect-SCM and MCP-settled frames arrive with complete `arguments` and
+ * never set the partial buffer; `parseStreamingJson(undefined)` returns `{}`,
+ * so reparsing unconditionally would erase the arguments of every such block
+ * caught open by a truncated stream.
+ *
+ * Server-owned blocks are also paired here. `connect-scm` and `todo` are
+ * stamped {@link kCursorExecResolved} the moment they open, so `agent-loop.ts`
+ * synthesizes no placeholder for them and only their `toolCallCompleted` frame
+ * pairs a result. A transport that closes before that frame would leave the
+ * call unpaired, and `buildSessionContext` strips a dangling call from every
+ * rebuilt transcript — the interaction disappears. An interrupted result is
+ * emitted instead.
+ *
+ * MCP blocks are excluded even when resolved: the exec dispatch that marked
+ * them owns their result, and `drainInFlightDispatches` awaits it before this
+ * runs, so pairing here would duplicate one against the same `toolCallId`.
+ */
+export declare function flushOpenToolCalls(output: AssistantMessage, stream: AssistantMessageEventStream, state: BlockState): void;
 /**
  * Merge the decoded completion-frame `McpArgs` map into the args assembled
  * from streamed `args_text_delta` snapshots.

package/dist/types/providers/error-message.d.ts

@@ -1,10 +1,8 @@
 import type { Api, Model } from "../types.js";
 export declare function createProviderErrorMessage(model: Model<Api>, err: unknown): {
     role: "assistant";
-    content: {
-        type: "text";
-        text: string;
-    }[];
+    content: never[];
+    errorMessage: string;
     api: Api;
     provider: string;
     model: string;

package/dist/types/providers/openai-codex-responses.d.ts

@@ -27,6 +27,14 @@ export interface OpenAICodexResponsesOptions extends StreamOptions {
      * keys are ignored; extras are never emitted as top-level metadata fields.
      */
     clientMetadata?: Record<string, string>;
+    /**
+     * Turn id of the initiating (parent) Codex turn for nested requests such as
+     * subagent spawns (codex-rs `parent_turn_id`, #35835). Emitted both as the
+     * flat `client_metadata.parent_turn_id` key and inside the
+     * `x-codex-turn-metadata` JSON blob; blank values are ignored. The key is
+     * reserved: `clientMetadata` extras cannot supply it.
+     */
+    parentTurnId?: string;
     /**
      * Invoked when the server streams a `response.metadata` event carrying
      * ChatGPT moderation metadata (`metadata.openai_chatgpt_moderation_metadata`)
@@ -44,6 +52,8 @@ export interface OpenAICodexCompatibilityMetadataOptions {
     startNewTurn?: boolean;
     turnStartedAtUnixMs?: number;
     clientMetadata?: Readonly<Record<string, string>>;
+    /** Parent Codex turn id for nested requests; see {@link OpenAICodexResponsesOptions.parentTurnId}. */
+    parentTurnId?: string;
     /** Add the direct installation header required by `/responses/compact`. */
     includeInstallationHeader?: boolean;
 }

package/dist/types/providers/openai-responses-wire.d.ts

@@ -2453,6 +2453,14 @@ export interface ResponseFunctionToolCall {
      * The namespace of the function to run.
      */
     namespace?: string;
+    /**
+     * Plaintext-argument marker for collaboration tool calls (codex-rs
+     * `encrypted_function_args`, #35845): an empty array marks the arguments as
+     * plaintext agent-message payloads rather than encrypted blobs. Preserved
+     * verbatim across history replay so the backend keeps treating them as
+     * plaintext; omitted entirely for ordinary function calls.
+     */
+    encrypted_function_args?: string[];
     /**
      * The status of the item. One of `in_progress`, `completed`, or `incomplete`.
      * Populated when items are returned via API.

package/dist/types/providers/openai-shared.d.ts

@@ -397,7 +397,7 @@ export declare function repairOrphanResponsesToolOutputs(input: ResponseInput):
  * {@link repairOrphanResponsesToolOutputs}.
  */
 export declare function repairOrphanResponsesToolCalls(input: ResponseInput): ResponseInput;
-export declare function convertResponsesInputContent(content: string | Array<TextContent | ImageContent>, supportsImages: boolean, supportsImageDetailOriginal: boolean): ResponseInputContent[] | undefined;
+export declare function convertResponsesInputContent(content: string | Array<TextContent | ImageContent>, supportsImages: boolean, supportsImageDetailOriginal: boolean, escapeControlTokens?: boolean): ResponseInputContent[] | undefined;
 export interface BuildResponsesInputOptions<TApi extends Api> {
     model: Model<TApi>;
     context: Context;
@@ -414,6 +414,18 @@ export interface BuildResponsesInputOptions<TApi extends Api> {
     /** Preserve assistant message item IDs from text signatures during fallback replay. */
     preserveAssistantMessageIds?: boolean;
 }
+/**
+ * Escape reserved Harmony control tokens in the client-boundary text of
+ * replayed Responses input items — user/developer/system message text and
+ * tool-result output. Model-owned items (assistant output, reasoning, tool-call
+ * arguments) carry no client data and are returned untouched.
+ *
+ * Native history replay pushes stored `providerPayload` items straight onto the
+ * wire, bypassing {@link convertResponsesInputContent}; without this a stored
+ * `input_text` carrying `<|channel|>analysis` still reaches gpt-5.x raw (#6913).
+ * Callers gate on {@link isHarmonyDialectModel}. Items are copied, not mutated.
+ */
+export declare function escapeReplayedClientText(items: ResponseInput): ResponseInput;
 export declare function buildResponsesInput<TApi extends Api>(options: BuildResponsesInputOptions<TApi>): ResponseInput;
 export declare function convertResponsesAssistantMessage<TApi extends Api>(assistantMsg: AssistantMessage, model: Model<TApi>, msgIndex: number, knownCallIds: Set<string>, includeThinkingSignatures?: boolean, customCallIds?: Set<string>, preserveMessageIds?: boolean, supportsCustomToolCalls?: boolean, customToolWireNameMap?: ReadonlyMap<string, string>, computerCallIds?: Set<string>): ResponseInput;
 /** Appends one tool result while keeping consecutive outputs ahead of its synthetic image messages. */

package/dist/types/registry/exa.d.ts

@@ -0,0 +1,8 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginExa: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const exaProvider: {
+    readonly id: "exa";
+    readonly name: "Exa";
+    readonly envKeys: "EXA_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/registry.d.ts

@@ -64,6 +64,11 @@ declare const ALL: ({
     readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
     readonly callbackPort: 59653;
     readonly pasteCodeFlow: true;
+} | {
+    readonly id: "exa";
+    readonly name: "Exa";
+    readonly envKeys: "EXA_API_KEY";
+    readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
 } | {
     readonly id: "firepass";
     readonly name: "Fire Pass (Fireworks Kimi K2.6 Turbo subscription)";
@@ -282,7 +287,8 @@ declare const ALL: ({
     readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
 } | {
     readonly id: "xai";
-    readonly name: "xAI";
+    readonly name: "xAI API";
+    readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
 } | {
     readonly id: "xai-oauth";
     readonly name: "xAI Grok OAuth (SuperGrok or X Premium+)";

package/dist/types/registry/xai.d.ts

@@ -1,4 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginXAI: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
 export declare const xaiProvider: {
     readonly id: "xai";
-    readonly name: "xAI";
+    readonly name: "xAI API";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
 };

package/dist/types/stream.d.ts

@@ -5,6 +5,8 @@ import type { GoogleGeminiCliOptions } from "./providers/google-gemini-cli.js";
 import type { GoogleVertexOptions } from "./providers/google-vertex.js";
 import type { Api, AssistantMessage, Context, Model, OptionsForApi, SimpleStreamOptions, ToolChoice } from "./types.js";
 import { AssistantMessageEventStream } from "./utils/event-stream.js";
+/** Strict official-Codex endpoint check; exact origin or a path boundary after {@link CODEX_BASE_URL}. */
+export declare function isOfficialCodexApiUrl(baseUrl: string | undefined): boolean;
 export declare function configureProviderMaxInFlightRequests(limits: Record<string, number> | undefined): void;
 export declare const __providerInFlightForTesting: {
     setRoot(root: string | undefined): void;

package/dist/types/types.d.ts

@@ -1,6 +1,6 @@
 export * from "@oh-my-pi/pi-catalog/effort";
 export * from "@oh-my-pi/pi-catalog/types";
-import type { DeleteArgs, DeleteResult, DiagnosticsArgs, DiagnosticsResult, GrepArgs, GrepResult, LsArgs, LsResult, McpResult, ReadArgs, ReadResult, ShellArgs, ShellResult, WriteArgs, WriteResult } from "@oh-my-pi/pi-catalog/discovery/cursor-gen/agent_pb";
+import type { DeleteArgs, DeleteResult, DiagnosticsArgs, DiagnosticsResult, GrepArgs, GrepResult, LsArgs, LsResult, McpResult, PiBashExecArgs, PiBashExecResult, PiEditExecArgs, PiEditExecResult, PiFindExecArgs, PiFindExecResult, PiGrepExecArgs, PiGrepExecResult, PiLsExecArgs, PiLsExecResult, PiReadExecArgs, PiReadExecResult, PiWriteExecArgs, PiWriteExecResult, ReadArgs, ReadResult, ShellArgs, ShellResult, WriteArgs, WriteResult } from "@oh-my-pi/pi-catalog/discovery/cursor-gen/agent_pb";
 import type { Effort } from "@oh-my-pi/pi-catalog/effort";
 import type { Api, FetchImpl, Model, Provider, ThinkingBudgets, Usage } from "@oh-my-pi/pi-catalog/types";
 import type { Type } from "arktype";
@@ -754,6 +754,14 @@ export interface CursorMcpCall {
     toolCallId: string;
     args: Record<string, unknown>;
     rawArgs: Record<string, Uint8Array>;
+    /**
+     * The frame asks only whether this call would be permitted — it must not
+     * run. The server sends it to resolve a smart-mode approval decision ahead
+     * of the real invocation, and answers with the dedicated `approved`
+     * variant, so executing here would fire a side-effecting tool the user has
+     * not yet been asked about (and fire it twice once the real call arrives).
+     */
+    approvalOnly?: boolean;
 }
 export interface CursorTodoSnapshotItem {
     content: string;
@@ -796,6 +804,51 @@ export interface CursorShellStreamCallbacks {
     onStdout(data: string): void;
     onStderr(data: string): void;
 }
+/**
+ * A modern Pi exec frame plus the call id the dispatcher minted for it.
+ *
+ * Unlike the legacy exec args (`ReadArgs`, `ShellArgs`, ...), the Pi frames
+ * carry no `tool_call_id` field: on modern builds the id rides the streamed
+ * `ToolCall` envelope (`ToolCall.tool_call_id = 57`) instead of each variant's
+ * args. The exec channel has no access to that envelope, so the dispatcher
+ * mints an id and hands it to the handler, keeping the synthesized transcript
+ * block and its paired `toolResult` on the same key.
+ */
+export interface CursorPiCall<TArgs> {
+    args: TArgs;
+    toolCallId: string;
+}
+/** One resource a host's MCP servers advertise. */
+export interface CursorMcpResource {
+    uri: string;
+    name?: string;
+    description?: string;
+    mimeType?: string;
+    /** The server advertising it; Cursor addresses reads by this name. */
+    server: string;
+}
+/**
+ * The content of one resource read.
+ *
+ * `text` and `blob` are the wire's content oneof: exactly one is sent, with
+ * `text` winning when a host supplies both. A download instead sets
+ * `downloadPath` and no content at all — the model is told where the file
+ * landed rather than being handed its bytes.
+ */
+export interface CursorMcpResourceContent {
+    uri: string;
+    name?: string;
+    description?: string;
+    mimeType?: string;
+    text?: string;
+    blob?: Uint8Array;
+    /**
+     * Where the host wrote the resource, workspace-relative, when the frame
+     * asked for a download. Set this INSTEAD of `text`/`blob`: the wire
+     * contract is that a download returns no content to the model.
+     */
+    downloadPath?: string;
+}
 export interface CursorExecHandlers {
     read?: (args: ReadArgs) => Promise<CursorExecHandlerResult<ReadResult>>;
     ls?: (args: LsArgs) => Promise<CursorExecHandlerResult<LsResult>>;
@@ -806,6 +859,53 @@ export interface CursorExecHandlers {
     shellStream?: (args: ShellArgs, callbacks: CursorShellStreamCallbacks) => Promise<CursorExecHandlerResult<ShellResult>>;
     diagnostics?: (args: DiagnosticsArgs) => Promise<CursorExecHandlerResult<DiagnosticsResult>>;
     mcp?: (call: CursorMcpCall) => Promise<CursorExecHandlerResult<McpResult>>;
+    /**
+     * Answers "would this MCP call be permitted", without running it.
+     *
+     * A modern `mcpArgs` frame carrying `smart_mode_approval_only` asks for the
+     * permission decision alone, ahead of the real invocation. Executing the
+     * tool to answer it would fire a side effect the user never approved — and
+     * fire it twice once the real call arrives.
+     *
+     * `true` only when the host's policy resolves to a definite allow. A pending
+     * prompt is `false`: it can only be answered interactively at execution
+     * time, and there is no "ask me later" reply in this frame's result. When no
+     * handler is registered the provider refuses, since it cannot decide.
+     */
+    mcpApprovalPreflight?: (call: CursorMcpCall) => Promise<boolean>;
+    /**
+     * Modern Cursor CLI Pi tool frames (`ExecServerMessage` 45-51). They are a
+     * distinct frame family from the legacy `readArgs`/`shellArgs`/... set, not
+     * an alias: different args, different result oneofs, and no `tool_call_id`.
+     */
+    piRead?: (call: CursorPiCall<PiReadExecArgs>) => Promise<CursorExecHandlerResult<PiReadExecResult>>;
+    piBash?: (call: CursorPiCall<PiBashExecArgs>) => Promise<CursorExecHandlerResult<PiBashExecResult>>;
+    piEdit?: (call: CursorPiCall<PiEditExecArgs>) => Promise<CursorExecHandlerResult<PiEditExecResult>>;
+    piWrite?: (call: CursorPiCall<PiWriteExecArgs>) => Promise<CursorExecHandlerResult<PiWriteExecResult>>;
+    piGrep?: (call: CursorPiCall<PiGrepExecArgs>) => Promise<CursorExecHandlerResult<PiGrepExecResult>>;
+    piFind?: (call: CursorPiCall<PiFindExecArgs>) => Promise<CursorExecHandlerResult<PiFindExecResult>>;
+    piLs?: (call: CursorPiCall<PiLsExecArgs>) => Promise<CursorExecHandlerResult<PiLsExecResult>>;
+    /**
+     * The resources the host's MCP servers advertise, optionally filtered to one
+     * server. Without a handler the provider answers an empty catalog, which
+     * hides resources a host is in fact holding live connections to.
+     */
+    listMcpResources?: (args: {
+        server?: string;
+    }) => Promise<CursorMcpResource[]>;
+    /**
+     * Read one resource. `null` means the server or uri is genuinely unknown,
+     * which the provider answers as `not_found`; throwing surfaces as `error`.
+     */
+    readMcpResource?: (args: {
+        server: string;
+        uri: string;
+        /**
+         * When set, write the resource here (workspace-relative) and return
+         * `downloadPath` instead of content.
+         */
+        downloadPath?: string;
+    }) => Promise<CursorMcpResourceContent | null>;
     /** Mirror Cursor's server-owned todo list into local session state. */
     todoSync?: CursorTodoSyncHandler;
     onToolResult?: CursorToolResultHandler;

package/dist/types/usage/umans.d.ts

@@ -0,0 +1,2 @@
+import type { UsageProvider } from "../usage.js";
+export declare const umansUsageProvider: UsageProvider;

package/dist/types/utils/block-symbols.d.ts

@@ -14,6 +14,17 @@ export declare function clearStreamingPartialJson(block: StreamingPartialJsonCar
 export declare const kStreamingBlockIndex: unique symbol;
 /** Stores the last parsed argument prefix length for throttled streaming JSON parsing. */
 export declare const kStreamingLastParseLen: unique symbol;
+/**
+ * The Cursor interaction envelope's `call_id` for a streamed tool-call block.
+ *
+ * Tracked separately from the block's own `id` because they are NOT the same
+ * key: MCP and Pi blocks are filed under the id inside the call's `args`, which
+ * is what the exec channel pairs its result under, while every streamed
+ * `ToolCall*Update` correlates on the envelope's `call_id`. Matching
+ * completions against the block id would mis-route every call whose args carry
+ * their own id.
+ */
+export declare const kStreamingEnvelopeId: unique symbol;
 /** Marks streamed tool-call arguments that already received an authoritative done payload. */
 export declare const kStreamingArgumentsDone: unique symbol;
 /** Classifies Cursor's in-flight tool-call kind without leaking provider-private state. */

package/dist/types/utils/harmony-leak.d.ts

@@ -1,13 +1,21 @@
+import type { AssistantMessage, Model, ToolCall } from "../types.js";
 /**
- * GPT-5 Harmony-header leakage detection and recovery.
+ * Escape reserved Harmony control tokens in arbitrary text so it can be
+ * transported as data to a harmony-dialect model. Returns the input unchanged
+ * when it carries no reserved spelling.
  *
- * Background and policy: see `docs/ERRATA-GPT5-HARMONY.md`. This module
- * implements §3 of that document: detection by signal fusion, plus a
- * truncate-and-resume primitive for the `edit` tool when its input is in
- * hashline DSL form. Other tools and surfaces fall through to
- * abort-and-retry handled by the agent loop.
+ * Callers MUST gate on a harmony target and escape only the transport copy —
+ * the persisted transcript keeps the byte-for-byte original.
  */
-import type { AssistantMessage, Model, ToolCall } from "../types.js";
+export declare function escapeHarmonyControlTokens(text: string): string;
+/**
+ * Whether requests to `model` are served by a Harmony-dialect backend
+ * (gpt-5.x / gpt-oss), which rejects reserved control-token spellings appearing
+ * as data in the request. Resolves the wire model id (`requestModelId ?? id`)
+ * so deployment/catalog aliases — e.g. an Azure alias whose `requestModelId` is
+ * `gpt-5.4` — are detected even when the local id is opaque.
+ */
+export declare function isHarmonyDialectModel(model: Model): boolean;
 declare const SIGNAL_ORDER: readonly ["M", "C", "G", "S", "B", "R", "T"];
 export type HarmonySignalClass = "H" | (typeof SIGNAL_ORDER)[number];
 export type HarmonySurface = "assistant_text" | "assistant_thinking" | "tool_arg";

package/dist/types/utils/proxy.d.ts

@@ -29,6 +29,8 @@ export interface ConnectProxiedSocketOptions {
     signal?: AbortSignal;
     /** Maximum wall-clock time to establish the final TLS tunnel. Disabled when absent or non-positive. */
     timeoutMs?: number;
+    /** Target TLS profile. Cursor defaults to HTTP/2 when this is absent. */
+    tls?: tls.ConnectionOptions;
 }
 /**
  * Tunnel a socket connection through an HTTP CONNECT proxy.

package/dist/types/utils/schema/normalize.d.ts

@@ -26,6 +26,7 @@ export interface NormalizeSchemaOptions {
     inferTypeForBareEnum: boolean;
     foldOneOfIntoAnyOf: boolean;
     dropNonScalarEnum: boolean;
+    stringEnumsOnly?: boolean;
     rejectResidualIncompatibilities?: ReadonlyArray<ResidualSchemaIncompatibility>;
     validateAndFallback?: {
         fallback: unknown;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "17.1.8",
+	"version": "17.2.1",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.1",
-		"@oh-my-pi/pi-catalog": "17.1.8",
-		"@oh-my-pi/pi-utils": "17.1.8",
-		"@oh-my-pi/pi-wire": "17.1.8",
+		"@oh-my-pi/pi-catalog": "17.2.1",
+		"@oh-my-pi/pi-utils": "17.2.1",
+		"@oh-my-pi/pi-wire": "17.2.1",
 		"arktype": "2.2.3",
 		"zod": "^4"
 	},

package/src/auth-broker/client.ts

@@ -28,6 +28,7 @@ import type {
 	UsageResponse,
 	UsageStaleResponse,
 } from "./types";
+import { AUTH_BROKER_CAPABILITIES_HEADER, AUTH_BROKER_CAPABILITY_CODEX_METER_BLOCK_SCOPES } from "./types";
 import { getAuthBrokerWireSchemas } from "./wire-schema-resource";
 
 type AuthBrokerResponseSchemaName =
@@ -135,7 +136,9 @@ export class AuthBrokerClient {
 		const query = new URLSearchParams();
 		if (opts.waitMs !== undefined) query.set("wait", String(opts.waitMs));
 		const path = `/v1/snapshot${query.size > 0 ? `?${query.toString()}` : ""}`;
-		const headers: Record<string, string> = {};
+		const headers: Record<string, string> = {
+			[AUTH_BROKER_CAPABILITIES_HEADER]: AUTH_BROKER_CAPABILITY_CODEX_METER_BLOCK_SCOPES,
+		};
 		if (opts.ifGenerationGt !== undefined) headers["If-None-Match"] = `"${opts.ifGenerationGt}"`;
 		const timeoutMs =
 			opts.waitMs !== undefined && opts.waitMs > 0 ? Math.max(this.#timeoutMs, opts.waitMs + 1000) : undefined;
@@ -176,6 +179,7 @@ export class AuthBrokerClient {
 		const headers: Record<string, string> = {
 			Accept: "text/event-stream",
 			Authorization: `Bearer ${this.#token}`,
+			[AUTH_BROKER_CAPABILITIES_HEADER]: AUTH_BROKER_CAPABILITY_CODEX_METER_BLOCK_SCOPES,
 		};
 		if (opts.signal?.aborted) {
 			throw new AuthBrokerError("Auth broker request aborted", { cause: opts.signal.reason });