@oh-my-pi/pi-ai 17.2.12 → 17.2.14

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## [Unreleased]
 
+## [17.2.14] - 2026-08-11
+
+### Added
+
+- Added `forceReasoningOff` and `disableReasoning` options to disable reasoning in OpenAI and Azure OpenAI models
+
+## [17.2.13] - 2026-08-11
+
+### Changed
+
+- Standardized first-party outbound User-Agent headers on `omp/<version>` via the shared `USER_AGENT` utility.
+
+### Fixed
+
+- Fixed the Amazon Bedrock and Cursor transports ignoring `StreamOptions.headers`; both built their request headers from scratch, so caller-supplied tracing or attribution headers were silently dropped while working on every other provider ([#8107](https://github.com/can1357/oh-my-pi/pull/8107) by [@svperfecta](https://github.com/svperfecta)).
+- Fixed Antigravity Flash turns hanging after successful response headers when the endpoint never emitted an SSE event; the provider now cancels the stalled body and fails over after 60 seconds while retaining the longer allowance for Pro reasoning starts.
+- Fixed Cursor exec-bridge bash/grep calls failing ArkType validation when the server omitted optional frame fields: synthesized and executed tool args now drop `undefined` keys (`cwd`, `case`, `skip`, `timeout`) instead of writing `optional: value || undefined`.
+- Fixed Cursor sessions double-executing settled tools when `tools.format` is an owned dialect (e.g. `gemini`): `wrapInbandToolStream` rebuilt toolCall blocks without copying `kCursorExecResolved`, so agent-loop re-ran bash/grep/todo and appended a second result for the same call id.
+- Fixed Codex Responses Lite requests for opaque model codenames such as Daybreak omitting the required `reasoning.context: "all_turns"` value and failing with HTTP 400.
+- Fixed Cursor personal usage reporting for current Pro / Pro+ / Ultra `/api/usage-summary` payloads that expose `individualUsage.plan` (and optional `onDemand`) instead of the older `individualUsage.overall` bucket ([#7998](https://github.com/can1357/oh-my-pi/pull/7998) by [@dnth](https://github.com/dnth)).
+- Allowed passive Google callers to accept empty or thinking-only `STOP` responses as successful silence instead of exhausting the provider's empty-response retry budget. ([#8223](https://github.com/can1357/oh-my-pi/issues/8223))
+- Fixed the AWS credential resolver ignoring `role_arn` profiles: shared-config role chaining (`source_profile` recursion, `web_identity_token_file`, `credential_source`) now resolves via STS `AssumeRole`/`AssumeRoleWithWebIdentity`, honoring `role_session_name`/`duration_seconds`/`external_id`, so Bedrock is detected on EKS/IRSA and multi-account setups instead of reporting "No models available" ([#8209](https://github.com/can1357/oh-my-pi/issues/8209)).
+- Fixed Bedrock availability being under-detected on Nitro/EKS hosts: the EC2 metadata probe now recognizes Nitro DMI markers (`board_asset_tag` instance ids, `Amazon EC2` vendor fields) in addition to the Xen `ec2` UUID prefix ([#8209](https://github.com/can1357/oh-my-pi/issues/8209)).
+- Fixed DeepSeek Responses targets (opencode-go) rejecting a thinking-mode continuation with `400 The reasoning_text in the thinking mode must be passed back to the API` after a prewalk hand-off plus mid-run compaction: the Responses input builder re-encoded replayed assistant turns without a reasoning item, so the request enabled reasoning but shipped no `reasoning_text`. The encoder now synthesizes a `reasoning_text` reasoning item for every replayed assistant turn when the target requires reasoning replay in thinking mode (`requiresReasoningContentForAllAssistantTurns` / `requiresReasoningContentForToolCalls`), mirroring the chat-completions `reasoning_content` safety net ([#8248](https://github.com/can1357/oh-my-pi/issues/8248)).
+
 ## [17.2.12] - 2026-08-08
 
 ### Fixed

package/dist/types/error/aws.d.ts

@@ -13,7 +13,11 @@ export type AwsCredentialsErrorKind =
 /** STS web-identity exchange failed or returned malformed credentials. */
  | "web-identity"
 /** ECS/container credential endpoint failed or returned malformed credentials. */
- | "container";
+ | "container"
+/** Shared-config role chain is misconfigured (cycle, missing source_profile, unsupported credential_source). */
+ | "profile"
+/** STS `AssumeRole` call failed or returned malformed credentials. */
+ | "assume-role";
 /** A failure resolving AWS credentials for the Bedrock provider. */
 export declare class AwsCredentialsError extends Error {
     readonly kind: AwsCredentialsErrorKind;

package/dist/types/providers/aws-credentials.d.ts

@@ -5,8 +5,9 @@
  *  1. Static credentials from the environment
  *     (`AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` [+ `AWS_SESSION_TOKEN`]).
  *  2. Web identity (`AWS_WEB_IDENTITY_TOKEN_FILE` + `AWS_ROLE_ARN`).
- *  3. Profile in `~/.aws/credentials` (and `~/.aws/config` for SSO):
- *      - static keys, SSO, or `credential_process`.
+ *  3. Profile in `~/.aws/credentials` (and `~/.aws/config` for SSO/roles):
+ *      - static keys, SSO, `credential_process`, or `role_arn` role chaining
+ *        (`source_profile` recursion, `web_identity_token_file`, `credential_source`).
  *  4. ECS/container credentials from `AWS_CONTAINER_CREDENTIALS_*`.
  *  5. EC2 IMDSv2 when metadata is enabled.
  *
@@ -14,7 +15,7 @@
  * 60 s before `Expiration` to absorb clock skew.
  */
 import type { FetchImpl } from "../types.js";
-import type { AwsCredentials } from "./aws-sigv4.js";
+import { type AwsCredentials } from "./aws-sigv4.js";
 export interface ResolvedCredentials extends AwsCredentials {
     /** Absolute expiration timestamp in ms. `undefined` for non-expiring static creds. */
     expiresAt?: number;

package/dist/types/providers/azure-openai-responses.d.ts

@@ -9,6 +9,7 @@ export interface AzureOpenAIResponsesOptions extends StreamOptions {
     azureDeploymentName?: string;
     toolChoice?: ToolChoice;
     serviceTier?: ServiceTier;
+    disableReasoning?: boolean;
 }
 /**
  * Generate function for Azure OpenAI Responses API

package/dist/types/providers/cursor/exec-modern.d.ts

@@ -17,7 +17,7 @@ import type { ToolResultMessage } from "../../types.js";
  * virtual registry. Re-exported here because this is where the frame builders
  * and their translation are consumed together.
  */
-export { piEscapeRegexLiteral, piGrepSkip, piJoinPath, piLimit, piLsPath, piReadDisplayPath, piReadPath, piReadPathHasRange, piTimeout, } from "../cursor-pi-args.js";
+export { omitUndefinedArgs, piEscapeRegexLiteral, piGrepSkip, piJoinPath, piLimit, piLsPath, piReadDisplayPath, piReadPath, piReadPathHasRange, piTimeout, } from "../cursor-pi-args.js";
 /** Flatten a tool result's content into the single `output` string the Pi frames carry. */
 export declare function piOutputText(toolResult: ToolResultMessage): string;
 /**

package/dist/types/providers/cursor-pi-args.d.ts

@@ -103,3 +103,17 @@ export declare function piLimit(limit: number | undefined): number | undefined;
  * Negative values have no local meaning and fall back to the default.
  */
 export declare function piTimeout(timeout: number | undefined): number | undefined;
+/**
+ * Drop keys whose value is `undefined` so optional local-tool kwargs stay
+ * absent rather than present-as-undefined.
+ *
+ * The Cursor exec bridge historically wrote forms like
+ * `cwd: workingDirectory || undefined` and
+ * `case: caseInsensitive === true ? false : undefined`. ArkType rejects a
+ * present `undefined` on an optional field (`was undefined`) even though
+ * omitting the key is valid — which flooded Cursor sessions with bash/grep
+ * validation errors for otherwise fine frames.
+ */
+export declare function omitUndefinedArgs<T extends Record<string, unknown>>(args: T): {
+    [K in keyof T]?: Exclude<T[K], undefined>;
+};

package/dist/types/providers/openai-codex/request-transformer.d.ts

@@ -13,6 +13,8 @@ export interface ReasoningConfig {
 export interface CodexRequestOptions {
     /** User-facing effort; maps 1:1 onto the wire tier of the same name. */
     reasoningEffort?: CodexCallerEffort | "none";
+    /** Suppress native reasoning by sending `reasoning.effort: "none"`. */
+    reasoningOff?: boolean;
     reasoningSummary?: ReasoningConfig["summary"] | null;
     /** Explicit `reasoning.context` override. Omitted by default; Responses Lite forces `all_turns` as required by that transport. */
     reasoningContext?: CodexReasoningContext;

package/dist/types/providers/openai-responses.d.ts

@@ -114,6 +114,7 @@ type OpenAIResponsesSamplingParams = ResponseCreateParamsStreaming & {
 export declare const streamOpenAIResponses: StreamFunction<"openai-responses">;
 export declare function buildParams(model: Model<"openai-responses">, context: Context, options: OpenAIResponsesOptions | undefined, providerSessionState: OpenAIResponsesProviderSessionState | undefined, strictToolsScope?: OpenAIStrictToolsScope, disableStrictToolsOverride?: boolean, statefulCacheBaseline?: ResponseInput): {
     params: OpenAIResponsesSamplingParams;
+    trailingScaffoldingItems: number;
     strictToolsApplied: boolean;
 };
 /**

package/dist/types/providers/openai-shared.d.ts

@@ -419,6 +419,14 @@ export interface BuildResponsesInputOptions<TApi extends Api> {
     repairOrphanOutputs?: boolean;
     /** Preserve assistant message item IDs from text signatures during fallback replay. */
     preserveAssistantMessageIds?: boolean;
+    /**
+     * Synthesize a reasoning item for every replayed assistant turn that carries
+     * content but no reasoning item. Set for DeepSeek-family Responses targets
+     * that reject a thinking-mode continuation lacking `reasoning_text`.
+     */
+    requiresReasoningReplayForAllTurns?: boolean;
+    /** As {@link requiresReasoningReplayForAllTurns}, but only for turns that contain a tool call. */
+    requiresReasoningReplayForToolCalls?: boolean;
 }
 /**
  * Escape reserved Harmony control tokens in the free-text fields of replayed
@@ -443,7 +451,7 @@ export interface BuildResponsesInputOptions<TApi extends Api> {
  */
 export declare function escapeReplayedControlTokens(items: ResponseInput): ResponseInput;
 export declare function buildResponsesInput<TApi extends Api>(options: BuildResponsesInputOptions<TApi>): ResponseInput;
-export declare function convertResponsesAssistantMessage<TApi extends Api>(assistantMsg: AssistantMessage, model: Model<TApi>, msgIndex: number, knownCallIds: Set<string>, includeThinkingSignatures?: boolean, customCallIds?: Set<string>, preserveMessageIds?: boolean, supportsCustomToolCalls?: boolean, customToolWireNameMap?: ReadonlyMap<string, string>, computerCallIds?: Set<string>): ResponseInput;
+export declare function convertResponsesAssistantMessage<TApi extends Api>(assistantMsg: AssistantMessage, model: Model<TApi>, msgIndex: number, knownCallIds: Set<string>, includeThinkingSignatures?: boolean, customCallIds?: Set<string>, preserveMessageIds?: boolean, supportsCustomToolCalls?: boolean, customToolWireNameMap?: ReadonlyMap<string, string>, computerCallIds?: Set<string>, requiresReasoningReplayForAllTurns?: boolean, requiresReasoningReplayForToolCalls?: boolean): ResponseInput;
 /** Appends one tool result while keeping consecutive outputs ahead of its synthetic image messages. */
 export declare function appendResponsesToolResultMessages<TApi extends Api>(messages: ResponseInput, toolResult: ToolResultMessage, model: Model<TApi>, strictResponsesPairing: boolean, supportsImageDetailOriginal: boolean, knownCallIds: ReadonlySet<string>, customCallIds?: ReadonlySet<string>, supportsCustomToolCalls?: boolean, computerCallIds?: ReadonlySet<string>): void;
 /**
@@ -497,6 +505,8 @@ export declare function appendMessageContentPart(item: ResponseOutputMessage, pa
 export declare function appendMessageTextDelta(item: ResponseOutputMessage, block: TextContent, delta: string, stream: AssistantMessageEventStream, output: AssistantMessage, contentIndex: number, partType: "output_text" | "refusal"): void;
 /** Chooses final message text while treating non-empty terminal content as authoritative. */
 export declare function finalizeMessageText(item: ResponseOutputMessage, streamedText: string): string;
+export declare const JUICE_EFFORT_MAP: Record<string, number>;
+export declare function getJuiceValue(effort?: string): number;
 export declare function accumulateToolCallArgumentsDelta(block: ResponsesToolCallBlock, delta: string, stream: AssistantMessageEventStream, output: AssistantMessage, contentIndex: number): void;
 /**
  * Finalize streamed function-call arguments from the authoritative `.done`
@@ -583,6 +593,14 @@ type ReasoningOptions = {
 export interface ApplyResponsesCompatPolicyOptions {
     reasoningSummary?: "auto" | "detailed" | "concise" | null;
     mapEffort?: (effort: string) => string;
+    /**
+     * Suppress native reasoning by sending `reasoning.effort: "none"` — the only
+     * disable level the Responses API defines (`"off"` is not a wire value and
+     * 400s everywhere). Gateways that reject `none` for a given model are
+     * handled by the reasoning-effort fallback retry, which clamps to the
+     * lowest level the error reports as allowed.
+     */
+    forceReasoningOff?: boolean;
 }
 export declare function applyResponsesCompatPolicy<P extends ResponseCreateParamsStreaming>(params: P, policy: OpenAICompatPolicy, options: ApplyResponsesCompatPolicyOptions | undefined): void;
 /**

package/dist/types/types.d.ts

@@ -294,6 +294,11 @@ export interface StreamOptions {
      * `false` so `previous_response_id` cannot explain a result.
      */
     statefulResponses?: boolean;
+    /**
+     * Emit `reasoning: { effort: "none" }` for OpenAI Responses and Codex requests.
+     * Used when a caller supplies an external reasoning scratchpad; other transports ignore it.
+     */
+    forceReasoningOff?: boolean;
     /**
      * Provider-scoped mutable state store for this agent session.
      * Providers can use this to persist transport/session state between turns.
@@ -368,6 +373,13 @@ export interface StreamOptions {
      * Optional retry delay hook for tests and transports that need custom scheduling.
      */
     providerRetryWait?: (delayMs: number, signal?: AbortSignal) => Promise<void>;
+    /**
+     * Accept a Google `STOP` response with no visible text or tool call as a
+     * successful completion. Passive callers such as advisors use this because
+     * silence is a valid result; interactive agent turns retain empty-response
+     * retries by default. Ignored by non-Google providers.
+     */
+    acceptEmptyResponse?: boolean;
     /**
      * Optional `fetch` implementation override. Providers route every HTTP
      * request — direct calls, SDK clients, and retry helpers — through this

package/dist/types/usage/cursor.d.ts

@@ -1,4 +1,15 @@
 import type { UsageProvider, UsageReport } from "../usage.js";
+/**
+ * Cursor's `/api/usage-summary` has shipped two personal-bucket shapes:
+ * - Enterprise/team dashboards historically exposed `individualUsage.overall`
+ * - Current Pro / Pro+ / Ultra dashboards expose `individualUsage.plan`
+ *   (plus optional `onDemand`)
+ *
+ * Prefer a *usable* overall bucket; if overall is absent/disabled/malformed,
+ * fall through to plan rails (`autoPercentUsed` / `apiPercentUsed`). Always
+ * consider on-demand afterward so a valid on-demand meter is not dropped when
+ * the included plan bucket is empty.
+ */
 export declare function parseCursorIndividualUsage(payload: unknown, fetchedAt?: number): UsageReport | null;
 export declare function parseCursorUsage(payload: unknown, fetchedAt?: number): UsageReport | null;
 export declare const cursorUsageProvider: UsageProvider;

package/dist/types/utils/block-symbols.d.ts

@@ -45,6 +45,18 @@ export declare const kCursorExecResolved: unique symbol;
 export type CursorExecResolvedCarrier = object & {
     [kCursorExecResolved]?: true;
 };
+/** True when a toolCall block was already executed by Cursor's exec channel. */
+export declare function isCursorExecResolved(block: CursorExecResolvedCarrier | null | undefined): boolean;
+/**
+ * Copy {@link kCursorExecResolved} onto a cloned/projected toolCall block.
+ *
+ * Stream projectors (owned/in-band dialect, leaked-thinking heal) rebuild
+ * toolCall objects field-by-field. Dropping this marker lets `agent-loop.ts`
+ * re-execute a call Cursor already settled — duplicate toolResults and a
+ * second bash/write/delete. Partial-JSON is already copied explicitly; this
+ * marker is the other load-bearing symbol that must survive the same way.
+ */
+export declare function copyCursorExecResolved(target: CursorExecResolvedCarrier, source: CursorExecResolvedCarrier): void;
 /**
  * Marks a text block synthesized by cross-model thinking demotion in
  * `transformMessages`. Converters that flatten adjacent text blocks into one

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "17.2.12",
+	"version": "17.2.14",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,10 +38,10 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.1",
-		"@oh-my-pi/omptype": "17.2.12",
-		"@oh-my-pi/pi-catalog": "17.2.12",
-		"@oh-my-pi/pi-utils": "17.2.12",
-		"@oh-my-pi/pi-wire": "17.2.12"
+		"@oh-my-pi/omptype": "17.2.14",
+		"@oh-my-pi/pi-catalog": "17.2.14",
+		"@oh-my-pi/pi-utils": "17.2.14",
+		"@oh-my-pi/pi-wire": "17.2.14"
 	},
 	"devDependencies": {
 		"@bufbuild/protoc-gen-es": "^2.12.1",

package/src/dialect/owned-stream.ts

@@ -7,6 +7,7 @@ import type {
 } from "../types";
 import {
 	clearStreamingPartialJson,
+	copyCursorExecResolved,
 	getStreamingPartialJson,
 	type StreamingPartialJsonCarrier,
 	setStreamingPartialJson,
@@ -54,6 +55,7 @@ function cloneToolCall(source: StreamingToolCall): StreamingToolCall {
 	};
 	const partialJson = getStreamingPartialJson(source);
 	if (partialJson !== undefined) setStreamingPartialJson(block, partialJson);
+	copyCursorExecResolved(block, source);
 	return block;
 }
 
@@ -65,6 +67,7 @@ function syncToolCall(target: StreamingToolCall, source: StreamingToolCall): voi
 	const partialJson = getStreamingPartialJson(source);
 	if (partialJson === undefined) clearStreamingPartialJson(target);
 	else setStreamingPartialJson(target, partialJson);
+	copyCursorExecResolved(target, source);
 }
 
 function hasNamedNativeToolCall(source: StreamingToolCall | undefined): source is StreamingToolCall {

package/src/error/aws.ts

@@ -13,7 +13,11 @@ export type AwsCredentialsErrorKind =
 	/** STS web-identity exchange failed or returned malformed credentials. */
 	| "web-identity"
 	/** ECS/container credential endpoint failed or returned malformed credentials. */
-	| "container";
+	| "container"
+	/** Shared-config role chain is misconfigured (cycle, missing source_profile, unsupported credential_source). */
+	| "profile"
+	/** STS `AssumeRole` call failed or returned malformed credentials. */
+	| "assume-role";
 
 /** A failure resolving AWS credentials for the Bedrock provider. */
 export class AwsCredentialsError extends Error {

package/src/providers/amazon-bedrock.ts

@@ -47,6 +47,19 @@ import { decodeEventStream } from "./aws-eventstream";
 import { signRequest } from "./aws-sigv4";
 import { transformMessages } from "./transform-messages";
 
+/**
+ * Headers SigV4 generates for itself. A caller cannot be allowed to supply these:
+ * `signRequest` would sign the caller's value but return its own, so the signature
+ * would not match what goes on the wire.
+ */
+const SIGNER_OWNED_HEADERS = new Set(["host", "x-amz-date", "x-amz-content-sha256", "x-amz-security-token"]);
+
+/** Headers the Bedrock request sets itself; a caller copy in any casing duplicates them. */
+// `content-length` included: the fetch layer recomputes it from the serialized
+// body, so a caller value would be signed but not sent, and AWS rejects the
+// mismatch.
+const BEDROCK_RESERVED_HEADERS = new Set(["content-type", "accept", "authorization", "content-length"]);
+
 export type BedrockThinkingDisplay = "summarized" | "omitted";
 
 export interface BedrockOptions extends StreamOptions {
@@ -356,7 +369,32 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 
 			const bodyText = JSON.stringify(commandInput);
 			const body = new TextEncoder().encode(bodyText);
+			// Caller headers are merged BEFORE signing, so SigV4 covers them and they
+			// reach the wire. Bedrock built its header map from scratch and ignored
+			// `options.headers` entirely, so tracing/attribution headers set by a
+			// caller (or by a `before_provider_headers` extension) were silently
+			// dropped here while working on every other provider. Content-type and
+			// accept stay last: the eventstream framing is not the caller's to change.
+			//
+			// The signer's OWN headers are dropped first, and that is load-bearing:
+			// `signRequest` lets a caller value overwrite `host`/`x-amz-*` in the map
+			// it signs, but always RETURNS the generated ones, which `requestHeaders`
+			// below then puts on the wire. A caller supplying any of them would sign
+			// one set of values and send another, and Bedrock would reject every
+			// request with a signature mismatch.
+			// Lower-cased, and names the request sets itself are dropped. Keeping a
+			// caller `Content-Type` beside the fixed `content-type` leaves TWO object
+			// keys: SigV4 signs one value while fetch canonicalizes both into a single
+			// comma-joined wire header, so AWS validates different bytes than were
+			// signed and rejects the request.
+			const callerHeaders: Record<string, string> = {};
+			for (const [name, value] of Object.entries(options?.headers ?? {})) {
+				const field = name.toLowerCase();
+				if (SIGNER_OWNED_HEADERS.has(field) || BEDROCK_RESERVED_HEADERS.has(field)) continue;
+				callerHeaders[field] = value;
+			}
 			const baseHeaders: Record<string, string> = {
+				...callerHeaders,
 				"content-type": "application/json",
 				accept: "application/vnd.amazon.eventstream",
 			};