@oh-my-pi/pi-ai 17.2.4 → 17.2.6

package/src/providers/openai-codex-responses.ts

@@ -84,6 +84,7 @@ import type {
 	ResponseFunctionToolCall,
 	ResponseInput,
 	ResponseInputContent,
+	ResponseOutputItem,
 	ResponseOutputMessage,
 	ResponseReasoningItem,
 	ResponseStatus,
@@ -96,6 +97,7 @@ import {
 	appendReasoningSummaryPart,
 	appendReasoningSummaryPartDone,
 	appendReasoningSummaryTextDelta,
+	appendResponsesImageResult,
 	appendResponsesToolResultMessages,
 	applyOpenAIServiceTier,
 	applyReasoningSummaryDone,
@@ -106,7 +108,7 @@ import {
 	createSequentialCutoffSummaryState,
 	encodeResponsesToolCallId,
 	encodeTextSignatureV1,
-	escapeReplayedClientText,
+	escapeReplayedControlTokens,
 	finalizeCustomToolCallInputDone,
 	finalizeMessageText,
 	finalizePendingResponsesToolCalls,
@@ -371,7 +373,8 @@ type CodexEventItem =
 	| ResponseOutputMessage
 	| ResponseFunctionToolCall
 	| ResponseCustomToolCall
-	| ResponseComputerToolCall;
+	| ResponseComputerToolCall
+	| ResponseOutputItem.ImageGenerationCall;
 type CodexOutputBlock =
 	| ThinkingContent
 	| TextContent
@@ -2289,6 +2292,7 @@ class CodexStreamProcessor {
 		const rawItem = rawEvent.item;
 		if (!rawItem || typeof rawItem !== "object") return;
 		const item = structuredCloneJSON(rawItem) as CodexEventItem;
+		if (item.type === "image_generation_call" && item.result) item.status = "completed";
 		runtime.nativeOutputItems.push(item as unknown as Record<string, unknown>);
 
 		// Match the finalization to the OPEN ITEM that started this block, not the
@@ -2301,6 +2305,12 @@ class CodexStreamProcessor {
 		const block = entry?.block ?? null;
 		const contentIndex = entry?.contentIndex ?? output.content.length - 1;
 
+		if (item.type === "image_generation_call" && item.result) {
+			appendResponsesImageResult(output, stream, item.result);
+			runtime.closeOpenItem(entry);
+			return;
+		}
+
 		if (item.type === "reasoning" && block?.type === "thinking") {
 			this.#flushSummaryDeltas(entry);
 			block.thinking = finalizeReasoningThinking(
@@ -4339,6 +4349,9 @@ function convertMessages(model: Model<"openai-codex-responses">, context: Contex
 	};
 
 	const transformedMessages = transformMessages(context.messages, model, normalizeToolCallId);
+	// gpt-5.x reject raw Harmony control-token spellings anywhere in replayed
+	// input, including the model's own tool-call arguments (#6913).
+	const escapeControlTokens = isHarmonyDialectModel(model);
 	let msgIndex = 0;
 	// Track call_ids that originated as custom tool calls so paired tool-result
 	// messages can be replayed as `custom_tool_call_output` rather than
@@ -4368,7 +4381,7 @@ function convertMessages(model: Model<"openai-codex-responses">, context: Contex
 						knownCallIds.add(item.call_id);
 					}
 				}
-				messages.push(...(isHarmonyDialectModel(model) ? escapeReplayedClientText(replayItems) : replayItems));
+				messages.push(...(escapeControlTokens ? escapeReplayedControlTokens(replayItems) : replayItems));
 				msgIndex += 1;
 				continue;
 			}
@@ -4394,10 +4407,11 @@ function convertMessages(model: Model<"openai-codex-responses">, context: Contex
 			if (historyItems) {
 				const sanitizedHistoryItems = sanitizeOpenAIResponsesAssistantHistoryItemsForReplay(historyItems);
 				if (sanitizedHistoryItems) {
-					const replayItems =
+					const rawReplayItems =
 						model.supportsComputerUse === true
 							? sanitizedHistoryItems
 							: unrollCodexComputerItems(sanitizedHistoryItems, model.compat.supportsImageDetailOriginal);
+					const replayItems = escapeControlTokens ? escapeReplayedControlTokens(rawReplayItems) : rawReplayItems;
 					for (const item of replayItems) {
 						if (item.type === "custom_tool_call") {
 							customCallIds.add(item.call_id);
@@ -4435,7 +4449,7 @@ function convertMessages(model: Model<"openai-codex-responses">, context: Contex
 				? sanitizeOpenAIResponsesAssistantFallbackItemsForReplay(convertedOutputItems)
 				: convertedOutputItems;
 			if (outputItems.length > 0) {
-				messages.push(...outputItems);
+				messages.push(...(escapeControlTokens ? escapeReplayedControlTokens(outputItems) : outputItems));
 			}
 			msgIndex += 1;
 			continue;

package/src/providers/openai-shared.ts

@@ -78,7 +78,11 @@ import {
 	kStreamingPartialJson,
 } from "../utils/block-symbols";
 import type { AssistantMessageEventStream } from "../utils/event-stream";
-import { escapeHarmonyControlTokens, isHarmonyDialectModel } from "../utils/harmony-leak";
+import {
+	escapeHarmonyControlTokens,
+	escapeHarmonyControlTokensInJson,
+	isHarmonyDialectModel,
+} from "../utils/harmony-leak";
 import type { CapturedHttpErrorResponse } from "../utils/http-inspector";
 import { getOpenRouterHeaders } from "../utils/openrouter-headers";
 import { isForcedToolChoice } from "../utils/tool-choice";
@@ -329,9 +333,7 @@ export function applyOpenAIServiceTier(
 	model: Pick<Model, "provider" | "api" | "id">,
 ): void {
 	if (!shouldSendServiceTier(serviceTier, model)) return;
-	if (serviceTier === "flex" || serviceTier === "scale" || serviceTier === "priority") {
-		params.service_tier = serviceTier;
-	}
+	params.service_tier = serviceTier;
 }
 
 /**
@@ -1636,39 +1638,71 @@ export interface BuildResponsesInputOptions<TApi extends Api> {
 }
 
 /**
- * Escape reserved Harmony control tokens in the client-boundary text of
- * replayed Responses input items — user/developer/system message text and
- * tool-result output. Model-owned items (assistant output, reasoning, tool-call
- * arguments) carry no client data and are returned untouched.
+ * Escape reserved Harmony control tokens in the free-text fields of replayed
+ * Responses input items: user/developer/system text, tool-result output,
+ * assistant message text, and tool-call payloads.
+ *
+ * Tool-call items are covered deliberately. The original #6913 fix skipped
+ * model-owned items on the theory that they carry no client data — but a model
+ * legitimately writing *about* Harmony samples `<|channel|>` etc. into its own
+ * `function_call.arguments`, and a full-transcript replay (stale or blocked
+ * previous_response_id, provider fallback) feeds those bytes back as input,
+ * which gpt-5.x reject with invalid_prompt / "Request blocked", permanently
+ * poisoning the session. `arguments` is a JSON document, so it uses
+ * {@link escapeHarmonyControlTokensInJson} to stay parseable. Reasoning items
+ * are left untouched: `encrypted_content` is opaque and plaintext summaries
+ * are never rendered back into the prompt.
  *
  * Native history replay pushes stored `providerPayload` items straight onto the
  * wire, bypassing {@link convertResponsesInputContent}; without this a stored
  * `input_text` carrying `<|channel|>analysis` still reaches gpt-5.x raw (#6913).
  * Callers gate on {@link isHarmonyDialectModel}. Items are copied, not mutated.
  */
-export function escapeReplayedClientText(items: ResponseInput): ResponseInput {
+export function escapeReplayedControlTokens(items: ResponseInput): ResponseInput {
 	return items.map(item => {
 		if (item.type === "function_call_output" || item.type === "custom_tool_call_output") {
 			return typeof item.output === "string" ? { ...item, output: escapeHarmonyControlTokens(item.output) } : item;
 		}
+		if (item.type === "function_call") {
+			return typeof item.arguments === "string"
+				? { ...item, arguments: escapeHarmonyControlTokensInJson(item.arguments) }
+				: item;
+		}
+		if (item.type === "custom_tool_call") {
+			return typeof item.input === "string" ? { ...item, input: escapeHarmonyControlTokens(item.input) } : item;
+		}
 		// EasyInputMessage may omit `type` (`{ role, content }`); the responses
 		// server persists it verbatim, so treat missing type as a message too.
 		const isTypedMessage = item.type === "message" || item.type === undefined;
-		if (isTypedMessage && "role" in item && "content" in item) {
-			const role = item.role;
-			if (role !== "user" && role !== "developer" && role !== "system") return item;
-			const content = item.content;
-			if (typeof content === "string") {
-				return { ...item, content: escapeHarmonyControlTokens(content) };
-			}
-			if (Array.isArray(content)) {
+		if (!isTypedMessage || !("role" in item) || !("content" in item)) return item;
+		if (item.role === "assistant") {
+			// Assistant output text is model-owned but equally capable of carrying
+			// control tokens as data. `status` discriminates ResponseOutputMessage.
+			if ("status" in item && Array.isArray(item.content)) {
 				return {
 					...item,
-					content: content.map(part =>
-						part.type === "input_text" ? { ...part, text: escapeHarmonyControlTokens(part.text) } : part,
+					content: item.content.map(part =>
+						part.type === "output_text"
+							? { ...part, text: escapeHarmonyControlTokens(part.text) }
+							: part.type === "refusal"
+								? { ...part, refusal: escapeHarmonyControlTokens(part.refusal) }
+								: part,
 					),
 				};
 			}
+			return item;
+		}
+		const content = item.content;
+		if (typeof content === "string") {
+			return { ...item, content: escapeHarmonyControlTokens(content) };
+		}
+		if (Array.isArray(content)) {
+			return {
+				...item,
+				content: content.map(part =>
+					part.type === "input_text" ? { ...part, text: escapeHarmonyControlTokens(part.text) } : part,
+				),
+			};
 		}
 		return item;
 	});
@@ -1733,7 +1767,7 @@ export function buildResponsesInput<TApi extends Api>(options: BuildResponsesInp
 					customToolWireNameMap,
 					options.model.supportsComputerUse === true,
 				);
-				messages.push(...(escapeControlTokens ? escapeReplayedClientText(replayItems) : replayItems));
+				messages.push(...(escapeControlTokens ? escapeReplayedControlTokens(replayItems) : replayItems));
 				knownCallIds = collectKnownCallIds(messages);
 				for (const id of collectCustomCallIds(messages)) customCallIds.add(id);
 				for (const id of collectComputerCallIds(messages)) computerCallIds.add(id);
@@ -1794,10 +1828,16 @@ export function buildResponsesInput<TApi extends Api>(options: BuildResponsesInp
 						)
 					: undefined;
 				if (nativeReplayEnabled && sanitizedHistoryItems) {
+					// Model-owned replay items can carry reserved control-token
+					// spellings as data (the model writing *about* Harmony); escape the
+					// transport copy just like client turns.
+					const wireItems = escapeControlTokens
+						? escapeReplayedControlTokens(sanitizedHistoryItems)
+						: sanitizedHistoryItems;
 					if (providerPayload?.dt) {
-						messages.push(...sanitizedHistoryItems);
+						messages.push(...wireItems);
 					} else {
-						messages.splice(0, messages.length, ...sanitizedHistoryItems);
+						messages.splice(0, messages.length, ...wireItems);
 						customCallIds.clear();
 						computerCallIds.clear();
 					}
@@ -1826,7 +1866,7 @@ export function buildResponsesInput<TApi extends Api>(options: BuildResponsesInp
 				? sanitizeOpenAIResponsesAssistantFallbackItemsForReplay(convertedOutputItems)
 				: convertedOutputItems;
 			if (outputItems.length === 0) continue;
-			messages.push(...outputItems);
+			messages.push(...(escapeControlTokens ? escapeReplayedControlTokens(outputItems) : outputItems));
 		} else if (msg.role === "toolResult") {
 			appendResponsesToolResultMessages(
 				messages,
@@ -2419,6 +2459,26 @@ export function computerCallMetadata(item: ResponseComputerToolCall): ComputerTo
 	};
 }
 
+/** Append a native Responses image result and emit its completion event. */
+export function appendResponsesImageResult(
+	output: AssistantMessage,
+	stream: AssistantMessageEventStream,
+	result: string,
+): void {
+	const image: ImageContent = {
+		type: "image",
+		data: result,
+		mimeType: parseImageMetadata(Buffer.from(result, "base64"))?.mimeType ?? "image/png",
+	};
+	output.content.push(image);
+	stream.push({
+		type: "image_end",
+		contentIndex: output.content.length - 1,
+		content: image,
+		partial: output,
+	});
+}
+
 export async function processResponsesStream<TApi extends Api>(
 	openaiStream: AsyncIterable<ResponseStreamEvent>,
 	output: AssistantMessage,
@@ -2932,18 +2992,7 @@ export async function processResponsesStream<TApi extends Api>(
 				closeOpenItem(event.output_index, item.id, entry, item.call_id, prefixedFunctionCallItemKey(item.call_id));
 				stream.push({ type: "toolcall_end", contentIndex, toolCall, partial: output });
 			} else if (item.type === "image_generation_call" && item.status === "completed" && item.result) {
-				const image: ImageContent = {
-					type: "image",
-					data: item.result,
-					mimeType: parseImageMetadata(Buffer.from(item.result, "base64"))?.mimeType ?? "image/png",
-				};
-				output.content.push(image);
-				stream.push({
-					type: "image_end",
-					contentIndex: output.content.length - 1,
-					content: image,
-					partial: output,
-				});
+				appendResponsesImageResult(output, stream, item.result);
 			}
 		} else if (terminalEvent) {
 			const response = terminalEvent.response;

package/src/providers/transform-messages.ts

@@ -300,7 +300,7 @@ function normalizeAnthropicTargetToolCallId<TApi extends Api>(
  * credential redaction is enabled. Exported so hosts can route the same shapes
  * through reversible obfuscation (keyed placeholders restored before local tool
  * execution) instead of the irreversible `[*_token_redacted]` rewrite below —
- * an irreversible placeholder echoed back in edit-tool `old_text` can never
+ * an irreversible placeholder echoed back in edit-tool `old_string` can never
  * match the real bytes on disk.
  */
 export const SENSITIVE_TOKEN_RE =

package/src/registry/amazon-bedrock.ts

@@ -1,22 +1,17 @@
-import { $env } from "@oh-my-pi/pi-utils";
+import { type AwsBedrockProviderOptions, resolveAwsRegistryApiKey } from "./aws";
 import type { ProviderDefinition } from "./types";
 
 export const amazonBedrockProvider = {
 	id: "amazon-bedrock",
 	name: "Amazon Bedrock",
 	// Amazon Bedrock accepts bearer tokens, IAM keys, profiles, ECS/IRSA credential chains.
-	envKeys: () => {
-		const hasEcsCredentials =
-			!!$env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || !!$env.AWS_CONTAINER_CREDENTIALS_FULL_URI;
-		const hasWebIdentity = !!$env.AWS_WEB_IDENTITY_TOKEN_FILE && !!$env.AWS_ROLE_ARN;
-		if (
-			$env.AWS_PROFILE ||
-			($env.AWS_ACCESS_KEY_ID && $env.AWS_SECRET_ACCESS_KEY) ||
-			$env.AWS_BEARER_TOKEN_BEDROCK ||
-			hasEcsCredentials ||
-			hasWebIdentity
-		) {
-			return "<authenticated>";
-		}
+	envKeys: resolveAwsRegistryApiKey,
+	mapSimpleOptions: options => {
+		const awsOptions = options.providerOptions as AwsBedrockProviderOptions | undefined;
+		return {
+			region: awsOptions?.region,
+			profile: awsOptions?.profile,
+			bearerToken: awsOptions?.bearerToken,
+		};
 	},
 } as const satisfies ProviderDefinition;

package/src/registry/aws.ts

@@ -0,0 +1,57 @@
+import * as fs from "node:fs";
+import { $env } from "@oh-my-pi/pi-utils";
+import { hasConfiguredAwsProfile } from "../utils/aws-profile";
+import { AUTHENTICATED_SENTINEL } from "./types";
+
+export interface AwsBedrockProviderOptions extends Readonly<Record<string, unknown>> {
+	/** AWS region used in the service endpoint and SigV4 credential scope. */
+	region?: string;
+	/** Named AWS shared-credentials/config profile. */
+	profile?: string;
+	/** Amazon Bedrock API key sent as a bearer token, ahead of SigV4 credential resolution. */
+	bearerToken?: string;
+}
+
+function isEc2Host(): boolean {
+	for (const candidate of [
+		"/sys/hypervisor/uuid",
+		"/sys/devices/virtual/dmi/id/product_uuid",
+		"/sys/devices/virtual/dmi/id/board_asset_tag",
+	]) {
+		try {
+			const value = fs.readFileSync(candidate, "utf8").trim().toLowerCase();
+			if (value.startsWith("ec2")) return true;
+		} catch {
+			// Missing/unreadable DMI metadata means this probe is inconclusive.
+		}
+	}
+	return false;
+}
+
+export function hasAwsCredentialSource(): boolean {
+	const hasEcsCredentials = !!$env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || !!$env.AWS_CONTAINER_CREDENTIALS_FULL_URI;
+	const hasWebIdentity = !!$env.AWS_WEB_IDENTITY_TOKEN_FILE && !!$env.AWS_ROLE_ARN;
+	const hasProfile = hasConfiguredAwsProfile();
+	const hasInstanceRole =
+		$env.AWS_EC2_METADATA_DISABLED?.toLowerCase() !== "true" &&
+		(!!$env.AWS_EC2_METADATA_SERVICE_ENDPOINT || isEc2Host());
+	return !!(
+		($env.AWS_ACCESS_KEY_ID && $env.AWS_SECRET_ACCESS_KEY) ||
+		$env.AWS_BEARER_TOKEN_BEDROCK ||
+		hasWebIdentity ||
+		hasProfile ||
+		hasEcsCredentials ||
+		hasInstanceRole
+	);
+}
+
+/** Registry key marker for AWS transports that resolve their own bearer/IAM credentials. */
+export function resolveAwsRegistryApiKey(): string | undefined {
+	return hasAwsCredentialSource() ? AUTHENTICATED_SENTINEL : undefined;
+}
+
+/** Resolve a real AWS bearer token while filtering the registry's auth marker. */
+export function resolveAwsBearerToken(apiKey?: string, bearerToken?: string): string | undefined {
+	const resolvedApiKey = apiKey === AUTHENTICATED_SENTINEL ? undefined : apiKey;
+	return bearerToken || resolvedApiKey || $env.AWS_BEARER_TOKEN_BEDROCK;
+}

package/src/registry/bedrock-mantle.ts

@@ -0,0 +1,34 @@
+import {
+	type BedrockMantleOptions,
+	createBedrockMantleAuthenticatedFetch,
+	prepareBedrockMantleRequest,
+} from "../providers/bedrock-mantle";
+import type { Model } from "../types";
+import { resolveAwsRegion } from "../utils/aws-profile";
+import { resolveAwsBearerToken, resolveAwsRegistryApiKey } from "./aws";
+import type { ProviderDefinition } from "./types";
+
+export const bedrockMantleProvider = {
+	id: "bedrock-mantle",
+	name: "Amazon Bedrock Mantle",
+	envKeys: resolveAwsRegistryApiKey,
+	allowsMissingApiKey: true,
+	prepareRequest: (model, options) =>
+		prepareBedrockMantleRequest(model as Model<"openai-responses">, options as BedrockMantleOptions),
+	mapSimpleOptions: options => ({ providerOptions: options.providerOptions }),
+	prepareModelDiscovery: config => {
+		const bearerToken = resolveAwsBearerToken(config.apiKey);
+		if (!bearerToken) {
+			return { ...config, apiKey: undefined, authenticated: false };
+		}
+		const region = resolveAwsRegion();
+		return {
+			authenticated: true,
+			baseUrl: `https://bedrock-mantle.${encodeURIComponent(region)}.api.aws/openai/v1`,
+			fetch: createBedrockMantleAuthenticatedFetch({
+				fetch: config.fetch,
+				providerOptions: { bearerToken, region },
+			}),
+		};
+	},
+} as const satisfies ProviderDefinition;

package/src/registry/google-vertex.ts

@@ -2,7 +2,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { $env } from "@oh-my-pi/pi-utils";
-import type { ProviderDefinition } from "./types";
+import { AUTHENTICATED_SENTINEL, type ProviderDefinition } from "./types";
 
 let cachedVertexAdcCredentialsExists: boolean | null = null;
 
@@ -32,7 +32,7 @@ export const googleVertexProvider = {
 		const hasProject = !!($env.GOOGLE_CLOUD_PROJECT || $env.GCP_PROJECT || $env.GCLOUD_PROJECT);
 		const hasLocation = !!($env.GOOGLE_VERTEX_LOCATION || $env.GOOGLE_CLOUD_LOCATION || $env.VERTEX_LOCATION);
 		if (hasCredentials && hasProject && hasLocation) {
-			return "<authenticated>";
+			return AUTHENTICATED_SENTINEL;
 		}
 	},
 } as const satisfies ProviderDefinition;

package/src/registry/registry.ts

@@ -7,6 +7,7 @@ import { amazonBedrockProvider } from "./amazon-bedrock";
 import { anthropicProvider } from "./anthropic";
 import { azureProvider } from "./azure";
 import { basetenProvider } from "./baseten";
+import { bedrockMantleProvider } from "./bedrock-mantle";
 import { cerebrasProvider } from "./cerebras";
 import { cloudflareAiGatewayProvider } from "./cloudflare-ai-gateway";
 import { coreWeaveProvider } from "./coreweave";
@@ -157,6 +158,7 @@ const ALL = [
 	mistralProvider,
 	minimaxProvider,
 	amazonBedrockProvider,
+	bedrockMantleProvider,
 	gmiCloudProvider,
 ];
 

package/src/registry/types.ts

@@ -9,6 +9,8 @@
  * (default model, model-manager factory, catalog discovery) lives in
  * `@oh-my-pi/pi-catalog`'s descriptor table.
  */
+
+import type { Api, FetchImpl, Model, SimpleStreamOptions, StreamOptions } from "../types";
 import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
 
 /**
@@ -18,6 +20,26 @@ import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
  */
 export type KeyResolver = string | (() => string | undefined);
 
+/** Credentials are resolved by the provider transport rather than used as a bearer string. */
+export const AUTHENTICATED_SENTINEL = "<authenticated>";
+
+export interface PreparedProviderRequest {
+	readonly model: Model<Api>;
+	readonly options: StreamOptions;
+}
+
+export type ProviderRequestPreparer = (model: Model<Api>, options: StreamOptions) => PreparedProviderRequest;
+export type ProviderSimpleOptionsMapper = (options: SimpleStreamOptions) => Readonly<Record<string, unknown>>;
+
+export interface ProviderModelDiscoveryConfig {
+	readonly apiKey?: string;
+	readonly baseUrl?: string;
+	readonly fetch?: FetchImpl;
+	readonly authenticated?: boolean;
+}
+
+export type ProviderModelDiscoveryPreparer = (config: ProviderModelDiscoveryConfig) => ProviderModelDiscoveryConfig;
+
 /**
  * Declarative description of a single provider's auth/login wiring. All
  * fields are optional except `id`/`name`; presence of a field opts the
@@ -42,6 +64,14 @@ export interface ProviderDefinition {
 	readonly showInLoginList?: boolean;
 	// --- env-var fallback (the catalog table's `envVars` supplies plain names; set this only for computed resolvers) ---
 	readonly envKeys?: KeyResolver;
+	/** Provider transport can authenticate without a resolved API-key string. */
+	readonly allowsMissingApiKey?: boolean;
+	/** Provider-owned request shaping applied before generic API dispatch. */
+	readonly prepareRequest?: ProviderRequestPreparer;
+	/** Provider-owned projection from the generic simple-stream option bag. */
+	readonly mapSimpleOptions?: ProviderSimpleOptionsMapper;
+	/** Provider-owned authentication and endpoint setup for model discovery. */
+	readonly prepareModelDiscovery?: ProviderModelDiscoveryPreparer;
 	// --- interactive login (OAuthProviderInterface-compatible) ---
 	readonly login?: (callbacks: OAuthLoginCallbacks) => Promise<OAuthCredentials | string>;
 	readonly refreshToken?: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;