@oh-my-pi/pi-ai 17.2.4 → 17.2.6

package/src/stream.ts

@@ -60,7 +60,7 @@ import {
 	streamOpenAIResponses,
 } from "./providers/register-builtins";
 import { isSyntheticModel, streamSynthetic } from "./providers/synthetic";
-import { PROVIDER_REGISTRY } from "./registry";
+import { getProviderDefinition, PROVIDER_REGISTRY } from "./registry";
 import type {
 	Api,
 	AssistantMessage,
@@ -812,33 +812,37 @@ function streamDispatch<TApi extends Api>(
 		} as GitLabDuoWorkflowOptions);
 	}
 
-	// Vertex AI uses Application Default Credentials, not API keys
+	// Vertex AI and Bedrock Converse authenticate outside the generic API-key path.
 	if (model.api === "google-vertex") {
 		return streamGoogleVertex(model as Model<"google-vertex">, context, requestOptions as GoogleVertexOptions);
-	} else if (model.api === "bedrock-converse-stream") {
-		// Bedrock doesn't have any API keys instead it sources credentials from standard AWS env variables or from given AWS profile.
+	}
+	if (model.api === "bedrock-converse-stream") {
 		return streamBedrock(model as Model<"bedrock-converse-stream">, context, requestOptions as BedrockOptions);
 	}
 
-	const apiKey = requestOptions.apiKey || getEnvApiKey(model.provider);
+	const prepareRequest = getProviderDefinition(model.provider)?.prepareRequest;
+	const prepared = prepareRequest?.(model as Model<Api>, requestOptions as StreamOptions);
+	const providerModel = prepared?.model ?? (model as Model<Api>);
+	const preparedOptions = prepared?.options ?? (requestOptions as StreamOptions);
+	const apiKey = preparedOptions.apiKey || getEnvApiKey(providerModel.provider);
 	if (!apiKey) {
-		throw new AIError.MissingApiKeyError(model.provider);
+		throw new AIError.MissingApiKeyError(providerModel.provider);
 	}
-	const providerOptions = isGoogleVertexAuthenticatedModel(model)
+	const providerOptions = isGoogleVertexAuthenticatedModel(providerModel)
 		? {
-				...requestOptions,
+				...preparedOptions,
 				apiKey: "vertex-adc",
-				fetch: createVertexAuthenticatedFetch(requestOptions),
+				fetch: createVertexAuthenticatedFetch(preparedOptions),
 			}
-		: { ...requestOptions, apiKey };
+		: { ...preparedOptions, apiKey };
 
-	const api: Api = model.api;
+	const api: Api = providerModel.api;
 	switch (api) {
 		case "anthropic-messages": {
 			const anthropicOptions = providerOptions as AnthropicOptions;
-			return streamAnthropic(model as Model<"anthropic-messages">, context, {
+			return streamAnthropic(providerModel as Model<"anthropic-messages">, context, {
 				...anthropicOptions,
-				isOAuth: anthropicOptions.isOAuth ?? model.isOAuth,
+				isOAuth: anthropicOptions.isOAuth ?? providerModel.isOAuth,
 			});
 		}
 
@@ -846,13 +850,13 @@ function streamDispatch<TApi extends Api>(
 			const useResponses = $env.PI_OPENROUTER_RESPONSES !== "0";
 			if (useResponses) {
 				return streamOpenAIResponses(
-					model as Model<"openai-responses">,
+					providerModel as Model<"openai-responses">,
 					context,
 					providerOptions as OptionsForApi<"openai-responses">,
 				);
 			}
 			return streamOpenAICompletions(
-				model as Model<"openai-completions">,
+				providerModel as Model<"openai-completions">,
 				context,
 				providerOptions as OptionsForApi<"openai-completions">,
 			);
@@ -860,50 +864,50 @@ function streamDispatch<TApi extends Api>(
 
 		case "openai-completions":
 			return streamOpenAICompletions(
-				model as Model<"openai-completions">,
+				providerModel as Model<"openai-completions">,
 				context,
 				providerOptions as OptionsForApi<"openai-completions">,
 			);
 
 		case "openai-responses":
 			return streamOpenAIResponses(
-				model as Model<"openai-responses">,
+				providerModel as Model<"openai-responses">,
 				context,
 				providerOptions as OptionsForApi<"openai-responses">,
 			);
 
 		case "azure-openai-responses":
 			return streamAzureOpenAIResponses(
-				model as Model<"azure-openai-responses">,
+				providerModel as Model<"azure-openai-responses">,
 				context,
 				providerOptions as OptionsForApi<"azure-openai-responses">,
 			);
 
 		case "openai-codex-responses":
 			return streamOpenAICodexResponses(
-				model as Model<"openai-codex-responses">,
+				providerModel as Model<"openai-codex-responses">,
 				context,
 				providerOptions as OptionsForApi<"openai-codex-responses">,
 			);
 
 		case "google-generative-ai":
-			return streamGoogle(model as Model<"google-generative-ai">, context, providerOptions);
+			return streamGoogle(providerModel as Model<"google-generative-ai">, context, providerOptions);
 
 		case "google-gemini-cli":
 			return streamGoogleGeminiCli(
-				model as Model<"google-gemini-cli">,
+				providerModel as Model<"google-gemini-cli">,
 				context,
 				providerOptions as GoogleGeminiCliOptions,
 			);
 
 		case "ollama-chat":
-			return streamOllama(model as Model<"ollama-chat">, context, providerOptions as OllamaChatOptions);
+			return streamOllama(providerModel as Model<"ollama-chat">, context, providerOptions as OllamaChatOptions);
 
 		case "cursor-agent":
-			return streamCursor(model as Model<"cursor-agent">, context, providerOptions as CursorOptions);
+			return streamCursor(providerModel as Model<"cursor-agent">, context, providerOptions as CursorOptions);
 
 		case "devin-agent":
-			return streamDevin(model as Model<"devin-agent">, context, providerOptions as DevinOptions);
+			return streamDevin(providerModel as Model<"devin-agent">, context, providerOptions as DevinOptions);
 
 		default:
 			throw new AIError.ConfigurationError(`Unhandled API: ${api}`);
@@ -1028,12 +1032,10 @@ export function streamSimple<TApi extends Api>(
 	if (apiKeyResolver) {
 		const outer = new AssistantMessageEventStream();
 		const signal = requestOptions?.signal;
-		// One inner attempt against a resolved string key. A retryable auth error
-		// that arrives before any replay-unsafe event is buffered and returned
-		// (so the caller can retry with a fresh key) instead of surfaced. Once any
-		// non-start event escapes, retry is no longer safe and the failure is
-		// emitted directly.
-		const runAttempt = async (apiKey: string): Promise<AuthRetryFailure | undefined> => {
+		// One inner attempt against a resolved key, or against the Bedrock AWS
+		// credential chain when its optional resolver has no stored bearer key.
+		// Retryable auth failures are buffered until replay is safe.
+		const runAttempt = async (apiKey?: string): Promise<AuthRetryFailure | undefined> => {
 			const bufferedEvents: AssistantMessageEvent[] = [];
 			let emittedReplayUnsafeEvent = false;
 			const flushBuffered = (): void => {
@@ -1107,6 +1109,11 @@ export function streamSimple<TApi extends Api>(
 				return;
 			}
 			if (lastKey === undefined) {
+				if (getProviderDefinition(model.provider)?.allowsMissingApiKey) {
+					const failure = await runAttempt();
+					if (failure) emitFailure(failure);
+					return;
+				}
 				outer.fail(new AIError.MissingApiKeyError(model.provider));
 				return;
 			}
@@ -1156,6 +1163,13 @@ export function streamSimple<TApi extends Api>(
 		// Bedrock doesn't have any API keys instead it sources credentials from standard AWS env variables or from given AWS profile.
 		const providerOptions = mapOptionsForApi(model, requestOptions, undefined);
 		return stream(model, context, providerOptions);
+	} else if (getProviderDefinition(model.provider)?.allowsMissingApiKey) {
+		const providerOptions = mapOptionsForApi(
+			model,
+			requestOptions,
+			typeof requestOptions.apiKey === "string" ? requestOptions.apiKey : getEnvApiKey(model.provider),
+		);
+		return stream(model, context, providerOptions);
 	}
 
 	// The resolver form is handled by the wrapper above; only a static string
@@ -1454,6 +1468,7 @@ function mapOptionsForApi<TApi extends Api>(
 	apiKey?: string,
 ): OptionsForApi<TApi> {
 	const options = normalizeMandatoryReasoningOptions(model, rawOptions);
+	const simpleProviderOptions = getProviderDefinition(model.provider)?.mapSimpleOptions?.(options ?? {});
 	const base = {
 		temperature: options?.temperature,
 		topP: options?.topP,
@@ -1483,6 +1498,7 @@ function mapOptionsForApi<TApi extends Api>(
 		execHandlers: options?.execHandlers,
 		fetch: options?.fetch,
 		fallbacks: options?.fallbacks,
+		...simpleProviderOptions,
 	};
 
 	switch (model.api) {

package/src/types.ts

@@ -214,10 +214,10 @@ export function resolveModelServiceTier(
 
 /**
  * True when the tier should be sent on the wire as the provider's service-tier
- * request field. OpenAI / OpenAI-Codex accept `flex`/`scale`/`priority`; Google
- * (Gemini API + Vertex) and OpenRouter accept `flex`/`priority`; Fireworks
- * Serverless realizes only its Priority serving path. Anthropic is absent — it
- * realizes `priority` via `speed: "fast"`, not a service-tier field.
+ * request field. OpenAI / OpenAI-Codex accept every {@link ServiceTier};
+ * Google (Gemini API + Vertex) and OpenRouter accept `flex`/`priority`;
+ * Fireworks Serverless realizes only its Priority serving path. Anthropic is
+ * absent because it realizes `priority` via `speed: "fast"`.
  */
 export function shouldSendServiceTier(
 	serviceTier: ServiceTier | null | undefined,
@@ -225,12 +225,11 @@ export function shouldSendServiceTier(
 ): boolean {
 	if (!serviceTier) return false;
 	const provider = typeof target === "string" ? target : target?.provider;
-	if (provider === "openai" || provider === "openai-codex" || provider === "openrouter") {
-		return serviceTier === "flex" || serviceTier === "scale" || serviceTier === "priority";
-	}
-	if (typeof target !== "string" && target && isOpenAIServiceTierModel(target)) {
+	if (provider === "openai" || provider === "openai-codex") return true;
+	if (provider === "openrouter") {
 		return serviceTier === "flex" || serviceTier === "scale" || serviceTier === "priority";
 	}
+	if (typeof target !== "string" && target && isOpenAIServiceTierModel(target)) return true;
 	if (provider === "google") {
 		return serviceTier === "flex" || serviceTier === "priority";
 	}
@@ -434,6 +433,11 @@ export interface StreamOptions {
 	 * For example, Anthropic uses `user_id` for abuse tracking and rate limiting.
 	 */
 	metadata?: Record<string, unknown>;
+	/**
+	 * Provider-owned request configuration. Provider hooks interpret this bag;
+	 * generic API transports do not forward its fields onto the wire.
+	 */
+	providerOptions?: Readonly<Record<string, unknown>>;
 	/** OpenAI Responses/Codex response fields to include verbatim. */
 	include?: OpenAIResponseInclude[];
 	/**
@@ -844,6 +848,8 @@ export interface AssistantRetryRecovery {
 export interface ContextSnapshot {
 	promptTokens: number; // authoritative provider prompt/input tokens
 	nonMessageTokens: number; // estimated non-message total at send time
+	/** Estimated prompt tokens removed by local history rewrites after this provider snapshot was recorded. */
+	historyRewriteTokensRemoved?: number;
 	lastMessageTimestamp?: number;
 }
 

package/src/utils/aws-profile.ts

@@ -0,0 +1,88 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { $env } from "@oh-my-pi/pi-utils";
+
+/** INI sections with `profile ` / `sso-session ` prefixes normalized. */
+export type AwsIniFile = Record<string, Record<string, string>>;
+
+export function parseAwsIni(text: string): AwsIniFile {
+	const out: AwsIniFile = {};
+	let current: Record<string, string> | null = null;
+	for (const rawLine of text.split(/\r?\n/)) {
+		const line = rawLine.trim();
+		if (!line || line.startsWith("#") || line.startsWith(";")) continue;
+		if (line.startsWith("[") && line.endsWith("]")) {
+			let name = line.slice(1, -1).trim();
+			if (name.startsWith("profile ")) name = name.slice(8).trim();
+			if (name.startsWith("sso-session ")) name = `sso-session:${name.slice(12).trim()}`;
+			let section = out[name];
+			if (!section) {
+				section = {};
+				out[name] = section;
+			}
+			current = section;
+			continue;
+		}
+		if (!current) continue;
+		const eq = line.indexOf("=");
+		if (eq === -1) continue;
+		current[line.slice(0, eq).trim()] = line.slice(eq + 1).trim();
+	}
+	return out;
+}
+
+function readAwsIniSync(filePath: string): AwsIniFile | undefined {
+	try {
+		return parseAwsIni(fs.readFileSync(filePath, "utf8"));
+	} catch {
+		return undefined;
+	}
+}
+
+/** Resolve the selected shared-credentials profile. */
+export function resolveAwsProfile(profile?: string): string {
+	return profile || $env.AWS_PROFILE || "default";
+}
+
+/**
+ * Whether the shared config file participates in profile/region resolution.
+ * Explicit profile selection enables it; the implicit default profile follows
+ * the AWS SDK's `AWS_SDK_LOAD_CONFIG` opt-in.
+ */
+export function shouldLoadAwsSharedConfig(profile?: string): boolean {
+	if (profile || $env.AWS_PROFILE) return true;
+	const value = $env.AWS_SDK_LOAD_CONFIG?.toLowerCase();
+	return value === "1" || value === "true";
+}
+
+export function resolveAwsProfileRegion(profile?: string): string | undefined {
+	if (!shouldLoadAwsSharedConfig(profile)) return undefined;
+	const configPath = $env.AWS_CONFIG_FILE || path.join(os.homedir(), ".aws", "config");
+	return readAwsIniSync(configPath)?.[resolveAwsProfile(profile)]?.region;
+}
+
+/** Region selected by the environment or active shared-config profile. */
+export function resolveAwsAmbientRegion(profile?: string): string | undefined {
+	return $env.AWS_REGION || $env.AWS_DEFAULT_REGION || resolveAwsProfileRegion(profile);
+}
+
+/** Resolve the region precedence shared by AWS transports and credential exchanges. */
+export function resolveAwsRegion(explicitRegion?: string, profile?: string): string {
+	return explicitRegion || resolveAwsAmbientRegion(profile) || "us-east-1";
+}
+
+export function hasConfiguredAwsProfile(profile?: string): boolean {
+	const selectedProfile = resolveAwsProfile(profile);
+	const credentialsPath = $env.AWS_SHARED_CREDENTIALS_FILE || path.join(os.homedir(), ".aws", "credentials");
+	const configPath = $env.AWS_CONFIG_FILE || path.join(os.homedir(), ".aws", "config");
+	const credentialsIni = readAwsIniSync(credentialsPath);
+	const configIni = shouldLoadAwsSharedConfig(profile) ? readAwsIniSync(configPath) : undefined;
+	const merged = { ...(configIni?.[selectedProfile] ?? {}), ...(credentialsIni?.[selectedProfile] ?? {}) };
+	if (merged.aws_access_key_id && merged.aws_secret_access_key) return true;
+	if (merged.credential_process) return true;
+	if (!merged.sso_account_id || !merged.sso_role_name) return false;
+	if (merged.sso_start_url && merged.sso_region) return true;
+	const session = merged.sso_session ? configIni?.[`sso-session:${merged.sso_session}`] : undefined;
+	return !!(session?.sso_start_url && session.sso_region);
+}

package/src/utils/harmony-leak.ts

@@ -35,6 +35,18 @@ export function escapeHarmonyControlTokens(text: string): string {
 	return text.replace(HARMONY_CONTROL_TOKEN_ESCAPE_RE, "<\\|$1\\|>");
 }
 
+/**
+ * Escape reserved Harmony control tokens inside a JSON document string (e.g.
+ * `function_call.arguments`). Doubles the backslash so the document remains
+ * valid JSON whose *decoded* strings carry the inert `<\|token\|>` spelling.
+ * `<|` cannot occur outside a string literal in valid JSON, so the blanket
+ * replace never corrupts structure; malformed documents are escaped
+ * best-effort.
+ */
+export function escapeHarmonyControlTokensInJson(text: string): string {
+	return text.replace(HARMONY_CONTROL_TOKEN_ESCAPE_RE, "<\\\\|$1\\\\|>");
+}
+
 /**
  * Whether requests to `model` are served by a Harmony-dialect backend
  * (gpt-5.x / gpt-oss), which rejects reserved control-token spellings appearing

package/src/utils/schema/typescript.ts

@@ -12,15 +12,22 @@
 import { isJsonObject } from "./types";
 
 export interface JsonSchemaToTsOptions {
-	/** Indentation unit for nested object bodies. Default two spaces. */
+	/** Indentation unit for nested object bodies. Default two spaces (none in `harmony` style). */
 	readonly indent?: string;
-	/** Emit `description` keywords as JSDoc comments on object properties. Default true. */
+	/** Emit `description` keywords as comments on object properties. Default true. */
 	readonly comments?: boolean;
+	/**
+	 * Output flavor. `default` renders JSDoc comments, `;` delimiters, and
+	 * indented bodies; `harmony` renders the flat OpenAI-Harmony convention —
+	 * `//` line comments, `,` delimiters, no indentation.
+	 */
+	readonly style?: "default" | "harmony";
 }
 
 interface Ctx {
 	readonly indent: string;
 	readonly comments: boolean;
+	readonly harmony: boolean;
 	readonly defs: Record<string, unknown> | undefined;
 	readonly seen: Set<unknown>;
 }
@@ -48,7 +55,11 @@ function joinUnion(parts: readonly string[]): string {
 	return unique.length > 0 ? unique.join(" | ") : "never";
 }
 
-function emitJsDoc(lines: string[], description: string, pad: string): void {
+function emitDescription(lines: string[], description: string, ctx: Ctx, pad: string): void {
+	if (ctx.harmony) {
+		for (const line of description.split("\n")) lines.push(`${pad}// ${line}`.trimEnd());
+		return;
+	}
 	// `* /` keeps a stray closing token inside the description from ending the comment.
 	const safe = description.replace(/\*\//g, "* /");
 	if (!safe.includes("\n")) {
@@ -85,6 +96,7 @@ function convertObject(node: Record<string, unknown>, ctx: Ctx, pad: string): st
 		const required = new Set(
 			Array.isArray(node.required) ? node.required.filter((key): key is string => typeof key === "string") : [],
 		);
+		const delimiter = ctx.harmony ? "," : ";";
 		for (const key in properties) {
 			const value = properties[key];
 			if (
@@ -93,11 +105,11 @@ function convertObject(node: Record<string, unknown>, ctx: Ctx, pad: string): st
 				typeof value.description === "string" &&
 				value.description.length > 0
 			) {
-				emitJsDoc(body, value.description, childPad);
+				emitDescription(body, value.description, ctx, childPad);
 			}
 			const optional = required.has(key) ? "" : "?";
 			const name = SAFE_KEY.test(key) ? key : JSON.stringify(key);
-			body.push(`${childPad}${name}${optional}: ${convert(value, ctx, childPad)};`);
+			body.push(`${childPad}${name}${optional}: ${convert(value, ctx, childPad)}${delimiter}`);
 		}
 	}
 
@@ -110,7 +122,7 @@ function convertObject(node: Record<string, unknown>, ctx: Ctx, pad: string): st
 
 	// Named properties alongside a free-form value schema → index signature.
 	if (isJsonObject(additional)) {
-		body.push(`${childPad}[key: string]: ${convert(additional, ctx, childPad)};`);
+		body.push(`${childPad}[key: string]: ${convert(additional, ctx, childPad)}${ctx.harmony ? "," : ";"}`);
 	}
 	return `{\n${body.join("\n")}\n${pad}}`;
 }
@@ -188,9 +200,11 @@ export function jsonSchemaToTypeScript(schema: unknown, options?: JsonSchemaToTs
 			}
 		}
 	}
+	const harmony = options?.style === "harmony";
 	const ctx: Ctx = {
-		indent: options?.indent ?? "  ",
+		indent: options?.indent ?? (harmony ? "" : "  "),
 		comments: options?.comments ?? true,
+		harmony,
 		defs,
 		seen: new Set(),
 	};

package/src/utils.ts

@@ -403,7 +403,7 @@ function sanitizeOpenAIResponsesReasoningItemForReplay(
 function sanitizeOpenAIResponsesImageGenerationCallForReplay(
 	item: Record<string, unknown>,
 ): ResponseInputItem.ImageGenerationCall | undefined {
-	if (typeof item.id !== "string" || item.status !== "completed" || typeof item.result !== "string") {
+	if (typeof item.id !== "string" || typeof item.result !== "string" || item.result.length === 0) {
 		return undefined;
 	}
 	return {