@oh-my-pi/pi-ai 17.3.7 → 17.3.8

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [17.3.8] - 2026-08-19
+
+### Changed
+
+- Fixed Gemini thought summaries occasionally leaking a raw `` ```thinking `` / `` ``````thinking `` fence delimiter into the reasoning block, so it no longer shows up as fence spam in the thinking display or persisted transcripts ([#8719](https://github.com/can1357/oh-my-pi/issues/8719)).
+- Fixed the OpenCode Go login prompting for an "OpenCode Zen API key": the shared login flow now names the provider you selected, so connecting OpenCode Go asks for an OpenCode Go key (the `opencode.ai/auth` console is still shared, as documented upstream) ([#8738](https://github.com/can1357/oh-my-pi/issues/8738)).
+- Fixed Anthropic-compatible endpoints with strict prompt validation (e.g. Z.AI GLM `api.z.ai/api/anthropic`, which rejects the whole request with `400 code 1213 "The prompt parameter was not received normally"`) failing sessions once a tool returned empty output on a vision-capable model: empty successful `tool_result` blocks now encode as `content: ""` instead of `content: []`, which both the official API and strict compatible endpoints accept.
+- Fixed `retry.usageReservePct` (Reserve Margin) ignoring Claude Fable/Mythos weekly tier usage until it hit 100%, so a Fable model kept serving turns past the configured reserve; reserve health now honors the mapped tier row while credential-wide hard blocks still require confirmed exhaustion ([#8773](https://github.com/can1357/oh-my-pi/issues/8773)).
+- Fixed `cursor-agent` streams stalling with "Provider stream stalled while waiting for the next event" when Cursor asked the client to approve a hosted WebFetch / web search (reproduced on `cursor-grok-4.6-xhigh` after "I'll fetch the page…"). Those `interaction_query` frames — including the newer WebFetch field 9 this proto did not name — were dropped, so the server waited forever and the idle watchdog aborted a live connection. Permission queries are now answered; hosted search/fetch is approved, unnamed permission fields get an `approved` reply on the same field number, and prompts this client cannot serve are rejected so the turn can continue.
+
+### Fixed
+
+- Fixed thinking effort selections being ignored for local Qwen 3.8+ models on llama.cpp and vLLM: the Qwen chat-completions dialects only toggled `enable_thinking`, so the chat template always reasoned at its `xhigh` default no matter which level was selected. The encoder now routes the requested effort onto the template's `reasoning_effort` kwarg (`chat_template_kwargs` for both Qwen dialects, plus the top-level field newer llama.cpp builds map natively).
+- Fixed OpenAI Completions, Amazon Bedrock, and Cursor providers ignoring `onPayload` replacement payloads. The hook now transforms the actual request body sent upstream on these providers, matching the Anthropic/Gemini/OpenAI Responses replacement contract. `devin-agent` still does not fire the hook (its payload is a protobuf object).
+- Fixed Codex requests failing outright when the signed-in ChatGPT account is not entitled to the requested model; the exact model denial is now classified as an account-policy error so credential rotation can reach an entitled sibling account
+- Fixed Perplexity email-OTP login after its verification response renamed the encrypted session token from `token` to `challenge_token`.
+- Cloud Code Assist Gemini 3.6/3.7 Flash requests at `minimal` now send `thinkingLevel: LOW` on the aliased `-low` SKU instead of `MINIMAL`, which the API rejects with HTTP 400.
+- Answer Cursor `interaction_query` permission gates (hosted web search, Exa, unnamed field-9 WebFetch) so the Run RPC continues instead of sitting silent until the 300s idle watchdog.
+- Fixed provider tool calls arriving with flattened array argument paths (e.g. Gemini's `questions[0].id`) being stripped and rejected by argument validation; well-formed flattened paths are now rebuilt into the nested arrays the tool schema expects ([#8886](https://github.com/can1357/oh-my-pi/issues/8886)).
+- Fixed opencode-go (Console Go) rejecting Responses turns with `400 No tool output found for tool call …` (naming a random call of the batch on each retry) when a model streamed a trailing text/thinking block after its tool calls: `buildResponsesInput` emitted that block as an assistant `message` item wedged between the `function_call` batch and its `function_call_output` items. Such interleaved messages are now hoisted ahead of their call batch (canonical `message(s) → calls → outputs`), which the strict gateway validator accepts; content is unchanged ([#8789](https://github.com/can1357/oh-my-pi/issues/8789)).
+- Fixed the OpenAI-wire transport sleeping on a LiteLLM concurrency-admission 429 (`rate_limit_type: max_parallel_requests`, `Retry-After: 60`) and retrying it up to 6 times (~300s) before session recovery saw the error. Because a 60s hint equals the transport's `maxDelayMs` cap, `fetchWithRetry` kept sleeping and retrying; the request now surfaces on the first attempt so `TurnRecovery`'s concurrency backoff/model fallback runs promptly. Genuine RPM/quota 429s (no such marker) still honor `Retry-After` ([#8854](https://github.com/can1357/oh-my-pi/issues/8854)).
+- Fixed OAuth login (Codex `localhost:1455`, and any `localhost` callback flow) failing on hosts with IPv6 disabled at the kernel (`ipv6.disable=1`). The `::1` companion listener added in #8081 fails there with Bun's generic "Is port X in use?" message (oven-sh/bun#7187), which the in-use check misread as a real collision — tearing down the healthy IPv4 listener and surfacing a bogus "port 1455 is in use" error. The dual-bind path now detects the missing IPv6 loopback up front and serves IPv4 alone ([#8814](https://github.com/can1357/oh-my-pi/issues/8814)).
+
 ## [17.3.7] - 2026-08-17
 
 ### Changed

package/README.md

@@ -634,7 +634,7 @@ All providers accept the base `StreamOptions` (in addition to provider-specific
 - `headers`: Extra request headers merged on top of model-defined headers
 - `sessionId`: Provider-specific session identifier (prompt caching/routing)
 - `signal`: Abort in-flight requests
-- `onPayload`: Callback invoked with the provider request payload just before sending
+- `onPayload`: Callback invoked with the provider request payload just before sending. Return a replacement payload object (sync or async) to send it instead of the original; return `undefined` to keep the original. The replacement is applied by every provider that fires the hook — all of them except `devin-agent`, whose payload is a protobuf object and does not fire the hook yet.
 
 Example:
 

package/dist/types/auth/sqlite-credential-store.d.ts

@@ -5,6 +5,7 @@
  * and remote stores share the same contract.
  */
 import { Database } from "bun:sqlite";
+import { isSqliteBusyError, isSqliteCorruptionError } from "@oh-my-pi/pi-utils";
 import type { AuthCredential, AuthCredentialStore, CredentialRefreshLeaseFence, DisabledCredentialSummary, StoredAuthCredential, StoredCredentialBlock } from "../auth-storage.js";
 import type { OAuthCredentials } from "../registry/oauth/types.js";
 import type { ClientUsageReport, ClientUsageSummary, UsageHistoryEntry, UsageHistoryQuery } from "../usage.js";
@@ -14,20 +15,7 @@ type SerializedCredentialRecord = {
     data: string;
     identityKey: string | null;
 };
-/**
- * SQLite's busy result code family — base `SQLITE_BUSY` plus the extended
- * variants `SQLITE_BUSY_RECOVERY` (concurrent WAL recovery), `SQLITE_BUSY_SNAPSHOT`,
- * and `SQLITE_BUSY_TIMEOUT`. All warrant the same backoff-and-retry treatment.
- */
-export declare function isSqliteBusyError(err: unknown): boolean;
-/**
- * SQLite's unrecoverable-corruption result codes — the `SQLITE_CORRUPT` family
- * (base plus extended variants like `SQLITE_CORRUPT_VTAB` / `SQLITE_CORRUPT_INDEX`)
- * and `SQLITE_NOTADB` (the file header is not a database). Unlike
- * {@link isSqliteBusyError}, these never clear by retrying: the store must be
- * repaired or replaced, so callers latch and stop touching it.
- */
-export declare function isSqliteCorruptionError(err: unknown): boolean;
+export { isSqliteBusyError, isSqliteCorruptionError };
 export declare function serializeCredential(provider: string, credential: AuthCredential): SerializedCredentialRecord | null;
 export declare function resolveCredentialIdentityKey(provider: string, credential: AuthCredential): string | null;
 /**
@@ -112,4 +100,3 @@ export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
     acknowledgeLocalChanges(): void;
     close(): void;
 }
-export {};

package/dist/types/auth-storage.d.ts

@@ -1142,8 +1142,10 @@ export declare class AuthStorage {
      * - usage-limit / account-rate-limit error → {@link AuthStorage.markUsageLimitReached}
      *   (temporary block via its own backoff — default plus server usage-report
      *   reset; sticky left intact so the next resolve re-ranks around the block).
-     * - account-scoped policy denial → temporarily block that account without
-     *   marking its credential suspect, then rotate through eligible siblings.
+     * - exact Codex model-entitlement denial → temporarily block only that
+     *   requested model after provider/model identity matches, then rotate.
+     * - other account-scoped policy denial → temporarily block that account
+     *   without marking its credential suspect, then rotate through siblings.
      * - otherwise (hard 401 / auth failure) → mark the credential suspect (or
      *   reload when no broker hook is wired) and block it, then drop matching
      *   sticky state.

package/dist/types/dialect/thinking-fence-strip.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Strip self-referential reasoning-fence delimiters that a provider leaks
+ * *inside* a structured thinking part.
+ *
+ * The visible-channel healers ({@link ../utils/leaked-thinking-stream},
+ * {@link ./fenced-thinking}) split leaked ` ```thinking ` fences out of the
+ * *text* stream. They never run over parts a provider already flags as
+ * thinking, so when a model (observed on Gemini thought summaries — issue
+ * #8719) emits a bare ` ```thinking ` / ` ``````thinking ` opener line between
+ * summaries, that delimiter reaches display and persistence verbatim as fence
+ * spam inside the reasoning block.
+ *
+ * This stripper removes only a *standalone* reasoning-fence opener line — a line
+ * that is nothing but a run of ≥3 backticks immediately followed by the info
+ * string `thinking` or `reasoning`. Such a line is always redundant inside an
+ * already-structured thinking block and never carries content. Inline mentions
+ * (prose on the same line), language-tagged code fences (` ```rs `), and bare
+ * closers (` ``` `) are left untouched so legitimate fenced code inside the
+ * reasoning survives.
+ *
+ * Streaming-safe: deltas may split a line anywhere. A trailing partial line is
+ * held only while it remains a viable opener prefix; the moment it cannot be an
+ * opener it is flushed and the rest of the line passes through character-level.
+ * Correctness never depends on the prefix heuristic — every held line is
+ * classified strictly on its newline (or on {@link ThinkingFenceStripper.flush})
+ * before it is dropped.
+ */
+/**
+ * Stateful, line-oriented stripper for leaked reasoning-fence openers in one
+ * structured thinking block. One instance per thinking block; feed every
+ * thinking delta through {@link push} and drain the tail with {@link flush}.
+ */
+export declare class ThinkingFenceStripper {
+    #private;
+    /** Consume one thinking delta; returns the sanitized text to emit (may be empty). */
+    push(chunk: string): string;
+    /** Drain any held partial line at block end; returns text to emit (may be empty). */
+    flush(): string;
+}

package/dist/types/error/finalize.d.ts

@@ -7,6 +7,8 @@ export interface FinalizeOptions {
     api?: Api;
     /** Provider id; forwarded to the message formatter for copilot rewrites. */
     provider?: string;
+    /** Requested model id; paired with provider for model-entitlement classification. */
+    model?: string;
     /** Caller signal, for providers that don't run an abort tracker. */
     signal?: AbortSignal;
     /** Abort tracker, preferred over `signal`: distinguishes caller vs. local aborts. */

package/dist/types/error/flags.d.ts

@@ -58,6 +58,13 @@ export declare function classify(error: unknown, api?: Api): number;
 export declare function isUsageLimit(error: unknown, api?: Api): boolean;
 /** Whether an upstream rejection is an account-scoped policy denial worth retrying with a sibling credential. */
 export declare function isAccountPolicyError(error: unknown, api?: Api): boolean;
+/**
+ * Model id from Codex's exact ChatGPT-account entitlement denial. Generic
+ * unsupported-model invalid requests deliberately do not match.
+ */
+export declare function codexChatGPTAccountPolicyModel(error: unknown, depth?: number): string | undefined;
+/** Whether the exact Codex entitlement denial applies to this provider and requested model. */
+export declare function isCodexChatGPTAccountPolicyError(error: unknown, provider: string, modelId: string | undefined): boolean;
 /**
  * Strict-tool rejection: grammar too large, schema too complex, or structured
  * outputs unsupported by the model/endpoint.
@@ -78,6 +85,8 @@ export declare function isFastModeUnsupported(error: unknown): boolean;
 export declare function isCopilotTransientModelError(error: unknown): boolean;
 export declare function classifyMessage(message: {
     api?: Api;
+    provider?: string;
+    model?: string;
     errorId?: number;
     errorMessage?: string;
     errorStatus?: number;

package/dist/types/providers/cursor/interaction-query.d.ts

@@ -0,0 +1,15 @@
+import type http2 from "node:http2";
+import { type InteractionQuery } from "@oh-my-pi/pi-catalog/discovery/cursor-gen/agent_pb";
+/**
+ * Answer a Cursor `interaction_query` so the Run RPC can continue.
+ *
+ * Hosted web search / Exa / unnamed permission gates (field 9 = WebFetch on
+ * current Cursor builds) block the turn until the client writes an
+ * `interaction_response`. Dropping the frame leaves the HTTP/2 stream alive
+ * on heartbeats that are not semantic progress; the lazy idle watchdog then
+ * aborts with "Provider stream stalled while waiting for the next event".
+ *
+ * Unsupported interactive queries are rejected so the server is not stranded.
+ * VM setup is left unanswered rather than reporting a fake success.
+ */
+export declare function handleInteractionQuery(query: InteractionQuery, h2Request: http2.ClientHttp2Stream): void;

package/dist/types/providers/cursor.d.ts

@@ -2,7 +2,7 @@ import http2 from "node:http2";
 import { type JsonValue } from "@bufbuild/protobuf";
 import type { McpToolDefinition } from "@oh-my-pi/pi-catalog/discovery/cursor-gen/agent_pb";
 import { type AgentServerMessage, type ConversationStateStructure } from "@oh-my-pi/pi-catalog/discovery/cursor-gen/agent_pb";
-import type { AssistantMessage, CursorExecHandlerResult, CursorExecHandlers, CursorExecPairing, CursorTodoSyncHandler, CursorToolResultHandler, Message, StreamFunction, StreamOptions, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage } from "../types.js";
+import type { AssistantMessage, Context, CursorExecHandlerResult, CursorExecHandlers, CursorExecPairing, CursorTodoSyncHandler, CursorToolResultHandler, Message, Model, StreamFunction, StreamOptions, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage } from "../types.js";
 import { kCursorExecResolved, kStreamingBlockIndex, kStreamingBlockKind, kStreamingEnvelopeId, kStreamingLastParseLen, kStreamingPartialJson } from "../utils/block-symbols.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
 export declare const CURSOR_API_URL = "https://api2.cursor.sh";
@@ -32,7 +32,7 @@ export type ToolCallState = ToolCall & {
     [kStreamingBlockIndex]: number;
     [kStreamingPartialJson]?: string;
     [kStreamingLastParseLen]?: number;
-    [kStreamingBlockKind]: "mcp" | "todo" | "cursor-exec" | "connect-scm";
+    [kStreamingBlockKind]: "mcp" | "todo" | "cursor-exec" | "connect-scm" | "web-fetch";
     [kStreamingEnvelopeId]?: string;
     [kCursorExecResolved]?: true;
 };
@@ -219,3 +219,12 @@ export declare function buildCursorHistoryForTest(messages: Message[], activeUse
     turnUserMessagesJson: JsonValue[];
     turnStepMessagesJson: JsonValue[][];
 };
+export declare function buildGrpcRequest(model: Model<"cursor-agent">, context: Context, options: CursorOptions | undefined, state: {
+    conversationId: string;
+    blobStore: Map<string, Uint8Array>;
+    conversationState?: ConversationStateStructure;
+}): Promise<{
+    requestBytes: Uint8Array;
+    blobStore: Map<string, Uint8Array>;
+    conversationState: ConversationStateStructure;
+}>;

package/dist/types/providers/openai-shared.d.ts

@@ -231,6 +231,7 @@ export type OpenAICompletionsParams = Omit<ChatCompletionCreateParamsStreaming,
     chat_template_kwargs?: {
         enable_thinking?: boolean;
         preserve_thinking?: boolean;
+        reasoning_effort?: string;
     };
     reasoning?: {
         effort?: string;
@@ -403,6 +404,23 @@ export declare function repairOrphanResponsesToolOutputs(input: ResponseInput):
  * {@link repairOrphanResponsesToolOutputs}.
  */
 export declare function repairOrphanResponsesToolCalls(input: ResponseInput): ResponseInput;
+/**
+ * Relocate assistant `message` items wedged inside a tool-call → tool-output
+ * batch to before the batch, yielding canonical `message(s) → calls → outputs`
+ * order. Idempotent; returns the same array reference when nothing moves.
+ *
+ * OpenAI's Responses API pairs tool outputs by `call_id` and tolerates any item
+ * order, but stricter gateways (notably opencode-go's "Console Go") reject a
+ * shape where an assistant message interrupts a `function_call` →
+ * `function_call_output` run, 400ing with `No tool output found for tool call …`
+ * (naming a random call of the batch on each retry). This arises whenever a
+ * model streams a trailing text / demoted-thinking block *after* its tool calls:
+ * the block-encode path preserves stream order, emitting the message between the
+ * calls and the outputs appended afterward. Moving the already-model-owned
+ * message ahead of its call batch keeps content identical while satisfying the
+ * strict validator. See #8789.
+ */
+export declare function hoistInterleavedResponsesToolBatchMessages<T extends object>(items: readonly T[]): T[];
 export declare function convertResponsesInputContent(content: string | Array<TextContent | ImageContent>, supportsImages: boolean, supportsImageDetailOriginal: boolean, escapeControlTokens?: boolean): ResponseInputContent[] | undefined;
 export interface BuildResponsesInputOptions<TApi extends Api> {
     model: Model<TApi>;

package/dist/types/registry/oauth/opencode.d.ts

@@ -1,18 +1,25 @@
 /**
- * OpenCode Zen login flow.
+ * OpenCode login flow, shared by the OpenCode Zen and OpenCode Go providers.
  *
- * OpenCode Zen is a subscription service that provides access to various AI models
- * (GPT-5.x, Claude 4.x, Gemini 3, etc.) through a unified API at opencode.ai/zen.
- * This is not OAuth - it's a simple API key flow:
+ * Both are subscription services whose API keys are issued from the same
+ * OpenCode Zen console at https://opencode.ai/auth — OpenCode Go keys are
+ * minted there after subscribing to Go (see https://opencode.ai/docs/go).
+ * This is not OAuth; it's a simple paste-the-API-key flow:
  * 1. Open browser to https://opencode.ai/auth
- * 2. User logs in and copies their API key
+ * 2. User logs in (and subscribes to Go, for OpenCode Go) and copies the key
  * 3. User pastes the API key back into the CLI
  */
 import type { OAuthController } from "./types.js";
 /**
- * Login to OpenCode Zen.
+ * Log in to an OpenCode subscription provider.
  *
- * Opens browser to auth page, prompts user to paste their API key.
- * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ * Opens the browser to the OpenCode Zen console, prompts the user to paste
+ * their API key, and returns it directly (not OAuthCredentials — this isn't
+ * OAuth).
+ *
+ * @param providerName Display name of the provider being connected
+ *   ("OpenCode Zen" or "OpenCode Go"). Used verbatim in the paste prompt so
+ *   the CLI reflects the provider the user actually selected instead of always
+ *   asking for a Zen key.
  */
-export declare function loginOpenCode(options: OAuthController): Promise<string>;
+export declare function loginOpenCode(options: OAuthController, providerName?: string): Promise<string>;

package/dist/types/types.d.ts

@@ -701,6 +701,13 @@ export interface ContextSnapshot {
     nonMessageTokens: number;
     /** Estimated prompt tokens removed by local history rewrites after this provider snapshot was recorded. */
     historyRewriteTokensRemoved?: number;
+    /**
+     * Compaction epoch current when this snapshot's provider request was recorded.
+     * A later compaction bumps the session epoch, so an anchor whose epoch is
+     * older than the current in-flight snapshot describes pre-compaction history
+     * and must not override the rebased estimate.
+     */
+    compactionEpoch?: number;
     lastMessageTimestamp?: number;
 }
 export interface AssistantMessage {

package/dist/types/usage.d.ts

@@ -482,6 +482,16 @@ export interface CredentialRankingStrategy {
      * account-wide quotas can omit this and use all limits.
      */
     scopeLimits?(report: UsageReport, context?: CredentialRankingContext): UsageLimit[];
+    /**
+     * Restrict limits for the opt-in, non-destructive usage-reserve health
+     * check ({@link AuthStorage.getModelUsageHealth}). Distinct from
+     * {@link scopeLimits}, which gates credential-wide hard blocks: a provider
+     * whose model/tier counters are trusted only at confirmed exhaustion for
+     * hard-blocking can still expose them here so the reserve margin protects
+     * the mapped quota before it hits the cap. Falls back to {@link scopeLimits}
+     * when omitted.
+     */
+    scopeLimitsForReserve?(report: UsageReport, context?: CredentialRankingContext): UsageLimit[];
     /**
      * Return a provider-local backoff scope for the requested model. Providers
      * with backend-specific quotas use this so one exhausted model family does

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "17.3.7",
+	"version": "17.3.8",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,10 +38,10 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.1",
-		"@oh-my-pi/omptype": "17.3.7",
-		"@oh-my-pi/pi-catalog": "17.3.7",
-		"@oh-my-pi/pi-utils": "17.3.7",
-		"@oh-my-pi/pi-wire": "17.3.7"
+		"@oh-my-pi/omptype": "17.3.8",
+		"@oh-my-pi/pi-catalog": "17.3.8",
+		"@oh-my-pi/pi-utils": "17.3.8",
+		"@oh-my-pi/pi-wire": "17.3.8"
 	},
 	"devDependencies": {
 		"@bufbuild/protoc-gen-es": "^2.12.1",

package/src/auth/sqlite-credential-store.ts

@@ -8,7 +8,13 @@ import { Database, type Statement } from "bun:sqlite";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { parseAlibabaTokenPlanCredential } from "@oh-my-pi/pi-catalog/wire/alibaba-token-plan";
-import { getAgentDbPath, getDbBusyTimeoutMs, logger } from "@oh-my-pi/pi-utils";
+import {
+	getAgentDbPath,
+	getDbBusyTimeoutMs,
+	isSqliteBusyError,
+	isSqliteCorruptionError,
+	logger,
+} from "@oh-my-pi/pi-utils";
 import type {
 	AuthCredential,
 	AuthCredentialStore,
@@ -87,29 +93,10 @@ const LEGACY_CODEX_BLOCK_PROVIDER_KEY = "openai-codex:oauth";
 const LEGACY_CODEX_BLOCK_SCOPE = "shared";
 const CODEX_METER_BLOCK_SCOPES = ["chat", "spark"] as const;
 
-/**
- * SQLite's busy result code family — base `SQLITE_BUSY` plus the extended
- * variants `SQLITE_BUSY_RECOVERY` (concurrent WAL recovery), `SQLITE_BUSY_SNAPSHOT`,
- * and `SQLITE_BUSY_TIMEOUT`. All warrant the same backoff-and-retry treatment.
- */
-export function isSqliteBusyError(err: unknown): boolean {
-	if (err === null || typeof err !== "object") return false;
-	const code = (err as { code?: unknown }).code;
-	return typeof code === "string" && code.startsWith("SQLITE_BUSY");
-}
-
-/**
- * SQLite's unrecoverable-corruption result codes — the `SQLITE_CORRUPT` family
- * (base plus extended variants like `SQLITE_CORRUPT_VTAB` / `SQLITE_CORRUPT_INDEX`)
- * and `SQLITE_NOTADB` (the file header is not a database). Unlike
- * {@link isSqliteBusyError}, these never clear by retrying: the store must be
- * repaired or replaced, so callers latch and stop touching it.
- */
-export function isSqliteCorruptionError(err: unknown): boolean {
-	if (err === null || typeof err !== "object" || !("code" in err)) return false;
-	const code = err.code;
-	return typeof code === "string" && (code.startsWith("SQLITE_CORRUPT") || code === "SQLITE_NOTADB");
-}
+// SQLite error classifiers live in pi-utils so the credential store and the
+// model cache share one implementation; re-exported here to preserve the
+// pre-existing `@oh-my-pi/pi-ai/auth-storage` surface.
+export { isSqliteBusyError, isSqliteCorruptionError };
 
 function normalizeStoredAccountId(accountId: string | null | undefined): string | null {
 	const normalized = accountId?.trim();

package/src/auth-storage.ts

@@ -1026,6 +1026,28 @@ function resolveOpenAICodexPlanRequirement(provider: string, modelId: string | u
 	return "none";
 }
 
+const MODEL_ACCOUNT_POLICY_BLOCK_SCOPE_PREFIX = "model-policy:";
+
+function modelAccountPolicyBlockScope(provider: string, modelId: string | undefined): string | undefined {
+	if (provider !== "openai-codex" || typeof modelId !== "string") return undefined;
+	const separator = modelId.lastIndexOf("/");
+	const bareModelId = (separator === -1 ? modelId : modelId.slice(separator + 1)).trim().toLowerCase();
+	if (!bareModelId || bareModelId.includes("\0")) return undefined;
+	return `${MODEL_ACCOUNT_POLICY_BLOCK_SCOPE_PREFIX}${bareModelId}`;
+}
+
+function credentialBlockScopesForRequest(
+	provider: string,
+	strategy: CredentialRankingStrategy | undefined,
+	rankingContext: CredentialRankingContext,
+	blockScope: string | undefined,
+): readonly string[] {
+	const scopes = strategy?.blockScopes?.(rankingContext) ?? (blockScope ? [blockScope] : []);
+	const modelPolicyScope = modelAccountPolicyBlockScope(provider, rankingContext.modelId);
+	if (!modelPolicyScope || scopes.includes(modelPolicyScope)) return scopes;
+	return [...scopes, modelPolicyScope];
+}
+
 function getUsagePlanType(report: UsageReport | null): string | undefined {
 	const metadata = report?.metadata;
 	if (!metadata) return undefined;
@@ -2169,7 +2191,7 @@ export class AuthStorage {
 
 		const rankingContext: CredentialRankingContext = { modelId: options?.modelId };
 		const blockScope = strategy.blockScope?.(rankingContext);
-		const blockScopes = strategy.blockScopes?.(rankingContext) ?? (blockScope ? [blockScope] : []);
+		const blockScopes = credentialBlockScopesForRequest(provider, strategy, rankingContext, blockScope);
 		const candidates = await this.#rankApiKeySelections({
 			providerKey,
 			provider,
@@ -3911,7 +3933,7 @@ export class AuthStorage {
 		const planRequirement = resolveOpenAICodexPlanRequirement(provider, options.modelId);
 		const planEligibilityByCredential = new Map<number, boolean | undefined>();
 		const blockScope = strategy.blockScope?.(rankingContext);
-		const blockScopes = strategy.blockScopes?.(rankingContext) ?? (blockScope ? [blockScope] : []);
+		const blockScopes = credentialBlockScopesForRequest(provider, strategy, rankingContext, blockScope);
 		const reserveFraction = Number.isFinite(options.reserveFraction)
 			? Math.max(0, Math.min(1, options.reserveFraction))
 			: 0;
@@ -3961,7 +3983,12 @@ export class AuthStorage {
 				}
 				if (!report) return { credentialId: entry.id, credentialType, state: "unknown" };
 
-				const limits = this.#getScopedUsageLimits(strategy, report, rankingContext);
+				// Reserve health is opt-in and non-destructive: prefer the strategy's
+				// reserve scoping, which may expose mapped model/tier rows that the
+				// hard-block scoper withholds until confirmed exhaustion.
+				const limits =
+					strategy.scopeLimitsForReserve?.(report, rankingContext) ??
+					this.#getScopedUsageLimits(strategy, report, rankingContext);
 				if (limits.length === 0) return { credentialId: entry.id, credentialType, state: "unknown" };
 
 				const currentLimits = limits.filter(limit => {
@@ -4378,17 +4405,24 @@ export class AuthStorage {
 		provider: string,
 		credentialType: AuthCredential["type"],
 		modelId: string | undefined,
+		blockScopeOverride?: string,
 	): CredentialBlockRouting {
 		const providerKey = this.#getProviderTypeKey(provider, credentialType);
 		const strategy = this.#rankingStrategyResolver?.(provider);
 		const rankingContext: CredentialRankingContext = { modelId };
-		const blockScope = strategy?.blockScope?.(rankingContext);
+		const defaultBlockScope = strategy?.blockScope?.(rankingContext);
+		const blockScope = blockScopeOverride ?? defaultBlockScope;
+		const requestBlockScopes = credentialBlockScopesForRequest(provider, strategy, rankingContext, defaultBlockScope);
+		const siblingBlockScopes =
+			blockScopeOverride && !requestBlockScopes.includes(blockScopeOverride)
+				? [...requestBlockScopes, blockScopeOverride]
+				: requestBlockScopes;
 		return {
 			providerKey,
 			strategy,
 			rankingContext,
 			blockScope,
-			siblingBlockScopes: strategy?.blockScopes?.(rankingContext) ?? (blockScope ? [blockScope] : []),
+			siblingBlockScopes,
 		};
 	}
 
@@ -4755,7 +4789,7 @@ export class AuthStorage {
 		const rankingContext: CredentialRankingContext = { modelId: options?.modelId };
 		const blockScope = strategy?.blockScope?.(rankingContext);
 		// Reads honour every scope that applies; the scalar above is for args that persist.
-		const blockScopes = strategy?.blockScopes?.(rankingContext) ?? (blockScope ? [blockScope] : []);
+		const blockScopes = credentialBlockScopesForRequest(provider, strategy, rankingContext, blockScope);
 		const planRequirement = resolveOpenAICodexPlanRequirement(provider, options?.modelId);
 		const hasPlanRequirement = planRequirement !== "none";
 		const checkUsage = strategy !== undefined && (credentials.length > 1 || hasPlanRequirement);
@@ -6205,8 +6239,10 @@ export class AuthStorage {
 	 * - usage-limit / account-rate-limit error → {@link AuthStorage.markUsageLimitReached}
 	 *   (temporary block via its own backoff — default plus server usage-report
 	 *   reset; sticky left intact so the next resolve re-ranks around the block).
-	 * - account-scoped policy denial → temporarily block that account without
-	 *   marking its credential suspect, then rotate through eligible siblings.
+	 * - exact Codex model-entitlement denial → temporarily block only that
+	 *   requested model after provider/model identity matches, then rotate.
+	 * - other account-scoped policy denial → temporarily block that account
+	 *   without marking its credential suspect, then rotate through siblings.
 	 * - otherwise (hard 401 / auth failure) → mark the credential suspect (or
 	 *   reload when no broker hook is wired) and block it, then drop matching
 	 *   sticky state.
@@ -6243,8 +6279,24 @@ export class AuthStorage {
 		});
 		if (!sessionCredential) return false;
 
-		if (AIError.isAccountPolicyError(error)) {
-			const routing = this.#credentialBlockRouting(provider, sessionCredential.type, options?.modelId);
+		const deniedModel = AIError.codexChatGPTAccountPolicyModel(error);
+		const exactCodexModelPolicy =
+			deniedModel !== undefined && AIError.isCodexChatGPTAccountPolicyError(error, provider, options?.modelId);
+		// The exact sentence is provider-controlled input. A non-Codex provider,
+		// absent request model, or mismatched model must not turn it into either a
+		// global block or a hard-auth invalidation.
+		if (deniedModel !== undefined && !exactCodexModelPolicy) return false;
+		if (exactCodexModelPolicy || AIError.isAccountPolicyError(error)) {
+			const modelPolicyScope = exactCodexModelPolicy
+				? modelAccountPolicyBlockScope(provider, options?.modelId)
+				: undefined;
+			if (exactCodexModelPolicy && modelPolicyScope === undefined) return false;
+			const routing = this.#credentialBlockRouting(
+				provider,
+				sessionCredential.type,
+				options?.modelId,
+				modelPolicyScope,
+			);
 			return this.#blockCredentialForRotation(
 				provider,
 				sessionCredential.type,

package/src/dialect/thinking-fence-strip.ts

@@ -0,0 +1,92 @@
+/**
+ * Strip self-referential reasoning-fence delimiters that a provider leaks
+ * *inside* a structured thinking part.
+ *
+ * The visible-channel healers ({@link ../utils/leaked-thinking-stream},
+ * {@link ./fenced-thinking}) split leaked ` ```thinking ` fences out of the
+ * *text* stream. They never run over parts a provider already flags as
+ * thinking, so when a model (observed on Gemini thought summaries — issue
+ * #8719) emits a bare ` ```thinking ` / ` ``````thinking ` opener line between
+ * summaries, that delimiter reaches display and persistence verbatim as fence
+ * spam inside the reasoning block.
+ *
+ * This stripper removes only a *standalone* reasoning-fence opener line — a line
+ * that is nothing but a run of ≥3 backticks immediately followed by the info
+ * string `thinking` or `reasoning`. Such a line is always redundant inside an
+ * already-structured thinking block and never carries content. Inline mentions
+ * (prose on the same line), language-tagged code fences (` ```rs `), and bare
+ * closers (` ``` `) are left untouched so legitimate fenced code inside the
+ * reasoning survives.
+ *
+ * Streaming-safe: deltas may split a line anywhere. A trailing partial line is
+ * held only while it remains a viable opener prefix; the moment it cannot be an
+ * opener it is flushed and the rest of the line passes through character-level.
+ * Correctness never depends on the prefix heuristic — every held line is
+ * classified strictly on its newline (or on {@link ThinkingFenceStripper.flush})
+ * before it is dropped.
+ */
+
+/**
+ * A complete standalone reasoning-fence opener: ≤3 lead spaces, ≥3 backticks,
+ * `thinking`/`reasoning`, optional trailing spaces, tolerating a trailing CR
+ * from a CRLF newline.
+ */
+const OPENER_LINE = /^ {0,3}`{3,}(?:thinking|reasoning)[ \t]*\r?$/i;
+
+/** Could `line` (a partial, newline-not-yet-seen) still grow into {@link OPENER_LINE}? */
+function couldBeOpenerPrefix(line: string): boolean {
+	// Tolerate a pending CR from a split CRLF.
+	const s = line.endsWith("\r") ? line.slice(0, -1) : line;
+	const m = /^ {0,3}(`*)([\s\S]*)$/.exec(s);
+	if (!m) return false;
+	const ticks = m[1]!.length;
+	const rest = m[2]!;
+	if (rest === "") return true; // still consuming leading spaces / backticks
+	if (ticks < 3) return false; // a non-backtick char appeared before 3 backticks: never a fence
+	const word = rest.replace(/[ \t]+$/, "").toLowerCase();
+	return "thinking".startsWith(word) || "reasoning".startsWith(word);
+}
+
+/**
+ * Stateful, line-oriented stripper for leaked reasoning-fence openers in one
+ * structured thinking block. One instance per thinking block; feed every
+ * thinking delta through {@link push} and drain the tail with {@link flush}.
+ */
+export class ThinkingFenceStripper {
+	/** Buffered content of the current line still being classified. */
+	#carry = "";
+	/** True once the current line is known not to be an opener; passes through until newline. */
+	#passthrough = false;
+
+	/** Consume one thinking delta; returns the sanitized text to emit (may be empty). */
+	push(chunk: string): string {
+		let out = "";
+		for (const ch of chunk) {
+			if (this.#passthrough) {
+				out += ch;
+				if (ch === "\n") this.#passthrough = false;
+				continue;
+			}
+			if (ch === "\n") {
+				if (!OPENER_LINE.test(this.#carry)) out += `${this.#carry}\n`;
+				this.#carry = "";
+				continue;
+			}
+			this.#carry += ch;
+			if (!couldBeOpenerPrefix(this.#carry)) {
+				out += this.#carry;
+				this.#carry = "";
+				this.#passthrough = true;
+			}
+		}
+		return out;
+	}
+
+	/** Drain any held partial line at block end; returns text to emit (may be empty). */
+	flush(): string {
+		const carry = this.#carry;
+		this.#carry = "";
+		this.#passthrough = false;
+		return OPENER_LINE.test(carry) ? "" : carry;
+	}
+}

package/src/error/finalize.ts

@@ -10,6 +10,8 @@ export interface FinalizeOptions {
 	api?: Api;
 	/** Provider id; forwarded to the message formatter for copilot rewrites. */
 	provider?: string;
+	/** Requested model id; paired with provider for model-entitlement classification. */
+	model?: string;
 	/** Caller signal, for providers that don't run an abort tracker. */
 	signal?: AbortSignal;
 	/** Abort tracker, preferred over `signal`: distinguishes caller vs. local aborts. */
@@ -55,6 +57,8 @@ export async function finalize(error: unknown, opts: FinalizeOptions = {}): Prom
 
 	const id = classifyMessage({
 		api: opts.api,
+		provider: opts.provider,
+		model: opts.model,
 		errorId: classify(error, opts.api),
 		errorMessage: message,
 		errorStatus: currentStatus,