@oh-my-pi/pi-ai 17.4.0 → 17.4.2

package/src/registry/oauth/google-antigravity.ts

@@ -2,16 +2,17 @@
  * Antigravity OAuth flow (Gemini 3, Claude, GPT-OSS via Google Cloud)
  * Uses different OAuth credentials than google-gemini-cli for access to additional models.
  */
-import { getAntigravityUserAgent, getAntigravityVersion } from "@oh-my-pi/pi-catalog/wire/gemini-headers";
+import { type } from "@oh-my-pi/omptype";
+import { getAntigravityUserAgent } from "@oh-my-pi/pi-catalog/wire/gemini-headers";
 import * as AIError from "../../error";
+import { raceWithSignal } from "../../utils/abort";
 import { oauthFetch, runGoogleOAuthLogin, throwIfLoginCancelled } from "./google-oauth-shared";
 import type { OAuthController, OAuthCredentials } from "./types";
 
-const decode = (s: string) => atob(s);
-const CLIENT_ID = decode(
+const CLIENT_ID = atob(
 	"MTA3MTAwNjA2MDU5MS10bWhzc2luMmgyMWxjcmUyMzV2dG9sb2poNGc0MDNlcC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbQ==",
 );
-const CLIENT_SECRET = decode("R09DU1BYLUs1OEZXUjQ4NkxkTEoxbUxCOHNYQzR6NnFEQWY=");
+const CLIENT_SECRET = atob("R09DU1BYLUs1OEZXUjQ4NkxkTEoxbUxCOHNYQzR6NnFEQWY=");
 const CALLBACK_PORT = 51121;
 const CALLBACK_PATH = "/oauth-callback";
 
@@ -25,127 +26,250 @@ const SCOPES = [
 
 const AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
 const TOKEN_URL = "https://oauth2.googleapis.com/token";
-const CLOUD_CODE_ENDPOINT = "https://cloudcode-pa.googleapis.com";
-const DAILY_CLOUD_CODE_ENDPOINT = "https://daily-cloudcode-pa.googleapis.com";
-const NODE_API_CLIENT_USER_AGENT = "google-api-nodejs-client/10.3.0";
-const GOOG_API_CLIENT_HEADER = "gl-node/22.21.1";
-const TIER_FREE = "free-tier";
-const PROJECT_ONBOARD_MAX_ATTEMPTS = 5;
-const PROJECT_ONBOARD_INTERVAL_MS = 2000;
-interface LoadCodeAssistPayload {
-	cloudaicompanionProject?: string | { id?: string };
-	currentTier?: { id?: string };
-	allowedTiers?: Array<{ id?: string; isDefault?: boolean }>;
+const CLOUD_CODE_ASSIST_ENDPOINT = "https://daily-cloudcode-pa.googleapis.com";
+const LOAD_CODE_ASSIST_URL = `${CLOUD_CODE_ASSIST_ENDPOINT}/v1internal:loadCodeAssist`;
+const ONBOARD_USER_URL = `${CLOUD_CODE_ASSIST_ENDPOINT}/v1internal:onboardUser`;
+const OPERATIONS_URL = `${CLOUD_CODE_ASSIST_ENDPOINT}/v1internal`;
+const FREE_TIER_ID = "free-tier";
+const ONBOARD_TIMEOUT_MS = 30_000;
+const ONBOARD_POLL_INTERVAL_MS = 1_000;
+const PROVIDER = "google-antigravity";
+
+/** Cloud Code Assist metadata sent by native Antigravity control-plane requests. */
+export const ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA = Object.freeze({
+	ideType: "ANTIGRAVITY",
+});
+
+interface CloudCodeContext {
+	headers: Record<string, string>;
+	signal?: AbortSignal;
 }
 
-interface LongRunningOperationResponse {
-	done?: boolean;
-	response?: {
-		cloudaicompanionProject?: string | { id?: string };
-	};
+interface CloudCodeRequest extends CloudCodeContext {
+	label: string;
+	url: string;
+	method: "GET" | "POST";
+	body?: string;
+	timeoutMs?: number;
 }
 
-export const ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA = Object.freeze({
-	ideType: "ANTIGRAVITY",
+const userTierSchema = type({
+	"id?": "string",
 });
 
-export interface AntigravityOnboardMetadata {
-	ide_type: string;
-	ide_version: string;
-	ide_name: string;
+const ineligibleTierSchema = type({
+	"tierId?": "string",
+	"reasonMessage?": "string",
+	"validationUrl?": "string",
+});
+
+const loadCodeAssistResponseSchema = type({
+	"currentTier?": userTierSchema.or("null"),
+	"paidTier?": userTierSchema.or("null"),
+	"allowedTiers?": userTierSchema.array(),
+	"ineligibleTiers?": ineligibleTierSchema.array(),
+	"cloudaicompanionProject?": "string",
+});
+type LoadCodeAssistResponse = typeof loadCodeAssistResponseSchema.infer;
+
+const operationErrorSchema = type({
+	"code?": "number",
+	"message?": "string",
+});
+type OperationError = typeof operationErrorSchema.infer;
+
+const onboardUserResponseSchema = type({
+	"@type": "string",
+	"cloudaicompanionProject?": "string",
+});
+
+const onboardOperationSchema = type({
+	"name?": "string",
+	"done?": "boolean",
+	"error?": operationErrorSchema.or("null"),
+	"response?": onboardUserResponseSchema.or("null"),
+});
+type OnboardOperation = typeof onboardOperationSchema.infer;
+
+function parseLoadCodeAssistResponse(payload: unknown): LoadCodeAssistResponse {
+	const result = loadCodeAssistResponseSchema(payload);
+	if (result instanceof type.errors) {
+		throw new AIError.OAuthError(`failed to unmarshal LoadCodeAssistResponse: ${result.summary}`, {
+			kind: "provisioning",
+			provider: PROVIDER,
+		});
+	}
+	return result;
+}
+
+function parseOnboardOperation(payload: unknown): OnboardOperation {
+	const result = onboardOperationSchema(payload);
+	if (result instanceof type.errors) {
+		throw new AIError.OAuthError(`failed to unmarshal OnboardUser operation: ${result.summary}`, {
+			kind: "provisioning",
+			provider: PROVIDER,
+		});
+	}
+	return result;
+}
+
+function extractProjectId(payload: LoadCodeAssistResponse): string | undefined {
+	const projectId = payload.cloudaicompanionProject;
+	return projectId && projectId.length > 0 ? projectId : undefined;
+}
+
+function hasMessageField(payload: LoadCodeAssistResponse, field: "currentTier" | "paidTier"): boolean {
+	return payload[field] !== undefined && payload[field] !== null;
+}
+
+function isFreeTierAllowed(payload: LoadCodeAssistResponse): boolean {
+	return payload.allowedTiers?.some(tier => tier.id === FREE_TIER_ID) === true;
 }
 
-export function getAntigravityOnboardMetadata(): AntigravityOnboardMetadata {
+function getFreeTierIneligibility(
+	payload: LoadCodeAssistResponse,
+): { reasonMessage: string; validationUrl: string | undefined } | undefined {
+	const tier = payload.ineligibleTiers?.find(candidate => candidate.tierId === FREE_TIER_ID);
+	if (!tier?.reasonMessage) return undefined;
 	return {
-		ide_type: "ANTIGRAVITY",
-		ide_version: getAntigravityVersion(),
-		ide_name: "antigravity",
+		reasonMessage: tier.reasonMessage,
+		validationUrl: tier.validationUrl && tier.validationUrl.length > 0 ? tier.validationUrl : undefined,
 	};
 }
 
-function readProjectId(value: unknown): string | undefined {
-	if (typeof value === "string" && value.length > 0) {
-		return value.trim();
-	}
-	if (value && typeof value === "object" && "id" in value && typeof (value as { id?: unknown }).id === "string") {
-		const id = (value as { id: string }).id.trim();
-		if (id.length > 0) return id;
-	}
-	return undefined;
+function assertFreeTierEligible(payload: LoadCodeAssistResponse): void {
+	if (isFreeTierAllowed(payload)) return;
+	const ineligibility = getFreeTierIneligibility(payload);
+	if (!ineligibility) return;
+	const validation = ineligibility.validationUrl ? `\n${ineligibility.validationUrl}` : "";
+	throw new AIError.OAuthError(`${ineligibility.reasonMessage}${validation}`, {
+		kind: "provisioning",
+		provider: PROVIDER,
+	});
 }
 
-function extractProjectId(payload: unknown): string | undefined {
-	if (!payload || typeof payload !== "object") return undefined;
-	const record = payload as Record<string, unknown>;
-	for (const key of ["cloudaicompanionProject", "projectId", "project"]) {
-		const id = readProjectId(record[key]);
-		if (id) return id;
+async function requestCloudCodeAssist({
+	label,
+	url,
+	method,
+	headers,
+	body,
+	signal,
+	timeoutMs,
+}: CloudCodeRequest): Promise<unknown> {
+	throwIfLoginCancelled(signal);
+	const init: RequestInit = body === undefined ? { method, headers } : { method, headers, body };
+	const response = await oauthFetch(url, init, { provider: PROVIDER, signal, timeoutMs });
+	if (response.status !== 200) {
+		const errorText = await response.text();
+		throw new AIError.OAuthError(`${label} failed: ${response.status} ${response.statusText}: ${errorText}`, {
+			kind: "provisioning",
+			provider: PROVIDER,
+			status: response.status,
+		});
 	}
-	return undefined;
+	return response.json();
 }
 
-function getDefaultTierId(
-	allowedTiers?: Array<{ id?: string; isDefault?: boolean }>,
-	currentTier?: { id?: string },
-): string {
-	if (allowedTiers && allowedTiers.length > 0) {
-		const defaultTier = allowedTiers.find(
-			tier => tier.isDefault && typeof tier.id === "string" && tier.id.trim().length > 0,
-		);
-		if (defaultTier?.id) {
-			return defaultTier.id.trim();
-		}
-	}
-	if (currentTier && typeof currentTier.id === "string" && currentTier.id.trim().length > 0) {
-		return currentTier.id.trim();
+async function postLoadCodeAssist(
+	context: CloudCodeContext,
+	body: Record<string, unknown>,
+): Promise<LoadCodeAssistResponse> {
+	const payload = await requestCloudCodeAssist({
+		...context,
+		label: "loadCodeAssist",
+		url: LOAD_CODE_ASSIST_URL,
+		method: "POST",
+		body: JSON.stringify(body),
+	});
+	return parseLoadCodeAssistResponse(payload);
+}
+
+async function loadCodeAssist(context: CloudCodeContext): Promise<LoadCodeAssistResponse> {
+	let payload = await postLoadCodeAssist(context, {
+		metadata: ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA,
+	});
+	const projectId = extractProjectId(payload);
+	if (!hasMessageField(payload, "paidTier") && projectId) {
+		payload = await postLoadCodeAssist(context, {
+			cloudaicompanionProject: projectId,
+			metadata: ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA,
+		});
 	}
-	return TIER_FREE;
+	return payload;
 }
 
-async function onboardProjectWithRetries(
-	endpoint: string,
-	headers: Record<string, string>,
-	onboardBody: { tier_id: string; metadata: AntigravityOnboardMetadata },
-	signal: AbortSignal | undefined,
-	onProgress?: (message: string) => void,
-): Promise<string> {
-	for (let attempt = 1; attempt <= PROJECT_ONBOARD_MAX_ATTEMPTS; attempt += 1) {
-		if (attempt > 1) {
-			onProgress?.(`Waiting for project provisioning (attempt ${attempt}/${PROJECT_ONBOARD_MAX_ATTEMPTS})...`);
-			throwIfLoginCancelled(signal);
-			await Bun.sleep(PROJECT_ONBOARD_INTERVAL_MS);
-		}
+function remainingOnboardTime(deadline: number): number {
+	const remaining = deadline - Date.now();
+	if (remaining > 0) return remaining;
+	throw new AIError.OAuthError(`onboardUser timed out after ${ONBOARD_TIMEOUT_MS}ms`, {
+		kind: "timeout",
+		provider: PROVIDER,
+	});
+}
 
-		throwIfLoginCancelled(signal);
-		const onboardResponse = await oauthFetch(
-			`${endpoint}/v1internal:onboardUser`,
-			{ method: "POST", headers, body: JSON.stringify(onboardBody) },
-			{ provider: "google-antigravity", signal },
-		);
+function describeOperationError(error: OperationError): string {
+	if (error.message) {
+		return typeof error.code === "number" ? `${error.code}: ${error.message}` : error.message;
+	}
+	return JSON.stringify(error) ?? String(error);
+}
 
-		if (!onboardResponse.ok) {
-			const errorText = await onboardResponse.text();
-			throw new AIError.OAuthError(
-				`onboardUser failed: ${onboardResponse.status} ${onboardResponse.statusText}: ${errorText}`,
-				{ kind: "provisioning", provider: "google-antigravity", status: onboardResponse.status },
-			);
-		}
+async function onboardUser(context: CloudCodeContext): Promise<void> {
+	const deadline = Date.now() + ONBOARD_TIMEOUT_MS;
+	let operation = parseOnboardOperation(
+		await requestCloudCodeAssist({
+			...context,
+			label: "onboardUser",
+			url: ONBOARD_USER_URL,
+			method: "POST",
+			body: JSON.stringify({
+				tierId: FREE_TIER_ID,
+				metadata: ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA,
+			}),
+			timeoutMs: remainingOnboardTime(deadline),
+		}),
+	);
 
-		const operation = (await onboardResponse.json()) as LongRunningOperationResponse;
-		if (!operation.done) {
-			continue;
+	while (true) {
+		if (operation.done === true) {
+			if (operation.error !== undefined && operation.error !== null) {
+				throw new AIError.OAuthError(`OnboardUser operation failed: ${describeOperationError(operation.error)}`, {
+					kind: "provisioning",
+					provider: PROVIDER,
+				});
+			}
+			if (operation.response === undefined || operation.response === null) {
+				throw new AIError.OAuthError("failed to unmarshal OnboardUserResponse", {
+					kind: "provisioning",
+					provider: PROVIDER,
+				});
+			}
+			return;
 		}
 
-		const projectId = extractProjectId(operation.response);
-		if (projectId) {
-			return projectId;
+		await raceWithSignal(
+			Bun.sleep(Math.min(ONBOARD_POLL_INTERVAL_MS, remainingOnboardTime(deadline))),
+			context.signal,
+		);
+		throwIfLoginCancelled(context.signal);
+		const operationName = operation.name ?? "";
+		if (operationName.length === 0) {
+			throw new AIError.OAuthError("onboardUser returned an operation without a name", {
+				kind: "provisioning",
+				provider: PROVIDER,
+			});
 		}
+		operation = parseOnboardOperation(
+			await requestCloudCodeAssist({
+				...context,
+				label: "onboardUser operation",
+				url: `${OPERATIONS_URL}/${operationName}`,
+				method: "GET",
+				timeoutMs: remainingOnboardTime(deadline),
+			}),
+		);
 	}
-
-	throw new AIError.OAuthError(
-		`onboardUser did not return a provisioned project id after ${PROJECT_ONBOARD_MAX_ATTEMPTS} attempts`,
-		{ kind: "provisioning", provider: "google-antigravity" },
-	);
 }
 
 async function discoverProject(
@@ -153,84 +277,45 @@ async function discoverProject(
 	onProgress?: (message: string) => void,
 	signal?: AbortSignal,
 ): Promise<string> {
-	const headers = {
-		Authorization: `Bearer ${accessToken}`,
-		"Content-Type": "application/json",
-		"User-Agent": getAntigravityUserAgent(),
+	const context: CloudCodeContext = {
+		headers: {
+			Authorization: `Bearer ${accessToken}`,
+			"Content-Type": "application/json",
+			"User-Agent": getAntigravityUserAgent(),
+		},
+		signal,
 	};
 
-	onProgress?.("Checking for existing project...");
+	onProgress?.("Checking Cloud Code Assist account status...");
 	try {
-		let lastErrorText: string | undefined;
-		let lastStatus: number | undefined;
-		let fallbackTierId = TIER_FREE;
-		let loadedSuccessfully = false;
-
-		for (const endpoint of [DAILY_CLOUD_CODE_ENDPOINT, CLOUD_CODE_ENDPOINT]) {
-			throwIfLoginCancelled(signal);
-			const loadResponse = await oauthFetch(
-				`${endpoint}/v1internal:loadCodeAssist`,
-				{
-					method: "POST",
-					headers,
-					body: JSON.stringify({
-						metadata: ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA,
-					}),
-				},
-				{ provider: "google-antigravity", signal },
-			);
-
-			if (!loadResponse.ok) {
-				lastStatus = loadResponse.status;
-				lastErrorText = await loadResponse.text();
-				continue;
-			}
-
-			loadedSuccessfully = true;
-			const loadPayload = (await loadResponse.json()) as LoadCodeAssistPayload;
-			const existingProject = extractProjectId(loadPayload);
-			if (existingProject) {
-				return existingProject;
-			}
-			fallbackTierId = getDefaultTierId(loadPayload.allowedTiers, loadPayload.currentTier);
-		}
-
-		if (!loadedSuccessfully && lastStatus !== undefined) {
-			throw new AIError.OAuthError(`loadCodeAssist failed: ${lastStatus}: ${lastErrorText || "unknown error"}`, {
-				kind: "discovery",
-				status: lastStatus,
-			});
+		const initial = await loadCodeAssist(context);
+		assertFreeTierEligible(initial);
+		if (!hasMessageField(initial, "currentTier")) {
+			onProgress?.("Provisioning the Antigravity free tier...");
+			await onboardUser(context);
 		}
 
-		onProgress?.("Provisioning project...");
-		const onboardBody = {
-			tier_id: fallbackTierId,
-			metadata: getAntigravityOnboardMetadata(),
-		};
-		const onboardHeaders: Record<string, string> = {
-			...headers,
-			"User-Agent": `${headers["User-Agent"]} ${NODE_API_CLIENT_USER_AGENT}`,
-			"X-Goog-Api-Client": GOOG_API_CLIENT_HEADER,
-		};
-		const provisionedProject = await onboardProjectWithRetries(
-			DAILY_CLOUD_CODE_ENDPOINT,
-			onboardHeaders,
-			onboardBody,
-			signal,
-			onProgress,
-		);
-		return provisionedProject;
+		onProgress?.("Refreshing Cloud Code Assist project...");
+		const refreshed = await loadCodeAssist(context);
+		const projectId = extractProjectId(refreshed);
+		if (projectId) return projectId;
+		throw new AIError.OAuthError("loadCodeAssist did not return a cloudaicompanionProject", {
+			kind: "provisioning",
+			provider: PROVIDER,
+		});
 	} catch (error) {
+		throwIfLoginCancelled(signal);
 		if (error instanceof AIError.LoginCancelledError || error instanceof AIError.OAuthError) {
 			throw error;
 		}
 		throw new AIError.OAuthError(
-			`Could not discover or provision an Antigravity project. ${error instanceof Error ? error.message : String(error)}`,
-			{ kind: "discovery", provider: "google-antigravity", cause: error },
+			`Could not discover an Antigravity project. ${error instanceof Error ? error.message : String(error)}`,
+			{ kind: "discovery", provider: PROVIDER, cause: error },
 		);
 	}
 }
 
+/** Authenticate an Antigravity account and resolve its Cloud Code Assist project. */
 export async function loginAntigravity(ctrl: OAuthController): Promise<OAuthCredentials> {
 	return runGoogleOAuthLogin(ctrl, {
 		provider: "google-antigravity",

package/src/registry/oauth/index.ts

@@ -60,12 +60,12 @@ export function unregisterOAuthProviders(sourceId: string): void {
 }
 
 /**
- * Refresh token for any OAuth provider.
- * Saves the new credentials and returns the new access token.
+ * Refresh a built-in OAuth grant, cancelling provider work when refresh ownership ends.
  */
 export async function refreshOAuthToken(
 	provider: OAuthProvider,
 	credentials: OAuthCredentials,
+	signal?: AbortSignal,
 ): Promise<OAuthCredentials> {
 	if (!credentials) {
 		throw new AIError.OAuthError(`No OAuth credentials found for ${provider}`, {
@@ -82,7 +82,7 @@ export async function refreshOAuthToken(
 	}
 	// Providers without a real refresher (static bearer tokens / API keys that
 	// don't expire) return the credentials unchanged.
-	return def.refreshToken ? def.refreshToken(credentials) : credentials;
+	return def.refreshToken ? def.refreshToken(credentials, signal) : credentials;
 }
 function getPerplexityJwtExpiryMs(token: string): number | undefined {
 	const parts = token.split(".");

package/src/registry/oauth/types.ts

@@ -89,7 +89,8 @@ export interface OAuthProviderInterface {
 	readonly name: string;
 	readonly sourceId?: string;
 	login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials | string>;
-	refreshToken?(credentials: OAuthCredentials): Promise<OAuthCredentials>;
+	/** Refresh a stored grant; the signal bounds provider network work to refresh ownership. */
+	refreshToken?(credentials: OAuthCredentials, signal?: AbortSignal): Promise<OAuthCredentials>;
 	getApiKey?(credentials: OAuthCredentials): string;
 	/** Store resulting OAuth credentials under a different provider id. */
 	readonly storeCredentialsAs?: string;

package/src/registry/oauth/xai-oauth.ts

@@ -106,6 +106,7 @@ export function validateXAIBillingEndpoint(url: string, field: string = "billing
 async function xaiOAuthDiscovery(
 	timeoutMs: number = DISCOVERY_TIMEOUT_MS,
 	fetchOverride?: FetchImpl,
+	signal?: AbortSignal,
 ): Promise<XAIOAuthDiscovery> {
 	const fetchImpl = fetchOverride ?? fetch;
 	let response: Response;
@@ -113,7 +114,7 @@ async function xaiOAuthDiscovery(
 		response = await fetchImpl(XAI_OAUTH_DISCOVERY_URL, {
 			method: "GET",
 			headers: { Accept: "application/json" },
-			signal: AbortSignal.timeout(timeoutMs),
+			signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs),
 		});
 	} catch (error) {
 		throw new AIError.OAuthError(
@@ -482,7 +483,7 @@ async function pollXAIDeviceToken(
 /** Log in to xAI Grok with the RFC 8628 device authorization grant. */
 export async function loginXAIOAuth(ctrl: OAuthController): Promise<OAuthCredentials> {
 	const fetchImpl = ctrl.fetch ?? fetch;
-	const discovery = await xaiOAuthDiscovery(DISCOVERY_TIMEOUT_MS, fetchImpl);
+	const discovery = await xaiOAuthDiscovery(DISCOVERY_TIMEOUT_MS, fetchImpl, ctrl.signal);
 	const device = await requestXAIDeviceAuthorization(fetchImpl, ctrl.signal);
 	ctrl.onAuth?.({
 		url: device.verificationUriComplete,
@@ -503,15 +504,19 @@ export async function loginXAIOAuth(ctrl: OAuthController): Promise<OAuthCredent
  * Refresh an xAI OAuth access token using a stored refresh_token.
  *
  * Re-runs OIDC discovery and re-validates the token endpoint before sending
- * the stored refresh token.
+ * the stored refresh token. Caller cancellation aborts every network request.
  */
-export async function refreshXAIOAuthToken(refreshToken: string, fetchOverride?: FetchImpl): Promise<OAuthCredentials> {
+export async function refreshXAIOAuthToken(
+	refreshToken: string,
+	fetchOverride?: FetchImpl,
+	signal?: AbortSignal,
+): Promise<OAuthCredentials> {
 	const fetchImpl = fetchOverride ?? fetch;
 	if (typeof refreshToken !== "string" || !refreshToken.trim()) {
 		throw new AIError.OAuthError("missing refresh_token", { kind: "validation", provider: "xai" });
 	}
 
-	const discovery = await xaiOAuthDiscovery(DISCOVERY_TIMEOUT_MS, fetchImpl);
+	const discovery = await xaiOAuthDiscovery(DISCOVERY_TIMEOUT_MS, fetchImpl, signal);
 	const tokenEndpoint = validateXAIEndpoint(discovery.token_endpoint, "token_endpoint");
 
 	const body = new URLSearchParams({
@@ -528,7 +533,9 @@ export async function refreshXAIOAuthToken(refreshToken: string, fetchOverride?:
 		},
 		body,
 		redirect: "error",
-		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
+		signal: signal
+			? AbortSignal.any([signal, AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)])
+			: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
 	});
 
 	if (!response.ok) {
@@ -555,5 +562,5 @@ export async function refreshXAIOAuthToken(refreshToken: string, fetchOverride?:
 		);
 	}
 	const credentials = parseXAITokenResponse(payload, "xAI token refresh response", refreshToken);
-	return withXAIOAuthIdentity(credentials, fetchImpl);
+	return withXAIOAuthIdentity(credentials, fetchImpl, signal);
 }

package/src/registry/types.ts

@@ -74,7 +74,8 @@ export interface ProviderDefinition {
 	readonly prepareModelDiscovery?: ProviderModelDiscoveryPreparer;
 	// --- interactive login (OAuthProviderInterface-compatible) ---
 	readonly login?: (callbacks: OAuthLoginCallbacks) => Promise<OAuthCredentials | string>;
-	readonly refreshToken?: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+	/** Refresh a stored grant; the signal bounds provider network work to refresh ownership. */
+	readonly refreshToken?: (credentials: OAuthCredentials, signal?: AbortSignal) => Promise<OAuthCredentials>;
 	readonly getApiKey?: (credentials: OAuthCredentials) => string;
 	/** Store OAuth credentials under a different provider id (e.g. `openai-codex-device` ⇒ `openai-codex`). */
 	readonly storeCredentialsAs?: string;

package/src/registry/xai-oauth.ts

@@ -9,9 +9,9 @@ export const xaiOauthProvider = {
 		const { loginXAIOAuth } = await import("./oauth/xai-oauth");
 		return loginXAIOAuth(cb);
 	},
-	refreshToken: async (credentials: OAuthCredentials) => {
+	refreshToken: async (credentials: OAuthCredentials, signal?: AbortSignal) => {
 		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
 		const { refreshXAIOAuthToken } = await import("./oauth/xai-oauth");
-		return refreshXAIOAuthToken(credentials.refresh);
+		return refreshXAIOAuthToken(credentials.refresh, undefined, signal);
 	},
 } as const satisfies ProviderDefinition;

package/src/stream.ts

@@ -20,7 +20,6 @@ import { getCustomApi } from "./api-registry";
 import { createAuthRetryKeyState, isApiKeyResolver, resolveNextAuthRetryKey } from "./auth-retry";
 import * as AIError from "./error";
 import { ProviderHttpError } from "./error";
-import { isInvalidatedOAuthTokenError } from "./error/auth-classify";
 import { isConcurrencyCapExclusion, isUsageLimitOutcome } from "./error/rate-limit";
 import type { BedrockOptions } from "./providers/amazon-bedrock";
 import type { AnthropicOptions } from "./providers/anthropic";
@@ -1091,6 +1090,7 @@ function isRetryableUpstreamError(
 	status: number | undefined,
 	message: string | undefined,
 ): boolean {
+	if (AIError.isAuthRetryableError(error)) return true;
 	// 401 means the credential is bad; 403 is its valid-token twin (access
 	// denied by plan, model policy, or org restriction — a sibling account may
 	// not share it). Explicit account-scoped policy errors such as Codex
@@ -1107,9 +1107,6 @@ function isRetryableUpstreamError(
 	// classify as RATE_LIMIT_EXCEEDED in `parseRateLimitReason` and stay in the
 	// provider's own backoff layer instead of burning siblings.
 	if (AIError.isCodexChatGPTAccountPolicyError(error, model.provider, model.id)) return true;
-	if (AIError.isAccountPolicyError(error)) return true;
-	if (AIError.isUsageLimit(error)) return true;
-	if (isInvalidatedOAuthTokenError(error)) return true;
 	if (status === 401 || (status === 403 && !isConcurrencyCapExclusion(status, message))) return true;
 	return isUsageLimitOutcome(status, message);
 }
@@ -1926,6 +1923,7 @@ function mapOptionsForApi<TApi extends Api>(
 		codexSseMaxAttempts: options?.codexSseMaxAttempts,
 		providerSessionState: options?.providerSessionState,
 		maxInFlightRequests: options?.maxInFlightRequests,
+		toolNamespacesInfo: options?.toolNamespacesInfo,
 		onPayload: options?.onPayload,
 		onResponse: options?.onResponse,
 		onSseEvent: options?.onSseEvent,
@@ -2311,10 +2309,16 @@ function mapOptionsForApi<TApi extends Api>(
 		case "cursor-agent": {
 			const execHandlers = options?.cursorExecHandlers ?? options?.execHandlers;
 			const onToolResult = options?.cursorOnToolResult ?? execHandlers?.onToolResult;
+			const cursorModel = model as Model<"cursor-agent">;
+			const effort =
+				options?.reasoning && !options.disableReasoning && !options.forceReasoningOff && cursorModel.reasoning
+					? requireSupportedEffort(cursorModel, options.reasoning)
+					: undefined;
 			return castApi<"cursor-agent">({
 				...base,
 				execHandlers,
 				onToolResult,
+				wireModelId: resolveWireModelId(cursorModel, effort),
 			});
 		}