@oh-my-pi/pi-ai 18.0.7 → 18.0.9

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## [Unreleased]
 
+## [18.0.9] - 2026-08-28
+
+### Fixed
+
+- Improved OAuth sign-in flows, including a fallback message when the browser cannot automatically close the OAuth success tab.
+- Fixed Cloudflare AI Gateway onboarding and routing so gateway account and endpoint configuration is preserved correctly while gateway credentials are not sent as upstream OpenAI authorization headers.
+- Fixed Codex OAuth quota handling so chat and Spark usage remain independent, legacy shared quota limits continue to work, and incomplete usage reports are not incorrectly treated as unlimited.
+
+## [18.0.8] - 2026-08-27
+
+### Added
+
+- Added Z.AI GLM Coding Plan usage tracking: credit-based `CREDIT_LIMIT` windows (5h + weekly) now surface in `omp usage` and the status line with the plan tier (`plan: lite/pro/max`).
+
+### Fixed
+
+- Fixed Amazon Bedrock requests to OpenAI-schema models (the `gpt-5.x` SKUs) failing with HTTP 400 `unknown_parameter: 'thinking'` when reasoning was enabled, by sending `reasoning.effort` instead of Anthropic's `thinking` budget block for models the catalog marks as effort-controlled.
+- Fixed Cursor replay rejecting sessions with orphaned tool results while preserving their output as assistant context.
+
 ## [18.0.7] - 2026-08-26
 
 ### Added

package/README.md

@@ -76,7 +76,7 @@ Unified LLM API with automatic model discovery, provider configuration, token an
 - **Qwen Portal** (supports `QWEN_OAUTH_TOKEN` or `QWEN_PORTAL_API_KEY`)
 - **QwenCloud Token Plan** (supports `/login alibaba-token-plan`, `ALIBABA_TOKEN_PLAN_API_KEY`, or `BAILIAN_TOKEN_PLAN_API_KEY`; interactive login first selects a region — International (Singapore, default), China (Beijing) for 百炼 Token Plan keys, or a custom base URL — since region keys are non-interchangeable, then optionally stores a `home.qwencloud.com` Cookie request header for best-effort 5-hour and 7-day quota reporting)
   To enable quota reporting, sign in to the Token Plan dashboard, copy the `Cookie` request-header value from a `home.qwencloud.com` request in browser developer tools, and paste it at the second login prompt. Press Enter to skip; the Cookie is sensitive and session-lived, so rerun login when it expires.
-- **Cloudflare AI Gateway** (requires `CLOUDFLARE_AI_GATEWAY_API_KEY` and provider-specific gateway base URL)
+- **Cloudflare AI Gateway** (supports `/login cloudflare-ai-gateway`, or `CLOUDFLARE_AI_GATEWAY_API_KEY` with `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_GATEWAY_ID`)
 - **Ollama** (local OpenAI-compatible runtime; optional `OLLAMA_API_KEY`)
 - **Ollama Cloud** (hosted native Ollama API; requires `OLLAMA_CLOUD_API_KEY`)
 - **llama.cpp** (local OpenAI and Anthropic compatible inference server)
@@ -960,11 +960,10 @@ In Node.js environments, you can set environment variables to avoid passing API
 | Xiaomi MiMo    | `XIAOMI_API_KEY`                                                             |
 | ZenMux         | `ZENMUX_API_KEY`                                                             |
 | vLLM           | `VLLM_API_KEY`                                                               |
-| Cloudflare AI Gateway | `CLOUDFLARE_AI_GATEWAY_API_KEY`                                      |
+| Cloudflare AI Gateway | `CLOUDFLARE_AI_GATEWAY_API_KEY` + `CLOUDFLARE_ACCOUNT_ID` + `CLOUDFLARE_GATEWAY_ID` |
 | GitHub Copilot | `COPILOT_GITHUB_TOKEN` or `GH_TOKEN` or `GITHUB_TOKEN`                      |
 
-For Cloudflare AI Gateway models, use provider base URL format
-`https://gateway.ai.cloudflare.com/v1/<account>/<gateway>/anthropic`.
+`/login cloudflare-ai-gateway` collects and stores the gateway token, account ID, and gateway ID. For environment configuration, set all three Cloudflare values above. OMP derives provider endpoints from the account and gateway IDs.
 
 For Anthropic Foundry routing, set `CLAUDE_CODE_USE_FOUNDRY=true` plus:
 `FOUNDRY_BASE_URL`, `ANTHROPIC_FOUNDRY_API_KEY`, optional `ANTHROPIC_CUSTOM_HEADERS`,
@@ -996,7 +995,7 @@ Provider endpoint defaults for the current OpenAI-compatible integrations:
 - Ollama: local OpenAI-compatible runtime (`http://127.0.0.1:11434/v1`)
 - Ollama Cloud: native Ollama API host (`https://ollama.com/api`, configured here as base URL `https://ollama.com`)
 - LiteLLM: `http://localhost:4000/v1`
-- Cloudflare AI Gateway: `https://gateway.ai.cloudflare.com/v1/<account>/<gateway>/anthropic`
+- Cloudflare AI Gateway: native Anthropic, OpenAI, and Workers AI routes under `https://gateway.ai.cloudflare.com/v1/<account>/<gateway>`
 - Qwen Portal: `https://portal.qwen.ai/v1`
 When set, the library automatically uses these keys:
 

package/dist/types/auth-storage.d.ts

@@ -821,6 +821,18 @@ export declare class AuthStorage {
      * `XAI_API_KEY` does not auto-select SuperGrok (`xai-oauth`).
      */
     hasAuth(provider: string): boolean;
+    /**
+     * Like {@link hasAuth} but excludes providers whose only credential is the
+     * self-resolving {@link AUTHENTICATED_SENTINEL} — the marker AWS/Vertex
+     * transports return when a credential *source* merely exists (a stray
+     * `~/.aws` profile, an EC2 instance role, Application Default Credentials)
+     * without a usable key resolved yet. Default-model auto-selection uses this
+     * so an ambiently-available provider (e.g. `amazon-bedrock` via an unrelated
+     * AWS profile) does not win the startup default over a provider the user
+     * actually signed into and then 403 on the first turn. Explicit selection
+     * and picker visibility still go through {@link hasAuth}. See issue #9967.
+     */
+    hasConcreteAuth(provider: string): boolean;
     /**
      * Whether a request could resolve a key for this provider, including
      * cross-provider env aliases (`xai-oauth` borrowing `XAI_API_KEY`).

package/dist/types/registry/cloudflare-ai-gateway.d.ts

@@ -1,13 +1,13 @@
-import type { OAuthLoginCallbacks } from "./oauth/types.js";
-/**
- * Login to Cloudflare AI Gateway.
- *
- * Opens browser to Cloudflare AI Gateway authentication docs and prompts for a gateway token/API key.
- * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
- */
-export declare const loginCloudflareAiGateway: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
+/** Collect the gateway credential used by CLI, setup-wizard, and TUI login callers. */
+export declare function loginCloudflareAiGateway(options: OAuthController): Promise<string>;
 export declare const cloudflareAiGatewayProvider: {
     readonly id: "cloudflare-ai-gateway";
     readonly name: "Cloudflare AI Gateway";
+    readonly prepareModel: (model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>) => import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>;
+    readonly prepareRequest: (model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>, options: import("../index.js").StreamOptions) => {
+        model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>;
+        options: import("../index.js").StreamOptions;
+    };
     readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
 };

package/dist/types/registry/registry.d.ts

@@ -72,6 +72,11 @@ declare const ALL: ({
 } | {
     readonly id: "cloudflare-ai-gateway";
     readonly name: "Cloudflare AI Gateway";
+    readonly prepareModel: (model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>) => import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>;
+    readonly prepareRequest: (model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>, options: import("../index.js").StreamOptions) => {
+        model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>;
+        options: import("../index.js").StreamOptions;
+    };
     readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
 } | {
     readonly id: "coreweave";

package/dist/types/registry/types.d.ts

@@ -24,6 +24,7 @@ export interface PreparedProviderRequest {
     readonly options: StreamOptions;
 }
 export type ProviderRequestPreparer = (model: Model<Api>, options: StreamOptions) => PreparedProviderRequest;
+export type ProviderModelPreparer = (model: Model<Api>) => Model<Api>;
 export type ProviderSimpleOptionsMapper = (options: SimpleStreamOptions) => Readonly<Record<string, unknown>>;
 export interface ProviderModelDiscoveryConfig {
     readonly apiKey?: string;
@@ -57,6 +58,8 @@ export interface ProviderDefinition {
     readonly envKeys?: KeyResolver;
     /** Provider transport can authenticate without a resolved API-key string. */
     readonly allowsMissingApiKey?: boolean;
+    /** Provider-owned model normalization that must run before API-specific option mapping. */
+    readonly prepareModel?: ProviderModelPreparer;
     /** Provider-owned request shaping applied before generic API dispatch. */
     readonly prepareRequest?: ProviderRequestPreparer;
     /** Provider-owned projection from the generic simple-stream option bag. */

package/dist/types/types.d.ts

@@ -698,6 +698,10 @@ export interface DeveloperMessage {
     content: string | (TextContent | ImageContent)[];
     /** Who initiated this message for billing/attribution semantics. */
     attribution?: MessageAttribution;
+    /** True if the message was injected by the system (e.g., auto-continue) and initiates a fresh run rather than continuing the current one. */
+    synthetic?: boolean;
+    /** True when the synthetic prompt was a deliberate operator action (`.`, `c` continue shortcut) rather than an automatic continuation — its timestamp is the turn's prompt time. */
+    userInitiated?: boolean;
     /** Provider-specific opaque payload used to reconstruct transport-native history. */
     providerPayload?: ProviderPayload;
     timestamp: number;
@@ -781,6 +785,8 @@ export interface AssistantMessage {
     timestamp: number;
     duration?: number;
     ttft?: number;
+    /** Local wall-clock time the response finished streaming (ms since epoch); stamped by the session at message_end so prompt→yield timing never depends on provider-reported duration. */
+    completedAt?: number;
 }
 export interface ToolResultMessage<TDetails = unknown> {
     role: "toolResult";

package/dist/types/usage/google-antigravity.d.ts

@@ -1,5 +1,16 @@
-import type { CredentialRankingStrategy, UsageProvider } from "../usage.js";
+import type { CredentialRankingContext, CredentialRankingStrategy, UsageLimit, UsageProvider, UsageReport } from "../usage.js";
 export declare const antigravityUsageProvider: UsageProvider;
+/** Map an Antigravity model id to its backend quota-counter key. */
+export declare function getAntigravityCounterKeyForModel(modelId: string | undefined): string | undefined;
+/**
+ * Scope an Antigravity report to the active model's backend counter, falling
+ * back to legacy default counters only when that backend has no limits.
+ *
+ * Exhaustion checks are only safe with a concrete backend counter. A no-model
+ * credential lookup (for example image-provider discovery) must not turn one
+ * exhausted family into a provider-wide block.
+ */
+export declare function scopeAntigravityLimitsForModel(report: UsageReport, context: CredentialRankingContext | undefined): UsageLimit[];
 /**
  * Antigravity quotas are returned per backend counter (Anthropic / Google /
  * OpenAI) and can include both daily and weekly windows. `fetchAntigravityUsage`

package/dist/types/usage.d.ts

@@ -1,5 +1,5 @@
 import type { FetchImpl, Provider } from "./types.js";
-export type UsageUnit = "percent" | "tokens" | "requests" | "usd" | "minutes" | "bytes" | "unknown";
+export type UsageUnit = "percent" | "tokens" | "requests" | "credits" | "usd" | "minutes" | "bytes" | "unknown";
 export type UsageStatus = "ok" | "warning" | "exhausted" | "unknown";
 /** Time window for a limit (e.g. 5h, 7d, monthly). */
 export interface UsageWindow {
@@ -204,7 +204,7 @@ export interface ClientUsageClientSummary {
 export interface ClientUsageSummary {
     clients: ClientUsageClientSummary[];
 }
-export declare const usageUnitSchema: import("@oh-my-pi/omptype").FluentType<"bytes" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd", "bytes" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd">;
+export declare const usageUnitSchema: import("@oh-my-pi/omptype").FluentType<"bytes" | "credits" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd", "bytes" | "credits" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd">;
 export declare const usageStatusSchema: import("@oh-my-pi/omptype").FluentType<"exhausted" | "ok" | "unknown" | "warning", "exhausted" | "ok" | "unknown" | "warning">;
 export declare const usageWindowSchema: import("@oh-my-pi/omptype").FluentType<{
     durationMs?: number | undefined;
@@ -223,14 +223,14 @@ export declare const usageAmountSchema: import("@oh-my-pi/omptype").FluentType<{
     limit?: number | undefined;
     remaining?: number | undefined;
     remainingFraction?: number | undefined;
-    unit: "bytes" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd";
+    unit: "bytes" | "credits" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd";
     used?: number | undefined;
     usedFraction?: number | undefined;
 }, {
     limit?: number | undefined;
     remaining?: number | undefined;
     remainingFraction?: number | undefined;
-    unit: "bytes" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd";
+    unit: "bytes" | "credits" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd";
     used?: number | undefined;
     usedFraction?: number | undefined;
 }>;
@@ -258,7 +258,7 @@ export declare const usageLimitSchema: import("@oh-my-pi/omptype").FluentType<{
         limit?: number | undefined;
         remaining?: number | undefined;
         remainingFraction?: number | undefined;
-        unit: "bytes" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd";
+        unit: "bytes" | "credits" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd";
         used?: number | undefined;
         usedFraction?: number | undefined;
     };
@@ -288,7 +288,7 @@ export declare const usageLimitSchema: import("@oh-my-pi/omptype").FluentType<{
         limit?: number | undefined;
         remaining?: number | undefined;
         remainingFraction?: number | undefined;
-        unit: "bytes" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd";
+        unit: "bytes" | "credits" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd";
         used?: number | undefined;
         usedFraction?: number | undefined;
     };
@@ -345,7 +345,7 @@ export declare const usageReportSchema: import("@oh-my-pi/omptype").FluentType<{
             limit?: number | undefined;
             remaining?: number | undefined;
             remainingFraction?: number | undefined;
-            unit: "bytes" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd";
+            unit: "bytes" | "credits" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd";
             used?: number | undefined;
             usedFraction?: number | undefined;
         };
@@ -390,7 +390,7 @@ export declare const usageReportSchema: import("@oh-my-pi/omptype").FluentType<{
             limit?: number | undefined;
             remaining?: number | undefined;
             remainingFraction?: number | undefined;
-            unit: "bytes" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd";
+            unit: "bytes" | "credits" | "minutes" | "percent" | "requests" | "tokens" | "unknown" | "usd";
             used?: number | undefined;
             usedFraction?: number | undefined;
         };
@@ -528,6 +528,10 @@ export interface CredentialRankingStrategy {
         primaryMs: number;
         secondaryMs: number;
     };
-    /** Optional: priority boost for specific credential states (e.g., fresh 5h ticker start). */
-    hasPriorityBoost?(primary: UsageLimit | undefined): boolean;
+    /**
+     * Optional: priority boost for specific credential states (e.g., fresh 5h
+     * ticker start). `primaryUncapped` is true only when the fetched report has
+     * an applicable secondary window but no applicable primary window.
+     */
+    hasPriorityBoost?(primary: UsageLimit | undefined, primaryUncapped?: boolean, context?: CredentialRankingContext): boolean;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.0.7",
+	"version": "18.0.9",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Stencil Labs, Inc.",
@@ -37,10 +37,10 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.0.7",
-		"@oh-my-pi/pi-catalog": "18.0.7",
-		"@oh-my-pi/pi-utils": "18.0.7",
-		"@oh-my-pi/pi-wire": "18.0.7"
+		"@oh-my-pi/omptype": "18.0.9",
+		"@oh-my-pi/pi-catalog": "18.0.9",
+		"@oh-my-pi/pi-utils": "18.0.9",
+		"@oh-my-pi/pi-wire": "18.0.9"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/auth/sqlite-credential-store.ts

@@ -8,6 +8,7 @@ import { Database, type Statement } from "bun:sqlite";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { parseAlibabaTokenPlanCredential } from "@oh-my-pi/pi-catalog/wire/alibaba-token-plan";
+import { parseCloudflareAiGatewayCredential } from "@oh-my-pi/pi-catalog/wire/cloudflare-ai-gateway";
 import {
 	getAgentDbPath,
 	getDbBusyTimeoutMs,
@@ -215,10 +216,17 @@ function matchesReplacementCredential(
 	if (incoming.type === "api_key") {
 		if (existing.type !== "api_key") return false;
 		if (existing.key === incoming.key) return true;
-		if (provider !== "alibaba-token-plan") return false;
-		const existingToken = parseAlibabaTokenPlanCredential(existing.key)?.token;
-		const incomingToken = parseAlibabaTokenPlanCredential(incoming.key)?.token;
-		return existingToken !== undefined && existingToken === incomingToken;
+		if (provider === "alibaba-token-plan") {
+			const existingToken = parseAlibabaTokenPlanCredential(existing.key)?.token;
+			const incomingToken = parseAlibabaTokenPlanCredential(incoming.key)?.token;
+			return existingToken !== undefined && existingToken === incomingToken;
+		}
+		if (provider === "cloudflare-ai-gateway") {
+			const existingToken = parseCloudflareAiGatewayCredential(existing.key)?.token;
+			const incomingToken = parseCloudflareAiGatewayCredential(incoming.key)?.token;
+			return existingToken !== undefined && existingToken === incomingToken;
+		}
+		return false;
 	}
 	const incomingIdentifiers = extractOAuthCredentialIdentifiers(incoming);
 	const incomingIdentityKey = resolveProviderCredentialIdentityKey(provider, incomingIdentifiers);

package/src/auth-broker/wire-schemas.ts

@@ -208,7 +208,7 @@ const usageAmountSchema = type({
 	"remaining?": "number",
 	"usedFraction?": "number",
 	"remainingFraction?": "number",
-	unit: "'percent' | 'tokens' | 'requests' | 'usd' | 'minutes' | 'bytes' | 'unknown'",
+	unit: "'percent' | 'tokens' | 'requests' | 'credits' | 'usd' | 'minutes' | 'bytes' | 'unknown'",
 });
 
 const usageScopeSchema = type({

package/src/auth-storage.ts

@@ -28,6 +28,7 @@ import type {
 	OAuthProvider,
 	OAuthProviderId,
 } from "./registry/oauth/types";
+import { AUTHENTICATED_SENTINEL } from "./registry/types";
 import { getEnvApiKey, getEnvApiKeyName } from "./stream";
 import type { Provider } from "./types";
 import type {
@@ -1272,6 +1273,7 @@ type UsageRankedCandidate<T extends AuthCredential> = UsageCandidate<T> & {
 	blocked: boolean;
 	blockedUntil?: number;
 	hasPriorityBoost: boolean;
+	usageMeasured: boolean;
 	planPriority: number;
 	secondaryUsed: number;
 	secondaryRequiredDrain: number;
@@ -2168,13 +2170,16 @@ export class AuthStorage {
 			const windows = usage ? strategy.findWindowLimits(usage, args.rankingContext) : undefined;
 			const primary = windows?.primary;
 			const secondary = windows?.secondary;
+			const usageMeasured = primary !== undefined || secondary !== undefined;
+			const primaryUncapped = primary === undefined && secondary !== undefined;
 			ranked.push({
 				selection,
 				usage,
 				usageChecked,
 				blocked,
 				blockedUntil,
-				hasPriorityBoost: strategy.hasPriorityBoost?.(primary) ?? false,
+				usageMeasured,
+				hasPriorityBoost: strategy.hasPriorityBoost?.(primary, primaryUncapped, args.rankingContext) ?? false,
 				planPriority: 0,
 				secondaryUsed: this.#normalizeUsageFraction(secondary),
 				secondaryRequiredDrain: this.#computeWindowRequiredDrain(
@@ -2748,6 +2753,34 @@ export class AuthStorage {
 		return false;
 	}
 
+	/**
+	 * Like {@link hasAuth} but excludes providers whose only credential is the
+	 * self-resolving {@link AUTHENTICATED_SENTINEL} — the marker AWS/Vertex
+	 * transports return when a credential *source* merely exists (a stray
+	 * `~/.aws` profile, an EC2 instance role, Application Default Credentials)
+	 * without a usable key resolved yet. Default-model auto-selection uses this
+	 * so an ambiently-available provider (e.g. `amazon-bedrock` via an unrelated
+	 * AWS profile) does not win the startup default over a provider the user
+	 * actually signed into and then 403 on the first turn. Explicit selection
+	 * and picker visibility still go through {@link hasAuth}. See issue #9967.
+	 */
+	hasConcreteAuth(provider: string): boolean {
+		if (this.#runtimeOverrides.has(provider)) return true;
+		if (this.#configOverrides.has(provider)) return true;
+		if (this.#getCredentialsForProvider(provider).length > 0) return true;
+		if ((provider === "amazon-bedrock" || provider === "bedrock-mantle") && $env.AWS_BEARER_TOKEN_BEDROCK?.trim()) {
+			return true;
+		}
+		if (provider === "xai-oauth") {
+			if ($env.XAI_OAUTH_TOKEN?.trim()) return true;
+		} else {
+			const envApiKey = getEnvApiKey(provider);
+			if (envApiKey !== undefined && envApiKey !== AUTHENTICATED_SENTINEL) return true;
+		}
+		const fallback = this.#fallbackResolver?.(provider);
+		return fallback !== undefined && fallback !== AUTHENTICATED_SENTINEL;
+	}
+
 	/**
 	 * Whether a request could resolve a key for this provider, including
 	 * cross-provider env aliases (`xai-oauth` borrowing `XAI_API_KEY`).
@@ -4633,8 +4666,8 @@ export class AuthStorage {
 		// scores are only comparable between measured windows, and the
 		// clockless headroom fallback (0..1) must not let an account whose
 		// usage fetch failed shadow a measured sibling.
-		const leftMeasured = left.usage !== null;
-		const rightMeasured = right.usage !== null;
+		const leftMeasured = left.usageMeasured;
+		const rightMeasured = right.usageMeasured;
 		if (leftMeasured !== rightMeasured) return leftMeasured ? -1 : 1;
 		// Required drain, descending: the account whose remaining quota must
 		// burn fastest to avoid expiring unused at its reset comes first, so
@@ -4769,13 +4802,16 @@ export class AuthStorage {
 			const windows = usage ? strategy.findWindowLimits(usage, args.rankingContext) : undefined;
 			const primary = windows?.primary;
 			const secondary = windows?.secondary;
+			const usageMeasured = primary !== undefined || secondary !== undefined;
+			const primaryUncapped = primary === undefined && secondary !== undefined;
 			ranked.push({
 				selection,
 				usage,
 				usageChecked,
 				blocked,
 				blockedUntil,
-				hasPriorityBoost: strategy.hasPriorityBoost?.(primary) ?? false,
+				usageMeasured,
+				hasPriorityBoost: strategy.hasPriorityBoost?.(primary, primaryUncapped, args.rankingContext) ?? false,
 				planPriority: getOpenAICodexPlanPriority(usage, args.planRequirement),
 				secondaryUsed: this.#normalizeUsageFraction(secondary),
 				secondaryRequiredDrain: this.#computeWindowRequiredDrain(

package/src/providers/amazon-bedrock.ts

@@ -1089,6 +1089,15 @@ function buildAdditionalModelRequestFields(
 		};
 	}
 
+	if (mode === "effort") {
+		// OpenAI-schema models on Bedrock (the GPT-5.x SKUs) reject the
+		// Anthropic budget block with `unknown_parameter: 'thinking'` and take
+		// `reasoning.effort` instead — same effort vocabulary the catalog
+		// already bakes (low/medium/high/xhigh/max).
+		const level = requireSupportedEffort(model, reasoning);
+		return { reasoning: { effort: model.thinking?.effortMap?.[level] ?? level } };
+	}
+
 	const level = requireSupportedEffort(model, reasoning);
 	const defaultBudgets: Record<Effort, number> = {
 		minimal: 1024,

package/src/providers/cursor.ts

@@ -4844,6 +4844,27 @@ export function buildCursorSystemPromptJsons(systemPrompt: readonly string[] | u
 	return systemPrompts.map(content => JSON.stringify({ role: "system", content }));
 }
 
+function collectCursorToolHistory(messages: Message[], historyEnd: number) {
+	const toolResults = new Map<string, ToolResultMessage>();
+	const pairedToolCallIds = new Set<string>();
+	for (let index = 0; index < historyEnd; index++) {
+		const message = messages[index];
+		if (message.role === "toolResult") {
+			toolResults.set(message.toolCallId, message);
+		} else if (message.role === "assistant") {
+			for (const item of message.content) {
+				if (item.type === "toolCall") pairedToolCallIds.add(item.id);
+			}
+		}
+	}
+	return { toolResults, pairedToolCallIds };
+}
+
+function cursorOrphanToolResultText(result: ToolResultMessage): string {
+	const prefix = result.isError ? "[Tool Error]" : "[Tool Result]";
+	return `${prefix}\n${toolResultToText(result) || "(empty result)"}`;
+}
+
 function buildRootPromptMessagesJson(
 	messages: Message[],
 	systemPromptIds: Uint8Array[],
@@ -4852,6 +4873,8 @@ function buildRootPromptMessagesJson(
 	targetModelId?: string,
 ): Uint8Array[] {
 	assertCursorKimiK3HistoryReplayable(messages, activeUserMessageIndex, targetModelId);
+	const historyEnd = activeUserMessageIndex >= 0 ? activeUserMessageIndex : messages.length;
+	const { pairedToolCallIds } = collectCursorToolHistory(messages, historyEnd);
 	const entries: Uint8Array[] = [...systemPromptIds];
 	const pushJson = (obj: unknown) => {
 		const bytes = new TextEncoder().encode(JSON.stringify(obj));
@@ -4870,6 +4893,13 @@ function buildRootPromptMessagesJson(
 			if (content.length === 0) continue;
 			pushJson({ role: "assistant", content });
 		} else if (msg.role === "toolResult") {
+			if (!pairedToolCallIds.has(msg.toolCallId)) {
+				pushJson({
+					role: "assistant",
+					content: [{ type: "text", text: cursorOrphanToolResultText(msg) }],
+				});
+				continue;
+			}
 			// Emit even when the result text is empty: the assistant `tool-call` is
 			// already in history, so dropping the pair would replay an orphaned call.
 			const toolCallId = normalizeToolCallId(msg.toolCallId);
@@ -5008,18 +5038,7 @@ function buildConversationTurns(
 ): Uint8Array[] {
 	const turns: Uint8Array[] = [];
 	const historyEnd = activeUserMessageIndex >= 0 ? activeUserMessageIndex : messages.length;
-	const toolResults = new Map<string, ToolResultMessage>();
-	const pairedToolCallIds = new Set<string>();
-	for (let index = 0; index < historyEnd; index++) {
-		const message = messages[index];
-		if (message.role === "toolResult") {
-			toolResults.set(message.toolCallId, message);
-		} else if (message.role === "assistant") {
-			for (const item of message.content) {
-				if (item.type === "toolCall") pairedToolCallIds.add(item.id);
-			}
-		}
-	}
+	const { toolResults, pairedToolCallIds } = collectCursorToolHistory(messages, historyEnd);
 
 	let i = 0;
 	while (i < messages.length) {
@@ -5077,17 +5096,13 @@ function buildConversationTurns(
 					stepBlobIds.push(storeCursorBlob(blobStore, toBinary(ConversationStepSchema, step)));
 				}
 			} else if (stepMsg.role === "toolResult" && !pairedToolCallIds.has(stepMsg.toolCallId)) {
-				const text = toolResultToText(stepMsg);
-				if (text) {
-					const prefix = stepMsg.isError ? "[Tool Error]" : "[Tool Result]";
-					const step = create(ConversationStepSchema, {
-						message: {
-							case: "assistantMessage",
-							value: create(AssistantMessageSchema, { text: `${prefix}\n${text}` }),
-						},
-					});
-					stepBlobIds.push(storeCursorBlob(blobStore, toBinary(ConversationStepSchema, step)));
-				}
+				const step = create(ConversationStepSchema, {
+					message: {
+						case: "assistantMessage",
+						value: create(AssistantMessageSchema, { text: cursorOrphanToolResultText(stepMsg) }),
+					},
+				});
+				stepBlobIds.push(storeCursorBlob(blobStore, toBinary(ConversationStepSchema, step)));
 			}
 			i++;
 		}

package/src/registry/cloudflare-ai-gateway.ts

@@ -1,26 +1,130 @@
-import { createApiKeyLogin } from "./api-key-login";
-import type { OAuthLoginCallbacks } from "./oauth/types";
+import { buildModel } from "@oh-my-pi/pi-catalog/build";
+import {
+	CLOUDFLARE_AI_GATEWAY_ANTHROPIC_BASE_URL,
+	CLOUDFLARE_AI_GATEWAY_BASE_URL,
+	CLOUDFLARE_AI_GATEWAY_COMPAT_BASE_URL,
+	CLOUDFLARE_AI_GATEWAY_OPENAI_BASE_URL,
+	parseCloudflareAiGatewayCredential,
+	serializeCloudflareAiGatewayCredential,
+} from "@oh-my-pi/pi-catalog/wire/cloudflare-ai-gateway";
+import { $env } from "@oh-my-pi/pi-utils";
+import * as AIError from "../error";
+import { NO_AUTH_SENTINEL } from "../providers/openai-shared";
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
 import type { ProviderDefinition } from "./types";
 
 const AUTH_URL = "https://developers.cloudflare.com/ai-gateway/configuration/authentication/";
 
-/**
- * Login to Cloudflare AI Gateway.
- *
- * Opens browser to Cloudflare AI Gateway authentication docs and prompts for a gateway token/API key.
- * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
- */
-export const loginCloudflareAiGateway = createApiKeyLogin({
-	providerLabel: "Cloudflare AI Gateway",
-	authUrl: AUTH_URL,
-	instructions: "Copy your Cloudflare AI Gateway token/API key. Configure account/gateway base URL in models config.",
-	promptMessage: "Paste your Cloudflare AI Gateway token/API key",
-	placeholder: "cf-aig-...",
-	validation: null,
-});
+/** Collect the gateway credential used by CLI, setup-wizard, and TUI login callers. */
+export async function loginCloudflareAiGateway(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new AIError.OnPromptRequiredError("Cloudflare AI Gateway");
+	}
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: "Create an AI Gateway token with Run permission, then copy it here.",
+	});
+
+	const apiKey = await options.onPrompt({
+		message: "Paste your Cloudflare AI Gateway token/API key",
+		placeholder: "cfut_...",
+	});
+	if (options.signal?.aborted) throw new AIError.LoginCancelledError();
+	if (!apiKey.trim()) throw new AIError.ApiKeyRequiredError();
+
+	const accountId = await options.onPrompt({
+		message: "Enter your Cloudflare account ID",
+		placeholder: "32-character account ID",
+	});
+	if (options.signal?.aborted) throw new AIError.LoginCancelledError();
+	if (!accountId.trim()) throw new AIError.ConfigurationError("Cloudflare account ID is required");
+
+	const gatewayId = await options.onPrompt({
+		message: "Enter your Cloudflare AI Gateway ID",
+		placeholder: "default",
+	});
+	if (options.signal?.aborted) throw new AIError.LoginCancelledError();
+	if (!gatewayId.trim()) throw new AIError.ConfigurationError("Cloudflare AI Gateway ID is required");
+
+	return serializeCloudflareAiGatewayCredential(apiKey, accountId, gatewayId);
+}
 
 export const cloudflareAiGatewayProvider = {
 	id: "cloudflare-ai-gateway",
 	name: "Cloudflare AI Gateway",
+	prepareModel: model => {
+		const hasGatewayPlaceholders = model.baseUrl.includes("<account>") || model.baseUrl.includes("<gateway>");
+		if (model.id.startsWith("anthropic/")) {
+			const requestModelId = model.id.slice("anthropic/".length).replaceAll(".", "-");
+			const baseUrl = hasGatewayPlaceholders ? CLOUDFLARE_AI_GATEWAY_ANTHROPIC_BASE_URL : model.baseUrl;
+			if (
+				model.api === "anthropic-messages" &&
+				model.baseUrl === baseUrl &&
+				model.requestModelId === requestModelId
+			) {
+				return model;
+			}
+			return {
+				...model,
+				api: "anthropic-messages",
+				baseUrl,
+				requestModelId,
+			};
+		}
+		if (model.id.startsWith("openai/")) {
+			const requestModelId = model.id.slice("openai/".length);
+			const baseUrl = hasGatewayPlaceholders ? CLOUDFLARE_AI_GATEWAY_OPENAI_BASE_URL : model.baseUrl;
+			if (model.api === "openai-responses" && model.baseUrl === baseUrl && model.requestModelId === requestModelId) {
+				return model;
+			}
+			return buildModel({
+				...model,
+				api: "openai-responses",
+				baseUrl,
+				compat: model.compatConfig,
+				requestModelId,
+			});
+		}
+		if (model.id.startsWith("workers-ai/")) {
+			const baseUrl = hasGatewayPlaceholders ? CLOUDFLARE_AI_GATEWAY_COMPAT_BASE_URL : model.baseUrl;
+			if (model.api === "openai-completions" && model.baseUrl === baseUrl) {
+				return model;
+			}
+			return buildModel({
+				...model,
+				api: "openai-completions",
+				baseUrl,
+				compat: model.compatConfig,
+			});
+		}
+		return model;
+	},
+	prepareRequest: (model, options) => {
+		const credential = parseCloudflareAiGatewayCredential(options.apiKey ?? $env.CLOUDFLARE_AI_GATEWAY_API_KEY ?? "");
+		if (!credential) return { model, options };
+		const accountId = credential.accountId ?? $env.CLOUDFLARE_ACCOUNT_ID;
+		const gatewayId = credential.gatewayId ?? $env.CLOUDFLARE_GATEWAY_ID;
+		let baseUrl = model.baseUrl;
+		if (baseUrl.startsWith(CLOUDFLARE_AI_GATEWAY_BASE_URL)) {
+			if (!accountId) throw new AIError.ConfigurationError("Cloudflare account ID is required");
+			if (!gatewayId) throw new AIError.ConfigurationError("Cloudflare AI Gateway ID is required");
+			baseUrl = baseUrl.replace("<account>", accountId).replace("<gateway>", gatewayId);
+		}
+
+		const isAnthropic = model.api === "anthropic-messages";
+		let headers = model.headers;
+		if (!isAnthropic) {
+			headers = { ...headers };
+			for (const name in headers) {
+				const normalized = name.toLowerCase();
+				if (normalized === "authorization" || normalized === "x-api-key") delete headers[name];
+			}
+			headers["cf-aig-authorization"] = `Bearer ${credential.token}`;
+		}
+		return {
+			model: { ...model, baseUrl, headers },
+			options: { ...options, apiKey: isAnthropic ? credential.token : NO_AUTH_SENTINEL },
+		};
+	},
 	login: (cb: OAuthLoginCallbacks) => loginCloudflareAiGateway(cb),
 } as const satisfies ProviderDefinition;

package/src/registry/oauth/oauth.html

@@ -303,10 +303,16 @@
 			const message = document.getElementById("message");
 
 			if (serverState.ok) {
+				const closeButton = document.querySelector(".btn");
 				app.classList.add("success", "countdown");
 				title.textContent = "Authentication Successful";
-				message.innerHTML = "You have successfully logged in.<br>You can now close this tab.";
-				setTimeout(() => window.close(), 3000);
+				message.textContent = "You have successfully logged in.";
+				window.close();
+				setTimeout(() => {
+					app.classList.remove("countdown");
+					closeButton.remove();
+					message.innerHTML = "You have successfully logged in.<br>Please close this tab manually.";
+				}, 300);
 			} else {
 				app.classList.add("error");
 				title.textContent = "Authentication Failed";

package/src/registry/types.ts

@@ -29,6 +29,7 @@ export interface PreparedProviderRequest {
 }
 
 export type ProviderRequestPreparer = (model: Model<Api>, options: StreamOptions) => PreparedProviderRequest;
+export type ProviderModelPreparer = (model: Model<Api>) => Model<Api>;
 export type ProviderSimpleOptionsMapper = (options: SimpleStreamOptions) => Readonly<Record<string, unknown>>;
 
 export interface ProviderModelDiscoveryConfig {
@@ -66,6 +67,8 @@ export interface ProviderDefinition {
 	readonly envKeys?: KeyResolver;
 	/** Provider transport can authenticate without a resolved API-key string. */
 	readonly allowsMissingApiKey?: boolean;
+	/** Provider-owned model normalization that must run before API-specific option mapping. */
+	readonly prepareModel?: ProviderModelPreparer;
 	/** Provider-owned request shaping applied before generic API dispatch. */
 	readonly prepareRequest?: ProviderRequestPreparer;
 	/** Provider-owned projection from the generic simple-stream option bag. */

package/src/stream.ts

@@ -939,9 +939,10 @@ function streamDispatch<TApi extends Api>(
 		return streamBedrock(model as Model<"bedrock-converse-stream">, context, requestOptions as BedrockOptions);
 	}
 
-	const prepareRequest = getProviderDefinition(model.provider)?.prepareRequest;
-	const prepared = prepareRequest?.(model as Model<Api>, requestOptions as StreamOptions);
-	const providerModel = prepared?.model ?? (model as Model<Api>);
+	const providerDefinition = getProviderDefinition(model.provider);
+	const requestModel = providerDefinition?.prepareModel?.(model) ?? model;
+	const prepared = providerDefinition?.prepareRequest?.(requestModel, requestOptions as StreamOptions);
+	const providerModel = prepared?.model ?? requestModel;
 	const preparedOptions = prepared?.options ?? (requestOptions as StreamOptions);
 	const apiKey = preparedOptions.apiKey || getEnvApiKey(providerModel.provider);
 	if (!apiKey) {
@@ -1691,8 +1692,9 @@ function streamSimpleRequest<TApi extends Api>(
 			),
 		);
 	}
-	const providerOptions = mapOptionsForApi(model, requestOptions, apiKey);
-	return stream(model, context, providerOptions);
+	const providerModel = getProviderDefinition(model.provider)?.prepareModel?.(model) ?? model;
+	const providerOptions = mapOptionsForApi(providerModel, requestOptions, apiKey);
+	return stream(providerModel, context, providerOptions);
 }
 
 export async function completeSimple<TApi extends Api>(
@@ -2080,8 +2082,8 @@ function mapOptionsForApi<TApi extends Api>(
 				guardrailVersion: model.guardrailVersion ?? options?.guardrailVersion,
 				guardrailTrace: model.guardrailTrace ?? options?.guardrailTrace,
 			};
-			// Adaptive mode sends effort directly, no budget_tokens — skip budget inflation.
-			if (model.thinking?.mode === "anthropic-adaptive") {
+			// Effort modes send effort directly, no budget_tokens — skip budget inflation.
+			if (model.thinking?.mode === "effort" || model.thinking?.mode === "anthropic-adaptive") {
 				return castApi<"bedrock-converse-stream">(bedrockBase);
 			}
 			const budgetInfo = resolveBedrockThinkingBudget(model as Model<"bedrock-converse-stream">, options);

package/src/types.ts

@@ -879,6 +879,10 @@ export interface DeveloperMessage {
 	content: string | (TextContent | ImageContent)[];
 	/** Who initiated this message for billing/attribution semantics. */
 	attribution?: MessageAttribution;
+	/** True if the message was injected by the system (e.g., auto-continue) and initiates a fresh run rather than continuing the current one. */
+	synthetic?: boolean;
+	/** True when the synthetic prompt was a deliberate operator action (`.`, `c` continue shortcut) rather than an automatic continuation — its timestamp is the turn's prompt time. */
+	userInitiated?: boolean;
 	/** Provider-specific opaque payload used to reconstruct transport-native history. */
 	providerPayload?: ProviderPayload;
 	timestamp: number; // Unix timestamp in milliseconds
@@ -976,6 +980,8 @@ export interface AssistantMessage {
 	timestamp: number; // Unix timestamp in milliseconds
 	duration?: number; // Request duration in milliseconds
 	ttft?: number; // Time to first token in milliseconds
+	/** Local wall-clock time the response finished streaming (ms since epoch); stamped by the session at message_end so prompt→yield timing never depends on provider-reported duration. */
+	completedAt?: number;
 }
 
 export interface ToolResultMessage<TDetails = unknown> {

package/src/usage/google-antigravity.ts

@@ -426,12 +426,19 @@ export const antigravityUsageProvider: UsageProvider = {
 	supports: params => params.provider === "google-antigravity",
 };
 
-function getAntigravityCounterKeyForModel(context: CredentialRankingContext | undefined): string | undefined {
-	const modelId = context?.modelId?.toLowerCase();
-	if (!modelId) return undefined;
-	if (modelId.startsWith("claude-")) return "anthropic";
-	if (modelId.startsWith("gemini-") || modelId.startsWith("gemma-")) return "google";
-	if (modelId.startsWith("gpt-") || modelId.startsWith("openai/")) return "openai";
+/** Map an Antigravity model id to its backend quota-counter key. */
+export function getAntigravityCounterKeyForModel(modelId: string | undefined): string | undefined {
+	const normalizedModelId = modelId?.toLowerCase();
+	if (!normalizedModelId) return undefined;
+	if (normalizedModelId.startsWith("claude-")) return "anthropic";
+	if (
+		normalizedModelId.startsWith("gemini-") ||
+		normalizedModelId.startsWith("gemma-") ||
+		normalizedModelId.startsWith("tab_")
+	) {
+		return "google";
+	}
+	if (normalizedModelId.startsWith("gpt-") || normalizedModelId.startsWith("openai/")) return "openai";
 	return undefined;
 }
 
@@ -440,14 +447,19 @@ function getAntigravityCounterLimits(report: UsageReport, counterKey: string): U
 	return report.limits.filter(limit => limit.id.toLowerCase().startsWith(prefix));
 }
 
-// Exhaustion checks are only safe with a concrete backend counter. A no-model
-// Antigravity credential lookup (for example image-provider discovery) must
-// not turn one exhausted family into a provider-wide block.
-function scopeAntigravityLimitsForModel(
+/**
+ * Scope an Antigravity report to the active model's backend counter, falling
+ * back to legacy default counters only when that backend has no limits.
+ *
+ * Exhaustion checks are only safe with a concrete backend counter. A no-model
+ * credential lookup (for example image-provider discovery) must not turn one
+ * exhausted family into a provider-wide block.
+ */
+export function scopeAntigravityLimitsForModel(
 	report: UsageReport,
 	context: CredentialRankingContext | undefined,
 ): UsageLimit[] {
-	const counterKey = getAntigravityCounterKeyForModel(context);
+	const counterKey = getAntigravityCounterKeyForModel(context?.modelId);
 	if (!counterKey) return [];
 	const backendLimits = getAntigravityCounterLimits(report, counterKey);
 	if (backendLimits.length > 0) return backendLimits;
@@ -455,7 +467,7 @@ function scopeAntigravityLimitsForModel(
 }
 
 function rankAntigravityLimits(report: UsageReport, context: CredentialRankingContext | undefined): UsageLimit[] {
-	const counterKey = getAntigravityCounterKeyForModel(context);
+	const counterKey = getAntigravityCounterKeyForModel(context?.modelId);
 	if (!counterKey) return report.limits;
 	return scopeAntigravityLimitsForModel(report, context);
 }
@@ -480,7 +492,7 @@ export const antigravityRankingStrategy: CredentialRankingStrategy = {
 	// Always return a scope for Antigravity so missing/unknown model context
 	// cannot fall through to AuthStorage's provider-wide block bucket.
 	blockScope(context) {
-		const counterKey = getAntigravityCounterKeyForModel(context);
+		const counterKey = getAntigravityCounterKeyForModel(context?.modelId);
 		return `counter:${counterKey ?? "unknown"}`;
 	},
 	// Antigravity windows carry `durationMs` when the response identifies them

package/src/usage/openai-codex.ts

@@ -611,8 +611,11 @@ export const codexRankingStrategy: CredentialRankingStrategy = {
 		return { primary: findLimit("primary"), secondary: findLimit("secondary") };
 	},
 	windowDefaults: { primaryMs: 60 * 60 * 1000, secondaryMs: 7 * 24 * 60 * 60 * 1000 },
-	hasPriorityBoost(primary) {
-		if (!primary) return false;
+	hasPriorityBoost(primary, primaryUncapped = false, context) {
+		// Chat plans can omit an uncapped primary window while retaining their
+		// weekly window. Spark always has a capped primary meter, so a missing
+		// Spark primary is incomplete rather than uncapped.
+		if (!primary) return primaryUncapped && !isCodexSparkRequest(context);
 		const windowId = primary.scope.windowId?.toLowerCase();
 		const durationMs = primary.window?.durationMs;
 		const isFiveHourWindow =

package/src/usage/zai.ts

@@ -51,6 +51,8 @@ interface ZaiQuotaPayload {
 	msg?: string;
 	data?: {
 		limits?: ZaiUsageLimitItem[];
+		/** Coding-plan tier (e.g. "lite", "pro", "max") surfaced as the plan label. */
+		level?: string;
 	};
 }
 
@@ -193,17 +195,33 @@ function buildModelUsageUrl(baseUrl: string, now: Date): string {
 }
 
 function getZaiCredentialLimits(report: UsageReport): UsageLimit[] {
-	const limits = report.limits.filter(
-		limit => limit.id.startsWith("zai:requests:") || limit.id.startsWith("zai:tokens:"),
+	return report.limits.filter(
+		limit =>
+			limit.id.startsWith("zai:requests:") ||
+			limit.id.startsWith("zai:tokens:") ||
+			limit.id.startsWith("zai:credits:"),
 	);
-	return limits;
+}
+
+function zaiLimitPressure(limit: UsageLimit): number {
+	const fraction = limit.amount.usedFraction;
+	return typeof fraction === "number" && Number.isFinite(fraction) ? fraction : -1;
 }
 
 function rankZaiRequestLimits(report: UsageReport): UsageLimit[] {
 	const requestLimits = report.limits.filter(limit => limit.id.startsWith("zai:requests:"));
 	const credentialLimits = getZaiCredentialLimits(report);
 	const limits = requestLimits.length > 0 ? requestLimits : credentialLimits;
-	const ranked = [...limits];
+	// Mixed-meter payloads (tokens + credits on the same plan) can repeat a
+	// window; keep the most-binding limit per window so a second 5h row never
+	// displaces the weekly window when primary/secondary are picked positionally.
+	const byWindow = new Map<number, UsageLimit>();
+	for (const limit of limits) {
+		const durationMs = limit.window?.durationMs ?? Number.POSITIVE_INFINITY;
+		const current = byWindow.get(durationMs);
+		if (!current || zaiLimitPressure(limit) > zaiLimitPressure(current)) byWindow.set(durationMs, limit);
+	}
+	const ranked = [...byWindow.values()];
 	ranked.sort((left, right) => {
 		const leftDuration = left.window?.durationMs ?? Number.POSITIVE_INFINITY;
 		const rightDuration = right.window?.durationMs ?? Number.POSITIVE_INFINITY;
@@ -306,6 +324,33 @@ async function fetchZaiUsage(params: UsageFetchParams, ctx: UsageFetchContext):
 				status: getUsageStatus(amount.usedFraction),
 			});
 		}
+		if (parsed.type === "CREDIT_LIMIT") {
+			// GLM Coding Plan windows (e.g. 12k credits / 5h + 60k credits / week):
+			// `usage` is the plan's credit allotment, `currentValue` the spend.
+			// `percentage` is a server-rounded integer (11 for 1438/12000 ≈ 11.98%),
+			// so prefer the exact ratio and fall back to it only without absolutes.
+			const window = buildZaiWindow(parsed);
+			const hasAbsoluteMeter = parsed.currentValue !== undefined && parsed.usage !== undefined && parsed.usage > 0;
+			const amount = buildUsageAmount({
+				used: parsed.currentValue,
+				limit: parsed.usage,
+				remaining: parsed.remaining,
+				percentage: hasAbsoluteMeter ? undefined : parsed.percentage,
+				unit: "credits",
+			});
+			limits.push({
+				id: `zai:credits:${window.id}`,
+				label: `ZAI ${window.label} Credit Quota`,
+				scope: {
+					provider: params.provider,
+					windowId: window.id,
+					shared: true,
+				},
+				window,
+				amount,
+				status: getUsageStatus(amount.usedFraction),
+			});
+		}
 	}
 
 	if (limits.length === 0) return null;
@@ -318,6 +363,7 @@ async function fetchZaiUsage(params: UsageFetchParams, ctx: UsageFetchContext):
 			endpoint: url,
 			accountId: credential.accountId,
 			email: credential.email,
+			...(typeof payload.data?.level === "string" && payload.data.level ? { planType: payload.data.level } : {}),
 		},
 		raw: payload,
 	};

package/src/usage.ts

@@ -6,7 +6,7 @@
  */
 import { type } from "@oh-my-pi/omptype";
 import type { FetchImpl, Provider } from "./types";
-export type UsageUnit = "percent" | "tokens" | "requests" | "usd" | "minutes" | "bytes" | "unknown";
+export type UsageUnit = "percent" | "tokens" | "requests" | "credits" | "usd" | "minutes" | "bytes" | "unknown";
 
 export type UsageStatus = "ok" | "warning" | "exhausted" | "unknown";
 
@@ -240,7 +240,9 @@ export interface ClientUsageSummary {
 
 // ─── Zod schemas (wire-shape validation for the broker `/v1/usage` endpoint) ─
 
-export const usageUnitSchema = type("'percent' | 'tokens' | 'requests' | 'usd' | 'minutes' | 'bytes' | 'unknown'");
+export const usageUnitSchema = type(
+	"'percent' | 'tokens' | 'requests' | 'credits' | 'usd' | 'minutes' | 'bytes' | 'unknown'",
+);
 export const usageStatusSchema = type("'ok' | 'warning' | 'exhausted' | 'unknown'");
 
 export const usageWindowSchema = type({
@@ -412,6 +414,14 @@ export interface CredentialRankingStrategy {
 		primaryMs: number;
 		secondaryMs: number;
 	};
-	/** Optional: priority boost for specific credential states (e.g., fresh 5h ticker start). */
-	hasPriorityBoost?(primary: UsageLimit | undefined): boolean;
+	/**
+	 * Optional: priority boost for specific credential states (e.g., fresh 5h
+	 * ticker start). `primaryUncapped` is true only when the fetched report has
+	 * an applicable secondary window but no applicable primary window.
+	 */
+	hasPriorityBoost?(
+		primary: UsageLimit | undefined,
+		primaryUncapped?: boolean,
+		context?: CredentialRankingContext,
+	): boolean;
 }