@oh-my-pi/pi-ai 18.0.8 → 18.0.9

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [18.0.9] - 2026-08-28
+
+### Fixed
+
+- Improved OAuth sign-in flows, including a fallback message when the browser cannot automatically close the OAuth success tab.
+- Fixed Cloudflare AI Gateway onboarding and routing so gateway account and endpoint configuration is preserved correctly while gateway credentials are not sent as upstream OpenAI authorization headers.
+- Fixed Codex OAuth quota handling so chat and Spark usage remain independent, legacy shared quota limits continue to work, and incomplete usage reports are not incorrectly treated as unlimited.
+
 ## [18.0.8] - 2026-08-27
 
 ### Added

package/README.md

@@ -76,7 +76,7 @@ Unified LLM API with automatic model discovery, provider configuration, token an
 - **Qwen Portal** (supports `QWEN_OAUTH_TOKEN` or `QWEN_PORTAL_API_KEY`)
 - **QwenCloud Token Plan** (supports `/login alibaba-token-plan`, `ALIBABA_TOKEN_PLAN_API_KEY`, or `BAILIAN_TOKEN_PLAN_API_KEY`; interactive login first selects a region — International (Singapore, default), China (Beijing) for 百炼 Token Plan keys, or a custom base URL — since region keys are non-interchangeable, then optionally stores a `home.qwencloud.com` Cookie request header for best-effort 5-hour and 7-day quota reporting)
   To enable quota reporting, sign in to the Token Plan dashboard, copy the `Cookie` request-header value from a `home.qwencloud.com` request in browser developer tools, and paste it at the second login prompt. Press Enter to skip; the Cookie is sensitive and session-lived, so rerun login when it expires.
-- **Cloudflare AI Gateway** (requires `CLOUDFLARE_AI_GATEWAY_API_KEY` and provider-specific gateway base URL)
+- **Cloudflare AI Gateway** (supports `/login cloudflare-ai-gateway`, or `CLOUDFLARE_AI_GATEWAY_API_KEY` with `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_GATEWAY_ID`)
 - **Ollama** (local OpenAI-compatible runtime; optional `OLLAMA_API_KEY`)
 - **Ollama Cloud** (hosted native Ollama API; requires `OLLAMA_CLOUD_API_KEY`)
 - **llama.cpp** (local OpenAI and Anthropic compatible inference server)
@@ -960,11 +960,10 @@ In Node.js environments, you can set environment variables to avoid passing API
 | Xiaomi MiMo    | `XIAOMI_API_KEY`                                                             |
 | ZenMux         | `ZENMUX_API_KEY`                                                             |
 | vLLM           | `VLLM_API_KEY`                                                               |
-| Cloudflare AI Gateway | `CLOUDFLARE_AI_GATEWAY_API_KEY`                                      |
+| Cloudflare AI Gateway | `CLOUDFLARE_AI_GATEWAY_API_KEY` + `CLOUDFLARE_ACCOUNT_ID` + `CLOUDFLARE_GATEWAY_ID` |
 | GitHub Copilot | `COPILOT_GITHUB_TOKEN` or `GH_TOKEN` or `GITHUB_TOKEN`                      |
 
-For Cloudflare AI Gateway models, use provider base URL format
-`https://gateway.ai.cloudflare.com/v1/<account>/<gateway>/anthropic`.
+`/login cloudflare-ai-gateway` collects and stores the gateway token, account ID, and gateway ID. For environment configuration, set all three Cloudflare values above. OMP derives provider endpoints from the account and gateway IDs.
 
 For Anthropic Foundry routing, set `CLAUDE_CODE_USE_FOUNDRY=true` plus:
 `FOUNDRY_BASE_URL`, `ANTHROPIC_FOUNDRY_API_KEY`, optional `ANTHROPIC_CUSTOM_HEADERS`,
@@ -996,7 +995,7 @@ Provider endpoint defaults for the current OpenAI-compatible integrations:
 - Ollama: local OpenAI-compatible runtime (`http://127.0.0.1:11434/v1`)
 - Ollama Cloud: native Ollama API host (`https://ollama.com/api`, configured here as base URL `https://ollama.com`)
 - LiteLLM: `http://localhost:4000/v1`
-- Cloudflare AI Gateway: `https://gateway.ai.cloudflare.com/v1/<account>/<gateway>/anthropic`
+- Cloudflare AI Gateway: native Anthropic, OpenAI, and Workers AI routes under `https://gateway.ai.cloudflare.com/v1/<account>/<gateway>`
 - Qwen Portal: `https://portal.qwen.ai/v1`
 When set, the library automatically uses these keys:
 

package/dist/types/auth-storage.d.ts

@@ -821,6 +821,18 @@ export declare class AuthStorage {
      * `XAI_API_KEY` does not auto-select SuperGrok (`xai-oauth`).
      */
     hasAuth(provider: string): boolean;
+    /**
+     * Like {@link hasAuth} but excludes providers whose only credential is the
+     * self-resolving {@link AUTHENTICATED_SENTINEL} — the marker AWS/Vertex
+     * transports return when a credential *source* merely exists (a stray
+     * `~/.aws` profile, an EC2 instance role, Application Default Credentials)
+     * without a usable key resolved yet. Default-model auto-selection uses this
+     * so an ambiently-available provider (e.g. `amazon-bedrock` via an unrelated
+     * AWS profile) does not win the startup default over a provider the user
+     * actually signed into and then 403 on the first turn. Explicit selection
+     * and picker visibility still go through {@link hasAuth}. See issue #9967.
+     */
+    hasConcreteAuth(provider: string): boolean;
     /**
      * Whether a request could resolve a key for this provider, including
      * cross-provider env aliases (`xai-oauth` borrowing `XAI_API_KEY`).

package/dist/types/registry/cloudflare-ai-gateway.d.ts

@@ -1,13 +1,13 @@
-import type { OAuthLoginCallbacks } from "./oauth/types.js";
-/**
- * Login to Cloudflare AI Gateway.
- *
- * Opens browser to Cloudflare AI Gateway authentication docs and prompts for a gateway token/API key.
- * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
- */
-export declare const loginCloudflareAiGateway: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
+/** Collect the gateway credential used by CLI, setup-wizard, and TUI login callers. */
+export declare function loginCloudflareAiGateway(options: OAuthController): Promise<string>;
 export declare const cloudflareAiGatewayProvider: {
     readonly id: "cloudflare-ai-gateway";
     readonly name: "Cloudflare AI Gateway";
+    readonly prepareModel: (model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>) => import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>;
+    readonly prepareRequest: (model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>, options: import("../index.js").StreamOptions) => {
+        model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>;
+        options: import("../index.js").StreamOptions;
+    };
     readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
 };

package/dist/types/registry/registry.d.ts

@@ -72,6 +72,11 @@ declare const ALL: ({
 } | {
     readonly id: "cloudflare-ai-gateway";
     readonly name: "Cloudflare AI Gateway";
+    readonly prepareModel: (model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>) => import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>;
+    readonly prepareRequest: (model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>, options: import("../index.js").StreamOptions) => {
+        model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>;
+        options: import("../index.js").StreamOptions;
+    };
     readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
 } | {
     readonly id: "coreweave";

package/dist/types/registry/types.d.ts

@@ -24,6 +24,7 @@ export interface PreparedProviderRequest {
     readonly options: StreamOptions;
 }
 export type ProviderRequestPreparer = (model: Model<Api>, options: StreamOptions) => PreparedProviderRequest;
+export type ProviderModelPreparer = (model: Model<Api>) => Model<Api>;
 export type ProviderSimpleOptionsMapper = (options: SimpleStreamOptions) => Readonly<Record<string, unknown>>;
 export interface ProviderModelDiscoveryConfig {
     readonly apiKey?: string;
@@ -57,6 +58,8 @@ export interface ProviderDefinition {
     readonly envKeys?: KeyResolver;
     /** Provider transport can authenticate without a resolved API-key string. */
     readonly allowsMissingApiKey?: boolean;
+    /** Provider-owned model normalization that must run before API-specific option mapping. */
+    readonly prepareModel?: ProviderModelPreparer;
     /** Provider-owned request shaping applied before generic API dispatch. */
     readonly prepareRequest?: ProviderRequestPreparer;
     /** Provider-owned projection from the generic simple-stream option bag. */

package/dist/types/usage/google-antigravity.d.ts

@@ -1,5 +1,16 @@
-import type { CredentialRankingStrategy, UsageProvider } from "../usage.js";
+import type { CredentialRankingContext, CredentialRankingStrategy, UsageLimit, UsageProvider, UsageReport } from "../usage.js";
 export declare const antigravityUsageProvider: UsageProvider;
+/** Map an Antigravity model id to its backend quota-counter key. */
+export declare function getAntigravityCounterKeyForModel(modelId: string | undefined): string | undefined;
+/**
+ * Scope an Antigravity report to the active model's backend counter, falling
+ * back to legacy default counters only when that backend has no limits.
+ *
+ * Exhaustion checks are only safe with a concrete backend counter. A no-model
+ * credential lookup (for example image-provider discovery) must not turn one
+ * exhausted family into a provider-wide block.
+ */
+export declare function scopeAntigravityLimitsForModel(report: UsageReport, context: CredentialRankingContext | undefined): UsageLimit[];
 /**
  * Antigravity quotas are returned per backend counter (Anthropic / Google /
  * OpenAI) and can include both daily and weekly windows. `fetchAntigravityUsage`

package/dist/types/usage.d.ts

@@ -528,6 +528,10 @@ export interface CredentialRankingStrategy {
         primaryMs: number;
         secondaryMs: number;
     };
-    /** Optional: priority boost for specific credential states (e.g., fresh 5h ticker start). */
-    hasPriorityBoost?(primary: UsageLimit | undefined): boolean;
+    /**
+     * Optional: priority boost for specific credential states (e.g., fresh 5h
+     * ticker start). `primaryUncapped` is true only when the fetched report has
+     * an applicable secondary window but no applicable primary window.
+     */
+    hasPriorityBoost?(primary: UsageLimit | undefined, primaryUncapped?: boolean, context?: CredentialRankingContext): boolean;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.0.8",
+	"version": "18.0.9",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Stencil Labs, Inc.",
@@ -37,10 +37,10 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.0.8",
-		"@oh-my-pi/pi-catalog": "18.0.8",
-		"@oh-my-pi/pi-utils": "18.0.8",
-		"@oh-my-pi/pi-wire": "18.0.8"
+		"@oh-my-pi/omptype": "18.0.9",
+		"@oh-my-pi/pi-catalog": "18.0.9",
+		"@oh-my-pi/pi-utils": "18.0.9",
+		"@oh-my-pi/pi-wire": "18.0.9"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/auth/sqlite-credential-store.ts

@@ -8,6 +8,7 @@ import { Database, type Statement } from "bun:sqlite";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { parseAlibabaTokenPlanCredential } from "@oh-my-pi/pi-catalog/wire/alibaba-token-plan";
+import { parseCloudflareAiGatewayCredential } from "@oh-my-pi/pi-catalog/wire/cloudflare-ai-gateway";
 import {
 	getAgentDbPath,
 	getDbBusyTimeoutMs,
@@ -215,10 +216,17 @@ function matchesReplacementCredential(
 	if (incoming.type === "api_key") {
 		if (existing.type !== "api_key") return false;
 		if (existing.key === incoming.key) return true;
-		if (provider !== "alibaba-token-plan") return false;
-		const existingToken = parseAlibabaTokenPlanCredential(existing.key)?.token;
-		const incomingToken = parseAlibabaTokenPlanCredential(incoming.key)?.token;
-		return existingToken !== undefined && existingToken === incomingToken;
+		if (provider === "alibaba-token-plan") {
+			const existingToken = parseAlibabaTokenPlanCredential(existing.key)?.token;
+			const incomingToken = parseAlibabaTokenPlanCredential(incoming.key)?.token;
+			return existingToken !== undefined && existingToken === incomingToken;
+		}
+		if (provider === "cloudflare-ai-gateway") {
+			const existingToken = parseCloudflareAiGatewayCredential(existing.key)?.token;
+			const incomingToken = parseCloudflareAiGatewayCredential(incoming.key)?.token;
+			return existingToken !== undefined && existingToken === incomingToken;
+		}
+		return false;
 	}
 	const incomingIdentifiers = extractOAuthCredentialIdentifiers(incoming);
 	const incomingIdentityKey = resolveProviderCredentialIdentityKey(provider, incomingIdentifiers);

package/src/auth-storage.ts

@@ -28,6 +28,7 @@ import type {
 	OAuthProvider,
 	OAuthProviderId,
 } from "./registry/oauth/types";
+import { AUTHENTICATED_SENTINEL } from "./registry/types";
 import { getEnvApiKey, getEnvApiKeyName } from "./stream";
 import type { Provider } from "./types";
 import type {
@@ -1272,6 +1273,7 @@ type UsageRankedCandidate<T extends AuthCredential> = UsageCandidate<T> & {
 	blocked: boolean;
 	blockedUntil?: number;
 	hasPriorityBoost: boolean;
+	usageMeasured: boolean;
 	planPriority: number;
 	secondaryUsed: number;
 	secondaryRequiredDrain: number;
@@ -2168,13 +2170,16 @@ export class AuthStorage {
 			const windows = usage ? strategy.findWindowLimits(usage, args.rankingContext) : undefined;
 			const primary = windows?.primary;
 			const secondary = windows?.secondary;
+			const usageMeasured = primary !== undefined || secondary !== undefined;
+			const primaryUncapped = primary === undefined && secondary !== undefined;
 			ranked.push({
 				selection,
 				usage,
 				usageChecked,
 				blocked,
 				blockedUntil,
-				hasPriorityBoost: strategy.hasPriorityBoost?.(primary) ?? false,
+				usageMeasured,
+				hasPriorityBoost: strategy.hasPriorityBoost?.(primary, primaryUncapped, args.rankingContext) ?? false,
 				planPriority: 0,
 				secondaryUsed: this.#normalizeUsageFraction(secondary),
 				secondaryRequiredDrain: this.#computeWindowRequiredDrain(
@@ -2748,6 +2753,34 @@ export class AuthStorage {
 		return false;
 	}
 
+	/**
+	 * Like {@link hasAuth} but excludes providers whose only credential is the
+	 * self-resolving {@link AUTHENTICATED_SENTINEL} — the marker AWS/Vertex
+	 * transports return when a credential *source* merely exists (a stray
+	 * `~/.aws` profile, an EC2 instance role, Application Default Credentials)
+	 * without a usable key resolved yet. Default-model auto-selection uses this
+	 * so an ambiently-available provider (e.g. `amazon-bedrock` via an unrelated
+	 * AWS profile) does not win the startup default over a provider the user
+	 * actually signed into and then 403 on the first turn. Explicit selection
+	 * and picker visibility still go through {@link hasAuth}. See issue #9967.
+	 */
+	hasConcreteAuth(provider: string): boolean {
+		if (this.#runtimeOverrides.has(provider)) return true;
+		if (this.#configOverrides.has(provider)) return true;
+		if (this.#getCredentialsForProvider(provider).length > 0) return true;
+		if ((provider === "amazon-bedrock" || provider === "bedrock-mantle") && $env.AWS_BEARER_TOKEN_BEDROCK?.trim()) {
+			return true;
+		}
+		if (provider === "xai-oauth") {
+			if ($env.XAI_OAUTH_TOKEN?.trim()) return true;
+		} else {
+			const envApiKey = getEnvApiKey(provider);
+			if (envApiKey !== undefined && envApiKey !== AUTHENTICATED_SENTINEL) return true;
+		}
+		const fallback = this.#fallbackResolver?.(provider);
+		return fallback !== undefined && fallback !== AUTHENTICATED_SENTINEL;
+	}
+
 	/**
 	 * Whether a request could resolve a key for this provider, including
 	 * cross-provider env aliases (`xai-oauth` borrowing `XAI_API_KEY`).
@@ -4633,8 +4666,8 @@ export class AuthStorage {
 		// scores are only comparable between measured windows, and the
 		// clockless headroom fallback (0..1) must not let an account whose
 		// usage fetch failed shadow a measured sibling.
-		const leftMeasured = left.usage !== null;
-		const rightMeasured = right.usage !== null;
+		const leftMeasured = left.usageMeasured;
+		const rightMeasured = right.usageMeasured;
 		if (leftMeasured !== rightMeasured) return leftMeasured ? -1 : 1;
 		// Required drain, descending: the account whose remaining quota must
 		// burn fastest to avoid expiring unused at its reset comes first, so
@@ -4769,13 +4802,16 @@ export class AuthStorage {
 			const windows = usage ? strategy.findWindowLimits(usage, args.rankingContext) : undefined;
 			const primary = windows?.primary;
 			const secondary = windows?.secondary;
+			const usageMeasured = primary !== undefined || secondary !== undefined;
+			const primaryUncapped = primary === undefined && secondary !== undefined;
 			ranked.push({
 				selection,
 				usage,
 				usageChecked,
 				blocked,
 				blockedUntil,
-				hasPriorityBoost: strategy.hasPriorityBoost?.(primary) ?? false,
+				usageMeasured,
+				hasPriorityBoost: strategy.hasPriorityBoost?.(primary, primaryUncapped, args.rankingContext) ?? false,
 				planPriority: getOpenAICodexPlanPriority(usage, args.planRequirement),
 				secondaryUsed: this.#normalizeUsageFraction(secondary),
 				secondaryRequiredDrain: this.#computeWindowRequiredDrain(

package/src/registry/cloudflare-ai-gateway.ts

@@ -1,26 +1,130 @@
-import { createApiKeyLogin } from "./api-key-login";
-import type { OAuthLoginCallbacks } from "./oauth/types";
+import { buildModel } from "@oh-my-pi/pi-catalog/build";
+import {
+	CLOUDFLARE_AI_GATEWAY_ANTHROPIC_BASE_URL,
+	CLOUDFLARE_AI_GATEWAY_BASE_URL,
+	CLOUDFLARE_AI_GATEWAY_COMPAT_BASE_URL,
+	CLOUDFLARE_AI_GATEWAY_OPENAI_BASE_URL,
+	parseCloudflareAiGatewayCredential,
+	serializeCloudflareAiGatewayCredential,
+} from "@oh-my-pi/pi-catalog/wire/cloudflare-ai-gateway";
+import { $env } from "@oh-my-pi/pi-utils";
+import * as AIError from "../error";
+import { NO_AUTH_SENTINEL } from "../providers/openai-shared";
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
 import type { ProviderDefinition } from "./types";
 
 const AUTH_URL = "https://developers.cloudflare.com/ai-gateway/configuration/authentication/";
 
-/**
- * Login to Cloudflare AI Gateway.
- *
- * Opens browser to Cloudflare AI Gateway authentication docs and prompts for a gateway token/API key.
- * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
- */
-export const loginCloudflareAiGateway = createApiKeyLogin({
-	providerLabel: "Cloudflare AI Gateway",
-	authUrl: AUTH_URL,
-	instructions: "Copy your Cloudflare AI Gateway token/API key. Configure account/gateway base URL in models config.",
-	promptMessage: "Paste your Cloudflare AI Gateway token/API key",
-	placeholder: "cf-aig-...",
-	validation: null,
-});
+/** Collect the gateway credential used by CLI, setup-wizard, and TUI login callers. */
+export async function loginCloudflareAiGateway(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new AIError.OnPromptRequiredError("Cloudflare AI Gateway");
+	}
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: "Create an AI Gateway token with Run permission, then copy it here.",
+	});
+
+	const apiKey = await options.onPrompt({
+		message: "Paste your Cloudflare AI Gateway token/API key",
+		placeholder: "cfut_...",
+	});
+	if (options.signal?.aborted) throw new AIError.LoginCancelledError();
+	if (!apiKey.trim()) throw new AIError.ApiKeyRequiredError();
+
+	const accountId = await options.onPrompt({
+		message: "Enter your Cloudflare account ID",
+		placeholder: "32-character account ID",
+	});
+	if (options.signal?.aborted) throw new AIError.LoginCancelledError();
+	if (!accountId.trim()) throw new AIError.ConfigurationError("Cloudflare account ID is required");
+
+	const gatewayId = await options.onPrompt({
+		message: "Enter your Cloudflare AI Gateway ID",
+		placeholder: "default",
+	});
+	if (options.signal?.aborted) throw new AIError.LoginCancelledError();
+	if (!gatewayId.trim()) throw new AIError.ConfigurationError("Cloudflare AI Gateway ID is required");
+
+	return serializeCloudflareAiGatewayCredential(apiKey, accountId, gatewayId);
+}
 
 export const cloudflareAiGatewayProvider = {
 	id: "cloudflare-ai-gateway",
 	name: "Cloudflare AI Gateway",
+	prepareModel: model => {
+		const hasGatewayPlaceholders = model.baseUrl.includes("<account>") || model.baseUrl.includes("<gateway>");
+		if (model.id.startsWith("anthropic/")) {
+			const requestModelId = model.id.slice("anthropic/".length).replaceAll(".", "-");
+			const baseUrl = hasGatewayPlaceholders ? CLOUDFLARE_AI_GATEWAY_ANTHROPIC_BASE_URL : model.baseUrl;
+			if (
+				model.api === "anthropic-messages" &&
+				model.baseUrl === baseUrl &&
+				model.requestModelId === requestModelId
+			) {
+				return model;
+			}
+			return {
+				...model,
+				api: "anthropic-messages",
+				baseUrl,
+				requestModelId,
+			};
+		}
+		if (model.id.startsWith("openai/")) {
+			const requestModelId = model.id.slice("openai/".length);
+			const baseUrl = hasGatewayPlaceholders ? CLOUDFLARE_AI_GATEWAY_OPENAI_BASE_URL : model.baseUrl;
+			if (model.api === "openai-responses" && model.baseUrl === baseUrl && model.requestModelId === requestModelId) {
+				return model;
+			}
+			return buildModel({
+				...model,
+				api: "openai-responses",
+				baseUrl,
+				compat: model.compatConfig,
+				requestModelId,
+			});
+		}
+		if (model.id.startsWith("workers-ai/")) {
+			const baseUrl = hasGatewayPlaceholders ? CLOUDFLARE_AI_GATEWAY_COMPAT_BASE_URL : model.baseUrl;
+			if (model.api === "openai-completions" && model.baseUrl === baseUrl) {
+				return model;
+			}
+			return buildModel({
+				...model,
+				api: "openai-completions",
+				baseUrl,
+				compat: model.compatConfig,
+			});
+		}
+		return model;
+	},
+	prepareRequest: (model, options) => {
+		const credential = parseCloudflareAiGatewayCredential(options.apiKey ?? $env.CLOUDFLARE_AI_GATEWAY_API_KEY ?? "");
+		if (!credential) return { model, options };
+		const accountId = credential.accountId ?? $env.CLOUDFLARE_ACCOUNT_ID;
+		const gatewayId = credential.gatewayId ?? $env.CLOUDFLARE_GATEWAY_ID;
+		let baseUrl = model.baseUrl;
+		if (baseUrl.startsWith(CLOUDFLARE_AI_GATEWAY_BASE_URL)) {
+			if (!accountId) throw new AIError.ConfigurationError("Cloudflare account ID is required");
+			if (!gatewayId) throw new AIError.ConfigurationError("Cloudflare AI Gateway ID is required");
+			baseUrl = baseUrl.replace("<account>", accountId).replace("<gateway>", gatewayId);
+		}
+
+		const isAnthropic = model.api === "anthropic-messages";
+		let headers = model.headers;
+		if (!isAnthropic) {
+			headers = { ...headers };
+			for (const name in headers) {
+				const normalized = name.toLowerCase();
+				if (normalized === "authorization" || normalized === "x-api-key") delete headers[name];
+			}
+			headers["cf-aig-authorization"] = `Bearer ${credential.token}`;
+		}
+		return {
+			model: { ...model, baseUrl, headers },
+			options: { ...options, apiKey: isAnthropic ? credential.token : NO_AUTH_SENTINEL },
+		};
+	},
 	login: (cb: OAuthLoginCallbacks) => loginCloudflareAiGateway(cb),
 } as const satisfies ProviderDefinition;

package/src/registry/oauth/oauth.html

@@ -303,10 +303,16 @@
 			const message = document.getElementById("message");
 
 			if (serverState.ok) {
+				const closeButton = document.querySelector(".btn");
 				app.classList.add("success", "countdown");
 				title.textContent = "Authentication Successful";
-				message.innerHTML = "You have successfully logged in.<br>You can now close this tab.";
-				setTimeout(() => window.close(), 3000);
+				message.textContent = "You have successfully logged in.";
+				window.close();
+				setTimeout(() => {
+					app.classList.remove("countdown");
+					closeButton.remove();
+					message.innerHTML = "You have successfully logged in.<br>Please close this tab manually.";
+				}, 300);
 			} else {
 				app.classList.add("error");
 				title.textContent = "Authentication Failed";

package/src/registry/types.ts

@@ -29,6 +29,7 @@ export interface PreparedProviderRequest {
 }
 
 export type ProviderRequestPreparer = (model: Model<Api>, options: StreamOptions) => PreparedProviderRequest;
+export type ProviderModelPreparer = (model: Model<Api>) => Model<Api>;
 export type ProviderSimpleOptionsMapper = (options: SimpleStreamOptions) => Readonly<Record<string, unknown>>;
 
 export interface ProviderModelDiscoveryConfig {
@@ -66,6 +67,8 @@ export interface ProviderDefinition {
 	readonly envKeys?: KeyResolver;
 	/** Provider transport can authenticate without a resolved API-key string. */
 	readonly allowsMissingApiKey?: boolean;
+	/** Provider-owned model normalization that must run before API-specific option mapping. */
+	readonly prepareModel?: ProviderModelPreparer;
 	/** Provider-owned request shaping applied before generic API dispatch. */
 	readonly prepareRequest?: ProviderRequestPreparer;
 	/** Provider-owned projection from the generic simple-stream option bag. */

package/src/stream.ts

@@ -939,9 +939,10 @@ function streamDispatch<TApi extends Api>(
 		return streamBedrock(model as Model<"bedrock-converse-stream">, context, requestOptions as BedrockOptions);
 	}
 
-	const prepareRequest = getProviderDefinition(model.provider)?.prepareRequest;
-	const prepared = prepareRequest?.(model as Model<Api>, requestOptions as StreamOptions);
-	const providerModel = prepared?.model ?? (model as Model<Api>);
+	const providerDefinition = getProviderDefinition(model.provider);
+	const requestModel = providerDefinition?.prepareModel?.(model) ?? model;
+	const prepared = providerDefinition?.prepareRequest?.(requestModel, requestOptions as StreamOptions);
+	const providerModel = prepared?.model ?? requestModel;
 	const preparedOptions = prepared?.options ?? (requestOptions as StreamOptions);
 	const apiKey = preparedOptions.apiKey || getEnvApiKey(providerModel.provider);
 	if (!apiKey) {
@@ -1691,8 +1692,9 @@ function streamSimpleRequest<TApi extends Api>(
 			),
 		);
 	}
-	const providerOptions = mapOptionsForApi(model, requestOptions, apiKey);
-	return stream(model, context, providerOptions);
+	const providerModel = getProviderDefinition(model.provider)?.prepareModel?.(model) ?? model;
+	const providerOptions = mapOptionsForApi(providerModel, requestOptions, apiKey);
+	return stream(providerModel, context, providerOptions);
 }
 
 export async function completeSimple<TApi extends Api>(

package/src/usage/google-antigravity.ts

@@ -426,12 +426,19 @@ export const antigravityUsageProvider: UsageProvider = {
 	supports: params => params.provider === "google-antigravity",
 };
 
-function getAntigravityCounterKeyForModel(context: CredentialRankingContext | undefined): string | undefined {
-	const modelId = context?.modelId?.toLowerCase();
-	if (!modelId) return undefined;
-	if (modelId.startsWith("claude-")) return "anthropic";
-	if (modelId.startsWith("gemini-") || modelId.startsWith("gemma-")) return "google";
-	if (modelId.startsWith("gpt-") || modelId.startsWith("openai/")) return "openai";
+/** Map an Antigravity model id to its backend quota-counter key. */
+export function getAntigravityCounterKeyForModel(modelId: string | undefined): string | undefined {
+	const normalizedModelId = modelId?.toLowerCase();
+	if (!normalizedModelId) return undefined;
+	if (normalizedModelId.startsWith("claude-")) return "anthropic";
+	if (
+		normalizedModelId.startsWith("gemini-") ||
+		normalizedModelId.startsWith("gemma-") ||
+		normalizedModelId.startsWith("tab_")
+	) {
+		return "google";
+	}
+	if (normalizedModelId.startsWith("gpt-") || normalizedModelId.startsWith("openai/")) return "openai";
 	return undefined;
 }
 
@@ -440,14 +447,19 @@ function getAntigravityCounterLimits(report: UsageReport, counterKey: string): U
 	return report.limits.filter(limit => limit.id.toLowerCase().startsWith(prefix));
 }
 
-// Exhaustion checks are only safe with a concrete backend counter. A no-model
-// Antigravity credential lookup (for example image-provider discovery) must
-// not turn one exhausted family into a provider-wide block.
-function scopeAntigravityLimitsForModel(
+/**
+ * Scope an Antigravity report to the active model's backend counter, falling
+ * back to legacy default counters only when that backend has no limits.
+ *
+ * Exhaustion checks are only safe with a concrete backend counter. A no-model
+ * credential lookup (for example image-provider discovery) must not turn one
+ * exhausted family into a provider-wide block.
+ */
+export function scopeAntigravityLimitsForModel(
 	report: UsageReport,
 	context: CredentialRankingContext | undefined,
 ): UsageLimit[] {
-	const counterKey = getAntigravityCounterKeyForModel(context);
+	const counterKey = getAntigravityCounterKeyForModel(context?.modelId);
 	if (!counterKey) return [];
 	const backendLimits = getAntigravityCounterLimits(report, counterKey);
 	if (backendLimits.length > 0) return backendLimits;
@@ -455,7 +467,7 @@ function scopeAntigravityLimitsForModel(
 }
 
 function rankAntigravityLimits(report: UsageReport, context: CredentialRankingContext | undefined): UsageLimit[] {
-	const counterKey = getAntigravityCounterKeyForModel(context);
+	const counterKey = getAntigravityCounterKeyForModel(context?.modelId);
 	if (!counterKey) return report.limits;
 	return scopeAntigravityLimitsForModel(report, context);
 }
@@ -480,7 +492,7 @@ export const antigravityRankingStrategy: CredentialRankingStrategy = {
 	// Always return a scope for Antigravity so missing/unknown model context
 	// cannot fall through to AuthStorage's provider-wide block bucket.
 	blockScope(context) {
-		const counterKey = getAntigravityCounterKeyForModel(context);
+		const counterKey = getAntigravityCounterKeyForModel(context?.modelId);
 		return `counter:${counterKey ?? "unknown"}`;
 	},
 	// Antigravity windows carry `durationMs` when the response identifies them

package/src/usage/openai-codex.ts

@@ -611,8 +611,11 @@ export const codexRankingStrategy: CredentialRankingStrategy = {
 		return { primary: findLimit("primary"), secondary: findLimit("secondary") };
 	},
 	windowDefaults: { primaryMs: 60 * 60 * 1000, secondaryMs: 7 * 24 * 60 * 60 * 1000 },
-	hasPriorityBoost(primary) {
-		if (!primary) return false;
+	hasPriorityBoost(primary, primaryUncapped = false, context) {
+		// Chat plans can omit an uncapped primary window while retaining their
+		// weekly window. Spark always has a capped primary meter, so a missing
+		// Spark primary is incomplete rather than uncapped.
+		if (!primary) return primaryUncapped && !isCodexSparkRequest(context);
 		const windowId = primary.scope.windowId?.toLowerCase();
 		const durationMs = primary.window?.durationMs;
 		const isFiveHourWindow =

package/src/usage.ts

@@ -414,6 +414,14 @@ export interface CredentialRankingStrategy {
 		primaryMs: number;
 		secondaryMs: number;
 	};
-	/** Optional: priority boost for specific credential states (e.g., fresh 5h ticker start). */
-	hasPriorityBoost?(primary: UsageLimit | undefined): boolean;
+	/**
+	 * Optional: priority boost for specific credential states (e.g., fresh 5h
+	 * ticker start). `primaryUncapped` is true only when the fetched report has
+	 * an applicable secondary window but no applicable primary window.
+	 */
+	hasPriorityBoost?(
+		primary: UsageLimit | undefined,
+		primaryUncapped?: boolean,
+		context?: CredentialRankingContext,
+	): boolean;
 }