@oh-my-pi/pi-ai 18.1.14 → 18.1.16

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+## [18.1.16] - 2026-09-09
+
+### Fixed
+
+- Codex SSE streams that end without a terminal completion event now retry when replay-safe and remain transient errors when partial output prevents replay ([#11349](https://github.com/can1357/oh-my-pi/issues/11349)).
+
+## [18.1.15] - 2026-09-08
+
+### Fixed
+
+- GitHub Copilot sign-in keeps the GitHub-owned Copilot CLI OAuth app on Enterprise domains: private instances run their own OAuth registry and reject the github.com-registered OpenCode client, which is now used only for public github.com sign-ins ([#11285](https://github.com/can1357/oh-my-pi/pull/11285) by [@H4vC](https://github.com/H4vC))
+- GitHub Copilot sign-in uses the minimal-grant OpenCode OAuth app again (`read:user` only): GitHub renders each app's existing per-user grant on the consent page, so Enterprise organizations that block the Copilot CLI app's broad historic grant can log in as on 18.1.4. API request identity still mimics the Copilot CLI, and tokens minted by either app keep working ([#11280](https://github.com/can1357/oh-my-pi/pull/11280) by [@H4vC](https://github.com/H4vC)).
+- GitHub Copilot plan/model-policy 403s no longer count as credential failures for credential-lifetime decisions: the token is valid, so stored credentials are preserved instead of wiped ([#11280](https://github.com/can1357/oh-my-pi/pull/11280) by [@H4vC](https://github.com/H4vC)).
+- Fixed custom `google-generative-ai` providers failing mid-turn model fallback when Gemini 3 tool calls are replayed without their original thought signature ([#11270](https://github.com/can1357/oh-my-pi/issues/11270)).
+- Fixed Linux `zcode://` (Z.AI coding-plan) OAuth sign-in hanging at the paste prompt after a successful browser authorization: native scheme registration now runs `update-desktop-database`, so `xdg-desktop-portal-gtk` resolves the handler on the first attempt instead of reporting "No Apps available" and no longer routes the callback to a stale transaction directory ([#11279](https://github.com/can1357/oh-my-pi/issues/11279)).
+
 ## [18.1.14] - 2026-09-07
 
 ### Fixed

package/dist/types/error/flags.d.ts

@@ -87,6 +87,15 @@ export declare function isFastModeUnsupported(error: unknown): boolean;
  * fail identically) nor surface as an auth failure.
  */
 export declare function isClinePassSurfaceGateMessage(errorMessage: string | undefined): boolean;
+/**
+ * GitHub Copilot 403s are plan/model-policy/org denials against a valid token —
+ * never a revoked credential (those arrive as 401). Wiping stored credentials
+ * on them hides the whole provider from `/model` and forces a pointless
+ * re-login, so credential-lifetime decisions must exempt them even though
+ * they still classify as `Flag.AuthFailed` (issue #11275). Mirrors the 403
+ * contract in `rewriteCopilotError` (`utils/http-inspector.ts`).
+ */
+export declare function isGitHubCopilotPolicyDenial(provider: string | undefined, status: number | undefined, errorMessage: string | undefined): boolean;
 export declare function classifyMessage(message: {
     api?: Api;
     provider?: string;

package/dist/types/registry/oauth/github-copilot.d.ts

@@ -15,7 +15,7 @@ type GitHubCopilotLoginOptions = {
 };
 /**
  * Refresh GitHub Copilot token.
- * GitHub OAuth tokens from both the former OpenCode app and the Copilot CLI app
+ * GitHub OAuth tokens from both the OpenCode app and the Copilot CLI app
  * remain directly usable, so existing logins need no token exchange or migration.
  */
 export declare function refreshGitHubCopilotToken(refreshToken: string, enterpriseDomain?: string, apiEndpoint?: string): OAuthCredentials;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.1.14",
+	"version": "18.1.16",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -124,11 +124,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.1.14",
-		"@oh-my-pi/pi-catalog": "18.1.14",
-		"@oh-my-pi/pi-natives": "18.1.14",
-		"@oh-my-pi/pi-utils": "18.1.14",
-		"@oh-my-pi/pi-wire": "18.1.14"
+		"@oh-my-pi/omptype": "18.1.16",
+		"@oh-my-pi/pi-catalog": "18.1.16",
+		"@oh-my-pi/pi-natives": "18.1.16",
+		"@oh-my-pi/pi-utils": "18.1.16",
+		"@oh-my-pi/pi-wire": "18.1.16"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/error/flags.ts

@@ -694,6 +694,26 @@ export function isClinePassSurfaceGateMessage(errorMessage: string | undefined):
 	return errorMessage !== undefined && CLINE_PASS_SURFACE_GATE_PATTERN.test(errorMessage);
 }
 
+const GITHUB_COPILOT_POLICY_DENIAL_PATTERN = /GitHub Copilot access denied \(HTTP 403\)/;
+
+/**
+ * GitHub Copilot 403s are plan/model-policy/org denials against a valid token —
+ * never a revoked credential (those arrive as 401). Wiping stored credentials
+ * on them hides the whole provider from `/model` and forces a pointless
+ * re-login, so credential-lifetime decisions must exempt them even though
+ * they still classify as `Flag.AuthFailed` (issue #11275). Mirrors the 403
+ * contract in `rewriteCopilotError` (`utils/http-inspector.ts`).
+ */
+export function isGitHubCopilotPolicyDenial(
+	provider: string | undefined,
+	status: number | undefined,
+	errorMessage: string | undefined,
+): boolean {
+	if (provider !== "github-copilot") return false;
+	if (status === 403) return true;
+	return errorMessage !== undefined && GITHUB_COPILOT_POLICY_DENIAL_PATTERN.test(errorMessage);
+}
+
 export function classifyMessage(message: {
 	api?: Api;
 	provider?: string;

package/src/providers/openai-codex-responses.ts

@@ -2147,6 +2147,17 @@ class CodexStreamProcessor {
 					firstTokenTime = this.#handleStreamEvent(rawEvent, firstTokenTime);
 					if (this.runtime.sawTerminalEvent) break;
 				}
+				if (!this.runtime.sawTerminalEvent) {
+					CODEX_DEBUG &&
+						logger.debug("[codex] codex stream ended unexpectedly", {
+							transport: this.runtime.transport,
+							terminalEventSeen: false,
+							unexpectedStreamEnd: true,
+							sentTurnStateHeader: Boolean(this.requestContext.turnState.value),
+							sentModelsEtagHeader: Boolean(this.requestContext.websocketState?.modelsEtag),
+						});
+					throw new CodexProviderStreamError("Codex stream ended before terminal completion event", true);
+				}
 				return { firstTokenTime };
 			} catch (error) {
 				const recovered = await this.#recoverStreamError(error);
@@ -2952,21 +2963,6 @@ class CodexStreamProcessor {
 		if (this.options?.signal?.aborted) {
 			throw new AIError.AbortError();
 		}
-		if (!this.runtime.sawTerminalEvent) {
-			if (this.requestContext.websocketState) {
-				resetCodexWebSocketAppendState(this.requestContext.websocketState);
-				this.requestContext.websocketState.modelsEtag = undefined;
-			}
-			CODEX_DEBUG &&
-				logger.debug("[codex] codex stream ended unexpectedly", {
-					transport: this.runtime.transport,
-					terminalEventSeen: this.runtime.sawTerminalEvent,
-					unexpectedStreamEnd: true,
-					sentTurnStateHeader: Boolean(this.requestContext.turnState.value),
-					sentModelsEtagHeader: Boolean(this.requestContext.websocketState?.modelsEtag),
-				});
-			throw new CodexProviderStreamError("Codex stream ended before terminal completion event", false);
-		}
 		if (output.stopReason === "aborted" || output.stopReason === "error") {
 			throw new CodexProviderStreamError("Codex response failed", false);
 		}

package/src/registry/oauth/github-copilot.ts

@@ -1,5 +1,15 @@
 /**
- * GitHub Copilot OAuth flow using the official Copilot CLI app.
+ * GitHub Copilot OAuth flow (OpenCode OAuth app, minimal read:user grant).
+ *
+ * The device flow intentionally uses the OpenCode app identity rather than
+ * the official Copilot CLI app: GitHub renders each app's existing per-user
+ * grant (Existing access) on the consent page, and Enterprise orgs that
+ * restrict OAuth apps block the CLI app's broad historic grant
+ * (repo/gist/codespace) no matter what scope this request asks for
+ * (issue #11275). API request identity still mimics the Copilot CLI via
+ * COPILOT_API_HEADERS. Enterprise domains keep the GitHub-owned Copilot CLI
+ * client: private instances run their own OAuth registry and reject the
+ * github.com-registered OpenCode client.
  */
 import { scheduler } from "node:timers/promises";
 import { getBundledModels } from "@oh-my-pi/pi-catalog/models";
@@ -15,7 +25,18 @@ import * as AIError from "../../error";
 import type { FetchImpl } from "../../types";
 import type { OAuthController, OAuthCredentials } from "./types";
 
-const CLIENT_ID = "Ov23ctDVkRmgkPke0Mmm";
+const OPENCODE_CLIENT_ID = "Ov23li8tweQw6odWQebz";
+const COPILOT_CLI_CLIENT_ID = "Ov23ctDVkRmgkPke0Mmm";
+
+/**
+ * OAuth client for the device flow. Public github.com uses the minimal-grant
+ * OpenCode app (narrow consent, issue #11275); private GitHub Enterprise
+ * instances run their own OAuth registry, which does not know that github.com
+ * registration, so they keep the GitHub-owned Copilot CLI client.
+ */
+function resolveOAuthClientId(domain: string): string {
+	return isPublicGitHubHost(domain) ? OPENCODE_CLIENT_ID : COPILOT_CLI_CLIENT_ID;
+}
 const OAUTH_SCOPE = "read:user";
 const OAUTH_HEADERS = {
 	Accept: "application/json",
@@ -82,7 +103,7 @@ async function startDeviceFlow(domain: string, fetchImpl: FetchImpl): Promise<De
 			method: "POST",
 			headers: OAUTH_HEADERS,
 			body: new URLSearchParams({
-				client_id: CLIENT_ID,
+				client_id: resolveOAuthClientId(domain),
 				scope: OAUTH_SCOPE,
 			}),
 		},
@@ -156,7 +177,7 @@ async function pollForGitHubAccessToken(
 				method: "POST",
 				headers: OAUTH_HEADERS,
 				body: new URLSearchParams({
-					client_id: CLIENT_ID,
+					client_id: resolveOAuthClientId(domain),
 					device_code: deviceCode,
 					grant_type: "urn:ietf:params:oauth:grant-type:device_code",
 				}),
@@ -207,7 +228,7 @@ const FAR_FUTURE_MS = Date.now() + 10 * 365.25 * 24 * 60 * 60 * 1000;
 
 /**
  * Refresh GitHub Copilot token.
- * GitHub OAuth tokens from both the former OpenCode app and the Copilot CLI app
+ * GitHub OAuth tokens from both the OpenCode app and the Copilot CLI app
  * remain directly usable, so existing logins need no token exchange or migration.
  */
 export function refreshGitHubCopilotToken(
@@ -335,8 +356,8 @@ export async function loginGitHubCopilot(options: GitHubCopilotLoginOptions): Pr
 
 	const apiEndpoint = await discoverGitHubCopilotApiEndpoint(githubAccessToken, fetchImpl);
 
-	// Keep storing the GitHub token directly so credentials minted by the former
-	// OpenCode OAuth app remain valid alongside new Copilot CLI app logins.
+	// Keep storing the GitHub token directly so credentials minted by the
+	// Copilot CLI OAuth app remain valid alongside new OpenCode app logins.
 	const credentials: OAuthCredentials = {
 		refresh: githubAccessToken,
 		access: githubAccessToken,