@oh-my-pi/pi-ai 18.11.2 → 18.11.3

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+## [18.11.3] - 2026-10-16
+
+### Fixed
+
+- Fixed JSON Schema dereferencing rewriting literal values in `const`, `enum`, `default`, examples, and custom annotations, or treating property names as schema keywords ([#15927](https://github.com/can1357/oh-my-pi/pull/15927) by [@jchanghong023](https://github.com/jchanghong023)).
+- Fixed Anthropic requests hanging forever on Bun 1.3 when the upstream accepted the request but never sent headers: aborting the request (including the first-event timeout) now fails it, so the turn retries instead of waiting until the user interrupts it ([#16010](https://github.com/can1357/oh-my-pi/pull/16010) by [@ca-io-systems](https://github.com/ca-io-systems))
+- Fixed the auth gateway's `POST /v1/chat/completions` streams being dropped (`terminated`) after ~255 s without upstream output, e.g. while xAI generates a large tool call's arguments, which arrive only when complete; the stream now sends an SSE `: keepalive` comment every 15 s ([#15940](https://github.com/can1357/oh-my-pi/pull/15940) by [@radkawar](https://github.com/radkawar))
+- Fixed Anthropic models with mid-conversation system messages (e.g. Claude Opus 5.5) receiving `@file` mention contents and hidden extension messages as a trailing `system` message instead of ending the request on the user's turn ([#15881](https://github.com/can1357/oh-my-pi/issues/15881))
+
 ## [18.11.2] - 2026-10-16
 
 ### Breaking Changes
@@ -2359,24 +2368,4 @@
 - Fixed Ollama chat requests sending image payloads to text-only models. Image blocks are now omitted and replaced with the standard non-vision placeholder for models without vision support, while vision-capable Ollama models continue to receive images. ([#3009](https://github.com/can1357/oh-my-pi/pull/3009) by [@serverinspector](https://github.com/serverinspector))
 - Fixed `SqliteAuthCredentialStore.close()` leaking one-off prepared statements created by inline `this.#db.prepare()` calls in `#authCredentialsTableExists`, `#readAuthSchemaVersion`, `#inferAuthSchemaVersion`, `#migrateAuthSchemaV0ToV1`, `#backfillCredentialIdentityKeys`, and `updateAuthCredential`. Each statement is now wrapped in `try/finally` with `stmt.finalize()`, and the `close()` method finalizes `#insertUsageCostStmt` and `#listUsageCostsStmt` which were previously missed. This caused EBUSY on Windows when tests tried to delete temp dirs containing open SQLite handles.
 
-## [16.1.2] - 2026-06-19
-
-### Added
-
-- Added improved JSON repair capabilities for Anthropic tool arguments
-- Added authentication broker discovery to sync credentials between local SQLite and remote state
-
-### Fixed
-
-- Improved error feedback and transparency for malformed Anthropic tool call arguments
-- Added automatic fallback for unsupported OpenAI reasoning effort levels
-- Improved reliability when handling invalid reasoning parameter errors across OpenAI-compatible APIs
-- Fixed OpenAI-compatible Chat Completions, Responses, and Azure Responses requests to retry once with the nearest provider-supported reasoning effort when an endpoint rejects `xhigh`/`minimal`-style effort values.
-
-## [16.1.0] - 2026-06-19
-
-### Added
-
-- Added utility functions to strip schema descriptions for optimized LLM context usage
-
-Older entries are archived in [packages/ai/CHANGELOG.md@aa43b0057f82](https://github.com/can1357/oh-my-pi/blob/aa43b0057f82cb167459f8e6b41c5ec9f4e0f91d/packages/ai/CHANGELOG.md).
+Older entries are archived in [packages/ai/CHANGELOG.md@0595d346917d](https://github.com/can1357/oh-my-pi/blob/0595d346917d152ea2b710332817de599f749626/packages/ai/CHANGELOG.md).

package/README.md

@@ -84,7 +84,7 @@ Unified LLM API with automatic model discovery, provider configuration, token an
 - **vLLM** (OpenAI-compatible server; `VLLM_API_KEY` for secured deployments)
 - **GitHub Copilot** (requires OAuth, see below)
 - **Google Gemini CLI** (requires OAuth, see below)
-- **Antigravity** (requires OAuth, see below)
+- **Google Antigravity** (requires OAuth, see below)
 - **Any OpenAI-compatible API**: LM Studio, custom proxies, etc.
 
 ## Installation
@@ -1031,7 +1031,7 @@ Several providers support OAuth authentication (some also support static API key
 - **OpenAI Codex** (ChatGPT Plus/Pro subscription, access to GPT-5.x Codex models)
 - **GitHub Copilot** (Copilot subscription)
 - **Google Gemini CLI** (Gemini 2.0/2.5 via Google Cloud Code Assist; free tier or paid subscription)
-- **Antigravity** (Free Gemini 3, Claude, GPT-OSS via Google Cloud)
+- **Google Antigravity** (Gemini, Claude, GPT-OSS via Google Cloud)
 - **Qwen Portal** (Qwen OAuth token or API key)
 - **Snowflake Cortex** (Snowflake account OAuth with PKCE and refresh, subject to the account's local-application integration)
 

package/dist/types/providers/cursor/exec-modern.d.ts

@@ -17,7 +17,7 @@ import type { ToolResultMessage } from "../../types.js";
  * virtual registry. Re-exported here because this is where the frame builders
  * and their translation are consumed together.
  */
-export { cursorExecReadPath, cursorRawReadPath, omitUndefinedArgs, piEscapeRegexLiteral, piGrepSkip, piJoinPath, piLimit, piLsPath, piReadDisplayPath, piReadPath, piReadPathHasRange, piTimeout, shellTimeoutSeconds, } from "../cursor-pi-args.js";
+export { cursorExecReadPath, cursorRawReadPath, omitUndefinedArgs, piEscapeRegexLiteral, piGrepSkip, piJoinPath, piLimit, piLsPath, piReadDisplayPath, piReadPath, piReadPathHasRange, piTimeout, shellDeadlineSeconds, shellTimeoutSeconds, } from "../cursor-pi-args.js";
 /** Flatten a tool result's content into the single `output` string the Pi frames carry. */
 export declare function piOutputText(toolResult: ToolResultMessage): string;
 /**

package/dist/types/providers/cursor-pi-args.d.ts

@@ -129,6 +129,19 @@ export declare function piTimeout(timeout: number | undefined): number | undefin
  * budgets round up: 0 seconds means "no deadline" to the bash tool.
  */
 export declare function shellTimeoutSeconds(timeoutMs: number | undefined): number | undefined;
+/**
+ * The bash-tool kill deadline, in seconds, for a Cursor `ShellArgs`/`ShellStreamArgs` frame.
+ *
+ * Cursor's `timeout` carries the model's `block_until_ms`, which Cursor's Shell tool documents as
+ * how long to block before moving the command to the background, not as a kill deadline; the kill
+ * deadline is `hard_timeout`. Without one, a short wait (`block_until_ms: 5000` on a build) must not
+ * kill the command: the deadline stays the bash default (`undefined`), raised to the wait only when
+ * the wait is longer.
+ */
+export declare function shellDeadlineSeconds(args: {
+    timeout: number;
+    hardTimeout?: number;
+}): number | undefined;
 /**
  * Drop keys whose value is `undefined` so optional local-tool kwargs stay
  * absent rather than present-as-undefined.

package/dist/types/types.d.ts

@@ -267,6 +267,11 @@ export interface StreamOptions {
     frequencyPenalty?: number;
     maxTokens?: number;
     signal?: AbortSignal;
+    /**
+     * OpenAI chat-completions HTTP attempt budget. When set, transient provider
+     * errors are not replayed above the transport, so retries share this limit.
+     */
+    maxHttpAttempts?: number;
     apiKey?: string;
     /** @internal Stored credential row serving this request, when known. */
     credentialId?: number;

package/dist/types/utils/openai-http.d.ts

@@ -26,6 +26,8 @@ export interface OpenAIStreamRequestInit {
     body: unknown;
     signal: AbortSignal;
     fetch?: FetchImpl;
+    /** Override the default transport attempt budget for this request. */
+    maxAttempts?: number;
     /** Optional caller-specific gate composed with shared transport retry exclusions. */
     shouldRetryResponse?: (response: Response, bodyText: string) => boolean | Promise<boolean>;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.11.2",
+	"version": "18.11.3",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,11 +155,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.11.2",
-		"@oh-my-pi/pi-catalog": "18.11.2",
-		"@oh-my-pi/pi-natives": "18.11.2",
-		"@oh-my-pi/pi-utils": "18.11.2",
-		"@oh-my-pi/pi-wire": "18.11.2"
+		"@oh-my-pi/omptype": "18.11.3",
+		"@oh-my-pi/pi-catalog": "18.11.3",
+		"@oh-my-pi/pi-natives": "18.11.3",
+		"@oh-my-pi/pi-utils": "18.11.3",
+		"@oh-my-pi/pi-wire": "18.11.3"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/providers/anthropic.ts

@@ -5777,9 +5777,9 @@ export function convertAnthropicMessages(
 		compactionRequest?: AnthropicCompactionRequest;
 	},
 ): AnthropicMessageParam[] {
-	// Indices of params emitted from `developer` messages. After the main pass,
-	// the ones whose placement satisfies Anthropic's mid-conversation rules are
-	// upgraded from the `user` role to the authoritative `system` role.
+	// Indices of params emitted from agent-owned `developer` messages. After the
+	// main pass, the ones whose placement satisfies Anthropic's mid-conversation
+	// rules are upgraded from the `user` role to the authoritative `system` role.
 	const developerParams: Array<{ index: number; payload?: AnthropicMessagePayload }> = [];
 	const params: AnthropicMessageParam[] = [];
 	// Controls rendered from request-control markers. The assistant repairs
@@ -5906,7 +5906,13 @@ export function convertAnthropicMessages(
 				blocks.push(...anthropicToolChangeBlocks(payload.toolChanges, isOAuthToken, model));
 				content = blocks;
 			}
-			if (msg.role === "developer") developerParams.push({ index: params.length, payload });
+			// User-attributed developer turns (text `@file` mentions, hidden extension
+			// messages) only borrow the slot: their content is the user's, so it stays
+			// on `user` instead of gaining system authority or ending the request in
+			// place of the user's turn. Provider controls only exist on `system`.
+			if (msg.role === "developer" && (msg.attribution !== "user" || hasProviderControls)) {
+				developerParams.push({ index: params.length, payload });
+			}
 			const param: AnthropicMessageParam & ConversationalUserCarrier = { role: "user", content };
 			// Record that this wire `user` came from a real conversational turn, so
 			// prompt-cache decimation can tell it apart from everything else that

package/src/providers/cowork-fetch.ts

@@ -198,7 +198,11 @@ async function sendCoworkRequest(
 	};
 	const abort = (): void => {
 		const reason = signal?.reason;
-		request?.destroy(reason instanceof Error ? reason : new DOMException("The operation was aborted.", "AbortError"));
+		const error = reason instanceof Error ? reason : new DOMException("The operation was aborted.", "AbortError");
+		request?.destroy(error);
+		// Bun before 1.4 emits 'close' but not 'error' for destroy(error), so the
+		// 'error' listener below never settles a request still waiting for headers.
+		result.reject(error);
 	};
 	if (signal?.aborted) {
 		release();

package/src/providers/cursor/exec-modern.ts

@@ -86,6 +86,7 @@ export {
 	piReadPath,
 	piReadPathHasRange,
 	piTimeout,
+	shellDeadlineSeconds,
 	shellTimeoutSeconds,
 } from "../cursor-pi-args";
 

package/src/providers/cursor-pi-args.ts

@@ -209,6 +209,25 @@ export function shellTimeoutSeconds(timeoutMs: number | undefined): number | und
 	return Math.max(1, Math.round(timeoutMs / 1000));
 }
 
+/** The bash tool's deadline when its `timeout` is omitted. */
+const BASH_DEFAULT_DEADLINE_SECONDS = 300;
+
+/**
+ * The bash-tool kill deadline, in seconds, for a Cursor `ShellArgs`/`ShellStreamArgs` frame.
+ *
+ * Cursor's `timeout` carries the model's `block_until_ms`, which Cursor's Shell tool documents as
+ * how long to block before moving the command to the background, not as a kill deadline; the kill
+ * deadline is `hard_timeout`. Without one, a short wait (`block_until_ms: 5000` on a build) must not
+ * kill the command: the deadline stays the bash default (`undefined`), raised to the wait only when
+ * the wait is longer.
+ */
+export function shellDeadlineSeconds(args: { timeout: number; hardTimeout?: number }): number | undefined {
+	const hardSeconds = shellTimeoutSeconds(args.hardTimeout);
+	if (hardSeconds !== undefined) return hardSeconds;
+	const waitSeconds = shellTimeoutSeconds(args.timeout);
+	return waitSeconds !== undefined && waitSeconds > BASH_DEFAULT_DEADLINE_SECONDS ? waitSeconds : undefined;
+}
+
 /**
  * Drop keys whose value is `undefined` so optional local-tool kwargs stay
  * absent rather than present-as-undefined.

package/src/providers/cursor.ts

@@ -261,7 +261,7 @@ import {
 	piReadDisplayPath,
 	piReadPathHasRange,
 	piTimeout,
-	shellTimeoutSeconds,
+	shellDeadlineSeconds,
 } from "./cursor/exec-modern";
 import { handleInteractionQuery, protoUnknownFields } from "./cursor/interaction-query";
 
@@ -2681,7 +2681,7 @@ async function handleExecServerMessage(
 			synthesizeCursorExecToolCall(output, stream, state, args.toolCallId, "bash", {
 				command: args.command,
 				cwd: args.workingDirectory || undefined,
-				timeout: shellTimeoutSeconds(args.timeout),
+				timeout: shellDeadlineSeconds(args),
 			});
 			const { execResult } = await resolveExecHandler(
 				args,
@@ -2702,7 +2702,7 @@ async function handleExecServerMessage(
 			synthesizeCursorExecToolCall(output, stream, state, args.toolCallId, "bash", {
 				command: args.command,
 				cwd: args.workingDirectory || undefined,
-				timeout: shellTimeoutSeconds(args.timeout),
+				timeout: shellDeadlineSeconds(args),
 			});
 			await handleShellStreamArgs(args, execMsg, runTransport, execHandlers, onToolResult);
 			return;
@@ -3180,7 +3180,7 @@ async function handleExecServerMessage(
 			synthesizeCursorExecToolCall(output, stream, state, args.toolCallId, "bash", {
 				command: args.command,
 				cwd: args.workingDirectory || undefined,
-				timeout: shellTimeoutSeconds(args.timeout),
+				timeout: shellDeadlineSeconds(args),
 			});
 			const { execResult } = await resolveExecHandler(
 				normalizedArgs,

package/src/providers/openai-anthropic-shim.ts

@@ -133,6 +133,7 @@ export function streamOpenAIAnthropicShim(
 					presencePenalty: options?.presencePenalty,
 					repetitionPenalty: options?.repetitionPenalty,
 					maxTokens: options?.maxTokens ?? model.maxTokens ?? undefined,
+					maxHttpAttempts: options?.maxHttpAttempts,
 					signal: options?.signal,
 					headers: mergedHeaders,
 					cacheRetention: config.forwardCacheOptions ? options?.cacheRetention : undefined,

package/src/providers/openai-chat-server.ts

@@ -531,6 +531,13 @@ function makeId(): string {
 // encodeStream (SSE)
 // ---------------------------------------------------------------------------
 
+// Keepalive cadence for the SSE encoder. Some upstreams go silent for minutes
+// mid-stream (e.g. xAI emits a large tool call's arguments only when complete);
+// without bytes on the wire the listener's idle timeout and client watchdogs
+// drop a healthy stream. SSE comment lines are ignored by spec-compliant clients.
+const STREAM_KEEPALIVE_INTERVAL_MS = 15_000;
+const SSE_KEEPALIVE = ": keepalive\n\n";
+
 export function encodeStream(
 	events: AssistantMessageEventStream,
 	requestedModelId: string,
@@ -546,6 +553,13 @@ export function encodeStream(
 		cancelled = true;
 	};
 	control?.signal?.addEventListener("abort", markCancelled, { once: true });
+	let keepaliveTimer: NodeJS.Timeout | undefined;
+	const stopKeepalive = () => {
+		if (keepaliveTimer !== undefined) {
+			clearInterval(keepaliveTimer);
+			keepaliveTimer = undefined;
+		}
+	};
 
 	const baseChunk = (delta: Record<string, unknown>, finishReason: string | null) => ({
 		id,
@@ -584,6 +598,19 @@ export function encodeStream(
 			let hasToolCalls = false;
 			let finishReason: string = "stop";
 
+			keepaliveTimer = setInterval(() => {
+				try {
+					if (cancelled) {
+						stopKeepalive();
+						return;
+					}
+					controller.enqueue(encoder.encode(SSE_KEEPALIVE));
+				} catch {
+					// Controller already closed/errored (client gone); stop the timer.
+					stopKeepalive();
+				}
+			}, STREAM_KEEPALIVE_INTERVAL_MS);
+
 			try {
 				if (cancelled) {
 					controller.close();
@@ -733,11 +760,13 @@ export function encodeStream(
 					controller.close();
 				}
 			} finally {
+				stopKeepalive();
 				control?.signal?.removeEventListener("abort", markCancelled);
 			}
 		},
 		cancel(reason) {
 			cancelled = true;
+			stopKeepalive();
 			control?.signal?.removeEventListener("abort", markCancelled);
 			control?.onCancel?.(reason);
 		},

package/src/providers/openai-completions.ts

@@ -936,6 +936,7 @@ const streamOpenAICompletionsOnce = (
 						headers: headersWithTimeout,
 						body: params,
 						signal: requestSignal,
+						maxAttempts: options?.maxHttpAttempts,
 						fetch: wrapFetchForCopilotFallback(
 							options?.fetch,
 							model.provider === "github-copilot",
@@ -1866,7 +1867,7 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (mo
 	const resolvedModel = resolveOpenAICompletionsCompat(model);
 	return withReplaySafeStreamRetry(resolvedModel, context, options, streamOpenAICompletionsOnce, {
 		retryEmptyCompletion: true,
-		retryProviderErrors: true,
+		retryProviderErrors: options?.maxHttpAttempts === undefined,
 		maxProviderErrorRetries: 1,
 	});
 };

package/src/providers/pi-native-server.ts

@@ -55,6 +55,7 @@ const ALLOWED_OPTION_KEYS: ReadonlySet<keyof SimpleStreamOptions> = new Set([
 	"repetitionPenalty",
 	"stopSequences",
 	"maxTokens",
+	"maxHttpAttempts",
 	"cacheRetention",
 	"cachedContent",
 	"userProfileId",

package/src/registry/oauth/google-antigravity.ts

@@ -1,5 +1,5 @@
 /**
- * Antigravity OAuth flow (Gemini 3, Claude, GPT-OSS via Google Cloud)
+ * Google Antigravity OAuth flow (Gemini, Claude, GPT-OSS via Google Cloud)
  * Uses different OAuth credentials than google-gemini-cli for access to additional models.
  */
 import { type } from "@oh-my-pi/omptype";

package/src/stream.ts

@@ -1816,6 +1816,7 @@ function mapOptionsForApi<TApi extends Api>(
 		repetitionPenalty: options?.repetitionPenalty,
 		maxTokens: options?.maxTokens ?? model.maxTokens ?? undefined,
 		signal: options?.signal,
+		maxHttpAttempts: options?.maxHttpAttempts,
 		apiKey: apiKey ?? (typeof options?.apiKey === "string" ? options.apiKey : undefined),
 		credentialId: options?.credentialId,
 		oauthIdentity: options?.oauthIdentity,

package/src/types.ts

@@ -497,6 +497,11 @@ export interface StreamOptions {
 	frequencyPenalty?: number;
 	maxTokens?: number;
 	signal?: AbortSignal;
+	/**
+	 * OpenAI chat-completions HTTP attempt budget. When set, transient provider
+	 * errors are not replayed above the transport, so retries share this limit.
+	 */
+	maxHttpAttempts?: number;
 	apiKey?: string;
 	/** @internal Stored credential row serving this request, when known. */
 	credentialId?: number;

package/src/utils/openai-http.ts

@@ -68,6 +68,8 @@ export interface OpenAIStreamRequestInit {
 	body: unknown;
 	signal: AbortSignal;
 	fetch?: FetchImpl;
+	/** Override the default transport attempt budget for this request. */
+	maxAttempts?: number;
 	/** Optional caller-specific gate composed with shared transport retry exclusions. */
 	shouldRetryResponse?: (response: Response, bodyText: string) => boolean | Promise<boolean>;
 	/**
@@ -102,7 +104,7 @@ export async function postOpenAIStream<TEvent>(init: OpenAIStreamRequestInit): P
 		body: JSON.stringify(init.body),
 		signal: init.signal,
 		fetch: init.fetch,
-		maxAttempts: DEFAULT_MAX_ATTEMPTS,
+		maxAttempts: init.maxAttempts ?? DEFAULT_MAX_ATTEMPTS,
 		// A proxy concurrency-admission 429 (`rate_limit_type: max_parallel_requests`)
 		// surfaces immediately instead of being slept-and-retried here; session
 		// recovery owns its backoff/fallback (issue #8854).

package/src/utils/schema/dereference.ts

@@ -11,6 +11,43 @@
  */
 import { isJsonObject, type JsonObject } from "./types";
 
+// Only schema-valued keywords may contain references; literal JSON is opaque.
+const SCHEMA_MAP_KEYS: Record<string, true> = {
+	properties: true,
+	patternProperties: true,
+	dependencies: true,
+	dependentSchemas: true,
+};
+const SCHEMA_ARRAY_KEYS: Record<string, true> = { anyOf: true, oneOf: true, allOf: true, prefixItems: true };
+const SCHEMA_VALUE_KEYS: Record<string, true> = {
+	items: true,
+	additionalItems: true,
+	contains: true,
+	contentSchema: true,
+	propertyNames: true,
+	if: true,
+	// oxlint-disable-next-line unicorn/no-thenable -- JSON Schema keyword
+	then: true,
+	else: true,
+	not: true,
+	additionalProperties: true,
+	unevaluatedItems: true,
+	unevaluatedProperties: true,
+};
+
+function dereferenceKeyword(key: string, value: unknown, root: JsonObject, visiting: Set<string>): unknown {
+	if (Object.hasOwn(SCHEMA_MAP_KEYS, key) && isJsonObject(value)) {
+		const result: JsonObject = {};
+		for (const name in value) result[name] = dereferenceNode(value[name], root, visiting);
+		return result;
+	}
+	if ((Object.hasOwn(SCHEMA_ARRAY_KEYS, key) || key === "items") && Array.isArray(value)) {
+		return value.map(item => dereferenceNode(item, root, visiting));
+	}
+	if (Object.hasOwn(SCHEMA_VALUE_KEYS, key)) return dereferenceNode(value, root, visiting);
+	return value;
+}
+
 /**
  * Resolve a JSON-pointer-style `$ref` against the root schema's `$defs`
  * or `definitions` block. Returns `undefined` for external or unresolvable refs.
@@ -33,7 +70,6 @@ function resolveLocalRef(ref: string, root: JsonObject): JsonObject | undefined
  */
 function dereferenceNode(node: unknown, root: JsonObject, visiting: Set<string>): unknown {
 	if (!isJsonObject(node)) return node;
-	if (Array.isArray(node)) return node.map(item => dereferenceNode(item, root, visiting));
 
 	const ref = node.$ref;
 	if (typeof ref === "string") {
@@ -49,14 +85,17 @@ function dereferenceNode(node: unknown, root: JsonObject, visiting: Set<string>)
 		// referencing node. In draft 2020-12 these are valid alongside $ref.
 		let hasSiblings = false;
 		for (const k in node) {
-			if (k !== "$ref") {
+			if (k !== "$ref" && k !== "$defs" && k !== "definitions") {
 				hasSiblings = true;
 				break;
 			}
 		}
 		if (!hasSiblings || !isJsonObject(inlined)) return inlined;
-		const merged: JsonObject = { ...inlined, ...node };
-		delete merged.$ref;
+		const merged: JsonObject = { ...inlined };
+		for (const key in node) {
+			if (key === "$ref" || key === "$defs" || key === "definitions") continue;
+			merged[key] = dereferenceKeyword(key, node[key], root, visiting);
+		}
 		return merged;
 	}
 
@@ -66,13 +105,7 @@ function dereferenceNode(node: unknown, root: JsonObject, visiting: Set<string>)
 		// Skip $defs/definitions — they get inlined into consumers
 		if (key === "$defs" || key === "definitions") continue;
 
-		if (Array.isArray(value)) {
-			result[key] = value.map(item => dereferenceNode(item, root, visiting));
-		} else if (isJsonObject(value)) {
-			result[key] = dereferenceNode(value, root, visiting);
-		} else {
-			result[key] = value;
-		}
+		result[key] = dereferenceKeyword(key, value, root, visiting);
 	}
 	return result;
 }