@oh-my-pi/pi-ai 18.13.1 → 18.13.3

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+## [18.13.3] - 2026-10-28
+
+### Changed
+
+- Updated Bun engine requirement to ≥1.4.4
+
+## [18.13.2] - 2026-10-27
+
+### Fixed
+
+- Fixed OAuth logins shared by several processes being disabled with `invalid_grant` when they refreshed at the same time or one of them quit mid-refresh ([#17128](https://github.com/can1357/oh-my-pi/pull/17128) by [@sjawhar](https://github.com/sjawhar))
+- Fixed transient Google 429 rate-limit and capacity responses retrying in place without blocking or rotating credentials, while daily caps and zero-entitlement limits still rotate ([#17127](https://github.com/can1357/oh-my-pi/pull/17127) by [@GTanger](https://github.com/GTanger))
+- Fixed Aliyun DashScope's multimodal gateway failing a turn on its intermittent `InvalidParameter` 400s for valid inline images ("provided URL does not appear to be valid", "Download multimodal file timed out"); they are now retried ([#17101](https://github.com/can1357/oh-my-pi/pull/17101) by [@shuairongzeng](https://github.com/shuairongzeng))
+- Fixed a revoked or rejected GitHub Copilot credential continuing to show its last cached usage quota instead of being dropped ([#17081](https://github.com/can1357/oh-my-pi/issues/17081))
+- Fixed Devin requests compressing the request body on the UI thread, which briefly froze the TUI on long conversations; requests under 1 KiB are now sent uncompressed
+
 ## [18.13.1] - 2026-10-27
 
 ### Fixed
@@ -2308,21 +2324,4 @@
 
 - Removed legacy GitLab Duo Workflow `chat` and `software_development` flow paths and the non-MCP action bridge in favor of the inline custom `ambient` flow.
 
-## [16.1.23] - 2026-06-26
-
-### Added
-
-- Added a third streaming thinking-loop detection heuristic to catch "progress-lexicon stalls" where models endlessly reshuffle motivational filler without introducing new vocabulary or concrete technical references
-- Added branded wordmark and logo animation to authentication flow
-- Added a third streaming thinking-loop detection shape — a _progress-lexicon stall_ — alongside verbatim tail repetition and near-duplicate (trigram) segments. It catches reasoning-summarizer loops that reshuffle the same motivational filler ("just doing it, pushing ahead, maintaining momentum") into fresh word order every paragraph: word-trigrams never cluster, but a run of substantial segments that recycle the recent vocabulary and introduce no _new_ concrete reference (path / identifier / code-span) trips the guard. Summarizer title/heading lines (`**Bold Title**`, `## Heading`) are stripped before analysis so their ever-changing wording cannot mask the stall by inflating novelty. Calibrated against 537k real non-Gemini reasoning blocks (zero false positives at novelty floor 0.2 / run length 8; the real loop sustains runs of 10+).
-- Added CoreWeave Serverless Inference provider login support via `COREWEAVE_API_KEY` and `WANDB_API_KEY` fallback.
-
-### Changed
-
-- Redesigned the OAuth callback page (`oauth.html`) to match the oh-my-pi web brand language: OKLCH purple-tinted dark neutrals, magenta→iris→cyan brand gradient on the wordmark, frosted-glass card over an ascii grid backdrop, and a colored status halo around the success/error icon. All assets are inlined; the `__OAUTH_STATE__` injection contract and success/error JS logic are unchanged.
-
-### Fixed
-
-- Fixed local llama.cpp (and any local OpenAI-compatible server rendering the Qwen3.6+ chat template) re-processing the full prompt every new user message even with `replayReasoningContent` enabled (#3541 follow-up to #3528). Sending `reasoning_content` alone wasn't enough: Qwen3's chat template strips `<think>...</think>` from any assistant turn whose index is `<= last_query_index`, so the moment a new user message (the user's next prompt, or the auto-learn capture-at-stop nudge) lands, every prior assistant turn becomes "older" and is re-rendered without the `<think>` block — diverging from the generation tokens still in the slot's KV cache. The chat-completions encoder now emits `preserve_thinking: true` for Qwen thinking dialects on local servers, route-split the same way the existing `enable_thinking` emission is: the `qwen` dialect rides the top-level field (llama.cpp's `--jinja` hook and Alibaba Cloud Model Studio's compatible-mode), the `qwen-chat-template` dialect (NVIDIA NIM, vLLM/SGLang's chat-template-kwargs path) rides only `chat_template_kwargs.preserve_thinking` because NIM's request schema is `additionalProperties: false` and rejects unknown top-level fields (#2299). The emission is hoisted above the `reasoning.enabled` gate so it fires for THREE cases the original gating missed: (1) runtime-discovered local Qwen models that ship with `reasoning: false` because the upstream `/v1/models` doesn't advertise the capability (same gotcha #3532 fixed for `replayReasoningContent`), (2) caller-disabled reasoning (`/think off`) — the kwarg is a history-rendering knob, not a per-turn thinking switch, and the slot still holds `<think>` tokens from earlier turns, and (3) forced-tool-choice / DeepSeek-style auto-disable. Qwen3.6+ then renders `<think>...</think>` for every assistant turn regardless of position, and the next-turn render matches the cached generation tokens. ([#3541](https://github.com/can1357/oh-my-pi/issues/3541))
-
-Older entries are archived in [packages/ai/CHANGELOG.md@917a36589039](https://github.com/can1357/oh-my-pi/blob/917a365890396071a959dfd2865a3538518ef717/packages/ai/CHANGELOG.md).
+Older entries are archived in [packages/ai/CHANGELOG.md@a36a1f252e23](https://github.com/can1357/oh-my-pi/blob/a36a1f252e23031accb25bacf2b9894605ba524f/packages/ai/CHANGELOG.md).

package/dist/types/auth/refresh.d.ts

@@ -54,7 +54,7 @@ export declare class OAuthRefresher {
      * continuing.
      */
     disableDefinitiveFailure(provider: string, credentialId: number | undefined, attemptedCredential: OAuthCredential, index: number, errorMsg: string): Promise<"disabled" | "peer-rotated" | "cas-lost">;
-    refresh(provider: Provider, credential: OAuthCredential, credentialId: number | undefined, signal?: AbortSignal, reason?: OAuthRefreshReason): Promise<OAuthCredentials>;
+    refresh(provider: Provider, credential: OAuthCredential, credentialId: number | undefined, signal?: AbortSignal, reason?: OAuthRefreshReason, rejectedAccess?: string): Promise<OAuthCredentials>;
     /**
      * Refresh the OAuth credential with the given id through a per-credential
      * single-flight. Concurrent callers for the same row await the same upstream

package/dist/types/auth/sqlite-credential-store.d.ts

@@ -6,7 +6,7 @@
  */
 import type { Database } from "bun:sqlite";
 import { isSqliteBusyError, isSqliteCorruptionError } from "@oh-my-pi/pi-utils";
-import type { AuthCredentialStore, CredentialRefreshLeaseFence } from "./store.js";
+import type { AuthCredentialStore, CredentialRefreshLeaseFence, CredentialRefreshLeaseHolder } from "./store.js";
 import type { AuthCredential, DisabledCredentialSummary, OAuthCredential, StoredAuthCredential, StoredCredentialBlock } from "./types.js";
 import type { OAuthCredentials } from "../registry/oauth/types.js";
 import type { ClientUsageReport, ClientUsageSummary, UsageHistoryEntry, UsageHistoryQuery } from "../usage.js";
@@ -89,6 +89,8 @@ export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
     tryAcquireCredentialRefreshLease(credentialId: number, owner: string, expiresAtMs: number): boolean;
     getCredentialRefreshLeaseExpiresAt(credentialId: number): number | undefined;
     renewCredentialRefreshLease(credentialId: number, owner: string, expiresAtMs: number): boolean;
+    getCredentialRefreshLeaseHolder(credentialId: number): CredentialRefreshLeaseHolder | undefined;
+    handBackCredentialRefreshLease(credentialId: number, owner: string, holder: CredentialRefreshLeaseHolder): boolean;
     releaseCredentialRefreshLease(credentialId: number, owner: string): void;
     recordUsageSnapshots(entries: UsageHistoryEntry[]): void;
     listUsageHistory(query?: UsageHistoryQuery): UsageHistoryEntry[];

package/dist/types/auth/store.d.ts

@@ -96,6 +96,19 @@ export interface CredentialRefreshLeaseStore {
     getCredentialRefreshLeaseExpiresAt(credentialId: number): number | undefined;
     releaseCredentialRefreshLease(credentialId: number, owner: string): void;
     renewCredentialRefreshLease(credentialId: number, owner: string, expiresAtMs: number): boolean;
+    /** The lease row as stored, expired or not; `undefined` when no lease row exists. */
+    getCredentialRefreshLeaseHolder?(credentialId: number): CredentialRefreshLeaseHolder | undefined;
+    /**
+     * Give a lease this owner took back to the holder it replaced, with that
+     * holder's own expiry, so the holder can still renew it and save the token
+     * it may have exchanged. Returns false when `owner` no longer holds it.
+     */
+    handBackCredentialRefreshLease?(credentialId: number, owner: string, holder: CredentialRefreshLeaseHolder): boolean;
+}
+/** Owner and expiry of a stored refresh lease row. */
+export interface CredentialRefreshLeaseHolder {
+    owner: string;
+    expiresAtMs: number;
 }
 /** Usage history and client-observed request accounting. */
 export interface UsageLedgerStore {

package/dist/types/auth/types.d.ts

@@ -434,6 +434,13 @@ export type AuthApiKeyOptions = {
     forceRefresh?: boolean;
     /** Explicit provider-401 recovery; generic force refreshes leave this unset. */
     refreshReason?: OAuthRefreshReason;
+    /**
+     * The access token the provider rejected with a 401, when this resolve is
+     * that 401's recovery. A refresh adopts a stored token that differs from it
+     * instead of exchanging the refresh token again: with single-use refresh
+     * tokens every needless exchange revokes the token its peers are using.
+     */
+    rejectedAccessToken?: string;
     /** When false, select as `sessionId` would without recording the choice as that session's sticky credential. */
     recordAffinity?: boolean;
 };
@@ -555,6 +562,12 @@ export interface StoredOAuthRefreshOptions<T extends OAuthCredential = OAuthCred
     observedCredential?: T;
     credentialFromRow: (credential: OAuthCredential) => T | undefined;
     forceRefresh?: boolean;
+    /**
+     * The access token a provider just rejected with a 401. A forced refresh
+     * adopts a still-fresh stored row whose token differs from it: another
+     * process rotated the row, and its token has not been rejected.
+     */
+    rejectedAccess?: string;
     canRefresh?: (credential: T) => boolean;
     refreshSkewMs?: number;
     signal?: AbortSignal;
@@ -963,6 +976,8 @@ export interface OAuthRefreshByIdOptions {
      * Local reuse still requires {@link reuseRecentMint}.
      */
     reason?: OAuthRefreshReason;
+    /** The access token a provider 401 rejected; see {@link AuthApiKeyOptions.rejectedAccessToken}. */
+    rejectedAccess?: string;
 }
 /** OAuth login, access, account identity, and refresh operations. */
 export interface OAuthApi {

package/dist/types/auth-gateway/dispatch.d.ts

@@ -1,4 +1,4 @@
-import type { ApiKeyResolver, ResolvedApiKey } from "../auth-retry.js";
+import { type ApiKeyResolver, type ResolvedApiKey } from "../auth-retry.js";
 import type { AuthStorage } from "../auth-storage.js";
 import { type GatewayErrorClassification } from "../error/gateway.js";
 import type { Api, FetchImpl, Model, Usage } from "../types.js";

package/dist/types/auth-retry.d.ts

@@ -36,6 +36,13 @@ export interface ResolvedApiKey {
     apiKey: string;
     /** Durable row id of the credential that supplied this bearer, when known. */
     credentialId?: number;
+    /**
+     * The OAuth access token behind this bearer, when the bearer came from a
+     * stored OAuth credential. A provider whose API key wraps the token in a
+     * structured document makes the two differ, so a 401 recovery names this
+     * one as the token the provider rejected.
+     */
+    oauthAccess?: string;
     /**
      * Resolved after `LimitsApi.rotate` slept out a sibling's short block
      * (`afterSiblingWait`): the driver accepts this bearer even if the request
@@ -55,6 +62,18 @@ export declare function resolvedApiKeyBearer(resolved: ApiKeyResolution): string
  * resolvers (`KeyCascade.resolver`, coding-agent `createApiKeyResolver`).
  */
 export declare function markAfterSiblingWait(resolved: ApiKeyResolution): ApiKeyResolution;
+/**
+ * Remembers which OAuth access token produced each bearer a resolver served,
+ * so a 401 recovery can name the token of the request that actually failed.
+ * A resolver serves many requests, and they fail out of order: the last
+ * resolution is not that request's identity. Used by every resolver that
+ * serves more than one request ({@link KeyCascade.resolver}, the coding
+ * agent's `createApiKeyResolver`, the auth gateway's resolver).
+ */
+export declare function createOAuthProvenance(): {
+    record: (resolved: ApiKeyResolution) => void;
+    accessFor: (bearer: string | undefined) => string | undefined;
+};
 /** A static bearer string, or a {@link ApiKeyResolver} that mints/rotates one. */
 export type ApiKey = string | ApiKeyResolver;
 /** Keyless-provider credential marker; transports must not send it in authentication headers. */

package/dist/types/error/flags.d.ts

@@ -94,6 +94,7 @@ export declare function isImmutableLatestThinkingText(text: string): boolean;
  * output, so callers strip {@link Flag.Transient} when this matches.
  */
 export declare const LLAMA_CPP_TOOL_CALL_PARSE_PATTERN: RegExp;
+export declare const ALIYUN_MM_GATEWAY_PATTERN: RegExp;
 /** Whether an OAuth refresh error message means the grant is definitively dead. */
 export declare function isOAuthExpiry(errorMessage: string): boolean;
 export declare function create(...flags: number[]): number;

package/dist/types/providers/google-types.d.ts

@@ -157,5 +157,6 @@ export interface GenerateContentResponse {
         code?: number;
         message?: string;
         status?: string;
+        details?: unknown[];
     };
 }

package/dist/types/providers/openai-completions.d.ts

@@ -3,6 +3,8 @@ import type { AssistantMessage, Context, Model, ServiceTier, StreamFunction, Str
 import type { ChatCompletionMessageParam } from "./openai-chat-wire.js";
 import { type OpenAIPromptCacheOptions } from "./openai-shared.js";
 export { applyOpenRouterRoutingVariant } from "./openai-shared.js";
+/** Whether a thinking block's signature is a raw LiteLLM (Anthropic) one, not a reasoning field name. */
+export declare function isLiteLLMThinkingSignature(signature: string | undefined): signature is string;
 /**
  * Identify "real progress" stream chunks vs. keepalives, role-only preambles,
  * and empty `{choices:[]}` no-ops emitted by some OpenAI-compatible endpoints.
@@ -43,4 +45,15 @@ export interface OpenAICompletionsOptions extends StreamOptions {
  */
 export declare const streamOpenAICompletions: StreamFunction<"openai-completions">;
 export declare function parseChunkUsage(rawUsage: object, model: Model<"openai-completions">, premiumRequests: number | undefined, timestamp?: number, cachedTokensHeader?: number): AssistantMessage["usage"];
+/**
+ * Whether every chat-completions request to `model` drops the thinking text of
+ * its own prior turns: neither the base compat nor its `whenThinking` view
+ * sends it. Blocks with a raw LiteLLM signature ({@link isLiteLLMThinkingSignature})
+ * still replay in `thinking_blocks`.
+ */
+export declare function completionsDropsOwnThinking(model: {
+    api?: string;
+    reasoning?: boolean;
+    compat?: Model["compat"];
+} | null | undefined): boolean;
 export declare function convertMessages(model: Model<"openai-completions">, context: Context, compat: ResolvedOpenAICompat): ChatCompletionMessageParam[];

package/dist/types/providers/transform-messages.d.ts

@@ -1,3 +1,4 @@
+import type { ResolvedOpenAICompat } from "@oh-my-pi/pi-catalog/types";
 import type { Api, AssistantMessage, Message, Model } from "../types.js";
 /**
  * Maximum tool-call id length the strictest replay provider accepts.
@@ -54,6 +55,14 @@ export declare function isSurvivingAssistant(msg: AssistantMessage, model?: Mode
 export declare function isAnthropicMessagesModel(model: Model): model is Model<"anthropic-messages">;
 /** Whether `turn` came from `model` itself: its own turns replay their native reasoning unchanged. */
 export declare function isSameModelTurn(turn: Pick<AssistantMessage, "provider" | "api" | "model">, model: Pick<Model, "provider" | "api" | "id">): boolean;
+/**
+ * Whether chat completions (`convertMessages`) writes the model's own past
+ * thinking under `compat`: as Mistral content parts, demoted text, or a
+ * reasoning field. Otherwise it drops it.
+ */
+export declare function completionsSendsOwnThinking(model: {
+    reasoning?: boolean;
+}, compat: Pick<ResolvedOpenAICompat, "mistralReasoningContentParts" | "requiresThinkingAsText" | "requiresReasoningContentForToolCalls" | "thinkingFormat" | "replayReasoningContent">): boolean;
 /**
  * Normalize tool call ID for cross-provider compatibility.
  * OpenAI Responses API generates IDs that are 450+ chars with special characters like `|`.

package/dist/types/utils/request-compression.d.ts

@@ -1,4 +1,6 @@
 import type { FetchImpl, Model } from "../types.js";
+/** Bodies below one TCP segment gain nothing from compression; skip them. */
+export declare const MIN_COMPRESSED_BODY_BYTES = 1024;
 /**
  * Compresses request bodies from {@link model} to its provider's own endpoint
  * when its catalog rules declare encodings the endpoint decodes

package/dist/types/utils/schema/json-schema-validator.d.ts

@@ -28,14 +28,11 @@ export declare function getTagSelectedUnionBranch(branches: readonly unknown[],
  * schemas asking about the same name keep separate answers, and one schema
  * asked about two names keeps two answers.
  *
- * The root identity covers the graph because the schema graphs reaching this
- * function are already treated as immutable for the lifetime of their
- * identity: `toolWireSchema` memoizes the wire schema against the tool's
- * parameters, and `stripSchemaDescriptions`, `tryEnforceStrictSchema` and
- * `memoizedInjectIntentIntoSchema` already memoize derived values against
- * that same wire-schema object. A graph mutated in place after production
- * would already hand those three a stale answer; this cache adds no new
- * assumption beyond the ones the schema pipeline already relies on.
+ * The root identity covers the graph because callers must not mutate a schema
+ * after its first query: wire schemas are covered by that same rule (their
+ * derived values memoize against the same identity), and raw MCP
+ * `inputSchema` and eval-tool `parameters` graphs reach this function with no
+ * other stamp on them, so a new identity is what resets the memo for those.
  */
 export declare function schemaDefinesProperty(schema: unknown, key: string): boolean;
 export declare function validateJsonSchemaValue(schema: unknown, value: unknown, root?: unknown): JsonSchemaValidationResult;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.13.1",
+	"version": "18.13.3",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,16 +155,16 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.13.1",
-		"@oh-my-pi/pi-catalog": "18.13.1",
-		"@oh-my-pi/pi-natives": "18.13.1",
-		"@oh-my-pi/pi-utils": "18.13.1",
-		"@oh-my-pi/pi-wire": "18.13.1"
+		"@oh-my-pi/omptype": "18.13.3",
+		"@oh-my-pi/pi-catalog": "18.13.3",
+		"@oh-my-pi/pi-natives": "18.13.3",
+		"@oh-my-pi/pi-utils": "18.13.3",
+		"@oh-my-pi/pi-wire": "18.13.3"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"
 	},
 	"engines": {
-		"bun": ">=1.3.14"
+		"bun": ">=1.4.4"
 	}
 }

package/src/auth/cascade.ts

@@ -1,6 +1,6 @@
 import { authPolicyFor } from "@oh-my-pi/pi-catalog/compat/auth";
 import { $env, $envExact, logger } from "@oh-my-pi/pi-utils";
-import { type ApiKeyResolver, markAfterSiblingWait, type ResolvedApiKey } from "../auth-retry";
+import { type ApiKeyResolver, createOAuthProvenance, markAfterSiblingWait, type ResolvedApiKey } from "../auth-retry";
 import { getEnvApiKey, getEnvApiKeyName } from "../env-api-key";
 import * as AIError from "../error";
 import { isUsageLimitOutcome } from "../error/rate-limit";
@@ -332,11 +332,19 @@ export class KeyCascade implements KeysApi {
 	): Promise<ResolvedApiKey | undefined> {
 		let credentialId: number | undefined;
 		let oauthIdentity: OAuthRequestIdentity | undefined;
-		const apiKey = await this.#resolve(provider, sessionId, options, (id, identity) => {
+		let oauthAccess: string | undefined;
+		const apiKey = await this.#resolve(provider, sessionId, options, (id, identity, access) => {
 			credentialId = id;
 			oauthIdentity = identity;
+			oauthAccess = access;
 		});
-		return apiKey === undefined ? undefined : { apiKey, credentialId, ...(oauthIdentity ? { oauthIdentity } : {}) };
+		if (apiKey === undefined) return undefined;
+		return {
+			apiKey,
+			credentialId,
+			...(oauthAccess ? { oauthAccess } : {}),
+			...(oauthIdentity ? { oauthIdentity } : {}),
+		};
 	}
 
 	/**
@@ -365,7 +373,7 @@ export class KeyCascade implements KeysApi {
 		provider: string,
 		sessionId?: string,
 		options?: AuthApiKeyOptions,
-		onCredentialId?: (id: number, identity?: OAuthRequestIdentity) => void,
+		onCredentialId?: (id: number, identity?: OAuthRequestIdentity, oauthAccess?: string) => void,
 	): Promise<string | undefined> {
 		const restricted = this.#deps.affinity.isRestricted(provider, sessionId);
 		// Runtime override takes highest priority
@@ -405,7 +413,8 @@ export class KeyCascade implements KeysApi {
 		if (oauthResolved) {
 			if (onCredentialId && oauthResolved.credentialId !== undefined) {
 				const { orgId, region, inferenceRegion } = oauthResolved.credential;
-				onCredentialId(oauthResolved.credentialId, { orgId, region, inferenceRegion });
+				const identity = { orgId, region, inferenceRegion };
+				onCredentialId(oauthResolved.credentialId, identity, oauthResolved.credential.access);
 			}
 			return oauthResolved.apiKey;
 		}
@@ -476,13 +485,18 @@ export class KeyCascade implements KeysApi {
 	 */
 	resolver(provider: string, options?: { sessionId?: string; baseUrl?: string; modelId?: string }): ApiKeyResolver {
 		const { sessionId, baseUrl, modelId } = options ?? {};
+		// One resolver serves many requests, and they fail out of order, so the
+		// token a 401 rejected is looked up from the bearer that request sent.
+		const provenance = createOAuthProvenance();
+		const resolve = async (extra: AuthApiKeyOptions): Promise<ResolvedApiKey | undefined> => {
+			const resolved = await this.getWithCredential(provider, sessionId, { baseUrl, modelId, ...extra });
+			provenance.record(resolved);
+			return resolved;
+		};
 		return async ({ lastChance, error, signal, previousKey }) => {
+			const rejectedAccessToken = provenance.accessFor(previousKey);
 			if (error === undefined) {
-				return this.getWithCredential(provider, sessionId, {
-					baseUrl,
-					modelId,
-					signal,
-				});
+				return resolve({ signal });
 			}
 			if (lastChance) {
 				const rotation = await this.#deps.rotate(provider, sessionId, {
@@ -499,18 +513,13 @@ export class KeyCascade implements KeysApi {
 					// because a peer may have refreshed the failed bearer.
 					if (AIError.isUsageLimit(error) || isUsageLimitOutcome(status, message)) return undefined;
 				}
-				const resolved = await this.getWithCredential(provider, sessionId, {
-					baseUrl,
-					modelId,
-					signal,
-				});
+				const resolved = await resolve({ signal });
 				return rotation.afterSiblingWait ? markAfterSiblingWait(resolved) : resolved;
 			}
-			return this.getWithCredential(provider, sessionId, {
-				baseUrl,
-				modelId,
+			return resolve({
 				forceRefresh: true,
 				refreshReason: AIError.status(error) === 401 ? "auth-recovery" : undefined,
+				rejectedAccessToken,
 				signal,
 			});
 		};

package/src/auth/oauth.ts

@@ -185,6 +185,7 @@ export class OAuthAccounts implements OAuthApi {
 				await this.refresh(selection.credentialId, options.signal, {
 					reuseRecentMint: options.refreshReason === "auth-recovery",
 					reason: options.refreshReason,
+					rejectedAccess: options.rejectedAccessToken,
 				});
 				// The refresh re-lists rows, so a concurrently removed row can shift this one's position.
 				index = this.#deps.pool.entries(provider).findIndex(entry => entry.id === selection.credentialId);