@oh-my-pi/pi-ai 18.13.3 → 18.14.1

package/CHANGELOG.md

@@ -2,6 +2,59 @@
 
 ## [Unreleased]
 
+## [18.14.1] - 2026-10-31
+
+### Added
+
+- Added the `codexAccessPrograms` stream option and `configureCodexAccessPrograms()` process default to turn off the automatic Daybreak Blue `access_programs` request on Codex ([#17508](https://github.com/can1357/oh-my-pi/pull/17508) by [@H4vC](https://github.com/H4vC))
+- Added `waitForSibling` to `RotateCredentialOptions`; set it to `false` to skip the short sibling-unblock wait in `limits.rotate()` while still blocking the failed credential ([#17439](https://github.com/can1357/oh-my-pi/pull/17439) by [@wolfiesch](https://github.com/wolfiesch))
+
+### Changed
+
+- Cursor runs served through `omp auth-gateway` are limited to the client's own tools, all advertised as MCP; Cursor's built-in tools (file, shell, edit, todo, web fetch, SCM) are no longer offered on that path ([#17382](https://github.com/can1357/oh-my-pi/pull/17382) by [@eggpeat](https://github.com/eggpeat))
+
+### Fixed
+
+- Fixed native judgment requests (TypeSafe, OpenRouter Decisions, OpenAI Decisions, Workers AI) sending credentials in their state unredacted while credential redaction was on ([#17443](https://github.com/can1357/oh-my-pi/pull/17443))
+- Fixed every new Codex session, including each subagent, losing a response and retrying when the native turn lane refuses live steering; once refused, later sessions on the same account, endpoint, and model queue follow-ups for four hours ([#14158](https://github.com/can1357/oh-my-pi/issues/14158), [#17438](https://github.com/can1357/oh-my-pi/pull/17438) by [@wolfiesch](https://github.com/wolfiesch))
+- Fixed Cursor models served through `omp auth-gateway` being told their file and shell tools were unavailable while the client ran the calls anyway, in Cursor's own argument shape (edits failed validation); each call now reaches the client as one of its own tools and the turn stops with `toolUse` until the result comes back ([#17382](https://github.com/can1357/oh-my-pi/pull/17382) by [@eggpeat](https://github.com/eggpeat))
+- Fixed Cursor models served through `omp auth-gateway` being told each tool call was handed off, which left Composer issuing calls blind and answering their results with empty stops; the gateway now keeps the Cursor run open while the client runs a step's calls and answers them in-band with the client's results on its next request (up to 30 minutes; otherwise the turn is rebuilt from history as before) ([#17382](https://github.com/can1357/oh-my-pi/pull/17382) by [@eggpeat](https://github.com/eggpeat))
+- Fixed Anthropic-compatible endpoints behind a relay opening a new connection for every turn: the response body is now drained for up to 2.5 s after `message_stop` instead of being cancelled, so the kept-alive connection is reused ([#17432](https://github.com/can1357/oh-my-pi/pull/17432) by [@flosrn](https://github.com/flosrn))
+
+## [18.14.0] - 2026-10-29
+
+### Breaking Changes
+
+- Moved Anthropic header and endpoint helpers, along with Codex session/transport inspection and OpenAI Responses replay/storage helpers, to dedicated provider modules. Update imports from the previous locations.
+- Updated auth-gateway model resolvers to receive `ModelResolveOptions`, including the route's native API wire and the scoped client's accepted grants. Scoped client IDs no longer fall back to scanning all models; resolvers now select the best permitted candidate.
+
+### Added
+
+- Added mTLS support for Anthropic connections through the `CLAUDE_CODE_CLIENT_CERT` and `CLAUDE_CODE_CLIENT_KEY` environment variables.
+
+### Changed
+
+- Provider implementations are now loaded on demand, reducing startup and memory overhead while preserving existing stream timeouts, cancellation, and host overrides.
+- Account policy `priority` now takes precedence when usage information is temporarily unavailable, keeping new sessions on the preferred account.
+- Improved provider-specific credential usage lookups so they no longer wait for unrelated providers, while preserving cache freshness, cancellation isolation, and complete aggregate reports. The corresponding server-side latency improvement requires an updated auth broker.
+- Credential usage is now prefetched during session setup without selecting, pinning, or advancing the OAuth account rotation.
+
+### Fixed
+
+- Fixed Mistral thinking-message replay requests that could be rejected by LiteLLM with a `422 extra_forbidden` error.
+- Fixed native Judge API requests missing the `omp/<version>` User-Agent, so omp usage is correctly identified in upstream statistics.
+- Fixed Codex capacity-error retries over WebSocket and SSE ignoring provider-supplied `Retry-After` delays and retrying too early.
+- Fixed cancelled OAuth refresh requests aborting the entire session, and ensured requests joining an existing refresh can still use the refreshed credential when the original request is cancelled.
+- Fixed Cursor models losing omp system-prompt context, including context files, skills, and rules, on subsequent turns or when earlier messages precede the active turn.
+- Fixed short-lived commands that refresh OAuth credentials, such as `omp token --force-refresh`, remaining open for several seconds after completing.
+- Fixed TypeSafe authentication when `TYPESAFE_BASE_URL` is configured by validating keys against the correct `/v1/models` endpoint.
+- Fixed forced tool calls on non-reasoning models causing an unhandled reasoning-effort error.
+- Fixed interrupted turns reporting a transport error instead of the caller-provided cancellation reason.
+- Fixed long-running pi-native turns being terminated before their first event by fetch or proxy timeouts by supporting keepalives and the configured first-event timeout.
+- Fixed pi-native clients crashing when the auth gateway reports an upstream failure during streaming.
+- Fixed Cursor turns failing after a mid-turn stream interruption when an automatic retry receives a zero-token provider error; retries now continue on the rotated conversation.
+- Corrected auth-gateway debug logs so they no longer claim a retry occurred when a usage-limit error was returned without retrying.
+
 ## [18.13.3] - 2026-10-28
 
 ### Changed
@@ -2266,62 +2319,4 @@
 - Enabled freeform tool patch support for Azure OpenAI and Codex models.
 - Fixed an issue where the `/usage show` command returned "No usage data available" when using a custom proxy base URL for Codex.
 
-## [16.2.2] - 2026-06-27
-
-### Added
-
-- Added a comprehensive, public-facing error module exported via the "./error" path, featuring structured error classification, provider-specific HTTP error classes (e.g., Anthropic, OpenAI, Gemini), OAuth/Auth-specific errors, rate-limit utilities, and retryability predicates.
-
-### Changed
-
-- Updated OpenAI Codex defaults to increase default text verbosity to medium, enable detailed reasoning summaries by default, and include all turns in the reasoning context by default.
-- Updated the OpenAI Codex WebSocket transport to resolve its configuration (via PI_CODEX_WEBSOCKET_* environment variables) once at startup rather than re-parsing on every request.
-- Enhanced cross-model reasoning recovery and preservation to render demoted reasoning in the target model's canonical inline thinking dialect (such as Gemini's thinking fence or standard think tags) to prevent leaking inert context or control tokens into history.
-- Broadened the leaked-thinking stream healer to recover reasoning emitted in any dialect's canonical idiom (including Gemini, Gemma, Harmony, and scratchpads) and route them to thinking events instead of raw markup.
-- Implemented automatic retry logic for detected thinking-loop stalls to improve response reliability.
-- Hardened stateful delta chaining to ignore transient streaming bookkeeping symbols during structural equality checks, preventing unnecessary full-transcript replays.
-
-### Fixed
-
-- Fixed preservation of OpenAI Responses assistant message phase values across auth-gateway parsing, streaming, and history replay, ensuring GPT-5.4/GPT-5.5 intermediate updates and final answers retain their original phase labels.
-
-### Removed
-
-- Removed Pi dialect support and related serialization/parsing logic.
-
-## [16.2.0] - 2026-06-27
-
-### Breaking Changes
-
-- Removed the `@oh-my-pi/pi-ai/utils/json-parse` module. The JSON repair and parsing helpers (`repairJson`, `parseJsonWithRepair`, `parseStreamingJson`, `parseStreamingJsonThrottled`) have been moved to `@oh-my-pi/pi-utils` to be shared across utilities.
-
-### Added
-
-- Added the GitLab Duo Agent provider (`gitlab-duo-agent`) and built-in implementation, renaming the existing AI Gateway proxy provider to "GitLab Duo Non-Agentic" (`gitlab-duo`).
-- Added GitLab Duo Workflow provider support, featuring OAuth login via the official VS Code OAuth application, automatic project discovery, and automatic session-time namespace Duo settings enablement.
-- Added runaway detection for Gemini models to interrupt streams stuck in excessive planning steps.
-- Added a per-provider in-flight request limiter for LLM streams, shared across local OMP processes and configurable via `maxInFlightRequests`.
-- Added a `credits` field to `UsageResetCredits` to display when banked rate-limit resets expire, with support for OpenAI Codex usage details.
-
-### Changed
-
-- Optimized GitLab Duo Agent and Workflow providers to use an inline custom "ambient" flow with MCP-only agent privileges, registering MCP tools under their bare names.
-- Improved GitLab Duo Agent context management and auto-compaction by lowering the soft overflow threshold to 1 MB and stripping redundant bytes (such as tool-call UUIDs and escaped JSON) from the goal transcript.
-- Enhanced GitLab Duo Agent prompt engineering to render replayed tool calls as past-tense records, reducing model confusion and preventing the model from mimicking historical markers.
-- Added caching for discovered GitLab Duo Agent root namespaces per account to avoid redundant discovery requests.
-
-### Fixed
-
-- Fixed various GitLab Duo Agent and Workflow stability issues, including infinite tool-call loops, connection hangs on half-open WebSockets, and unhandled step-limit or generic server-side failures.
-- Improved GitLab Duo Workflow routing, namespace resolution, and project-path handling, ensuring correct numeric ID resolution and support for self-managed GitLab relative install base paths.
-- Fixed GitLab Duo Workflow checkpoint streaming to correctly map reasoning entries to thinking blocks, preserve tool boundaries, and accurately report token usage.
-- Fixed `AuthStorage.login` to only synthesize manual-code paste prompts for paste-code providers, preventing terminal-blocking races on loopback OAuth flows.
-- Fixed llama.cpp compatibility by downgrading named forced `tool_choice` objects to the string `"required"` in the chat-completions encoder.
-- Fixed `omp usage` omitting Ollama and Ollama Cloud accounts by registering placeholder usage providers.
-- Fixed Gemini reasoning-runaway detection to expose a dedicated thought-summary header guard to interrupt streams stuck in planning loops.
-
-### Removed
-
-- Removed legacy GitLab Duo Workflow `chat` and `software_development` flow paths and the non-MCP action bridge in favor of the inline custom `ambient` flow.
-
-Older entries are archived in [packages/ai/CHANGELOG.md@a36a1f252e23](https://github.com/can1357/oh-my-pi/blob/a36a1f252e23031accb25bacf2b9894605ba524f/packages/ai/CHANGELOG.md).
+Older entries are archived in [packages/ai/CHANGELOG.md@cef4a452836c](https://github.com/can1357/oh-my-pi/blob/cef4a452836c7a8d547dd14470c34c9ed2dbb5f8/packages/ai/CHANGELOG.md).

package/dist/types/auth/abort.d.ts

@@ -1,6 +1,8 @@
 /**
  * Race `promise` against `signal`, rejecting only this caller when the signal
  * fires. The underlying promise keeps running so other awaiters on the same
- * single-flight operation aren't punished by a peer's cancel.
+ * single-flight operation aren't punished by a peer's cancel. It stays
+ * observed either way: a caller that leaves must not turn the work's later
+ * rejection into an unhandled one.
  */
 export declare function raceSignal<T>(promise: Promise<T>, signal: AbortSignal | undefined, message: string): Promise<T>;

package/dist/types/auth/cascade.d.ts

@@ -140,6 +140,8 @@ export declare class KeyCascade implements KeysApi {
      * {@link KeyCascade.getWithCredential}, which surfaces it.
      */
     get(provider: string, sessionId?: string, options?: AuthApiKeyOptions): Promise<string | undefined>;
+    /** Warm selection metadata during session startup without choosing or pinning an account. */
+    prefetchUsage(provider: string, sessionId?: string, options?: AuthApiKeyOptions): Promise<void>;
     /**
      * Build an {@link ApiKeyResolver} backed by this storage, implementing the
      * central a/b/c auth-retry policy:

package/dist/types/auth/rotation.d.ts

@@ -63,7 +63,8 @@ export declare class RateLimits implements LimitsApi {
      * For usage-limit and account-policy failures with no free sibling, sleeps
      * until the earliest sibling unblocks when that is at most
      * {@link SIBLING_UNBLOCK_WAIT_MAX_MS} away, then reports `afterSiblingWait`.
-     * Aborting `options.signal` during that wait rejects.
+     * Setting `options.waitForSibling` to false skips that wait without skipping
+     * the failed credential's block. Aborting `options.signal` during the wait rejects.
      */
     rotate(provider: string, sessionId: string | undefined, options?: RotateCredentialOptions): Promise<CredentialRotation>;
 }

package/dist/types/auth/select.d.ts

@@ -68,6 +68,8 @@ export declare class CredentialSelector {
         index: number;
     } | undefined;
     selectApiKey(provider: string, sessionId: string | undefined, options: AuthApiKeyOptions | undefined, filter?: (credential: ApiKeyCredential) => boolean): Promise<ApiKeySelection | undefined>;
+    /** Warm exactly the usage fetches a fresh, unpinned OAuth ranking pass needs. */
+    prefetchUsage(provider: string, sessionId?: string, options?: AuthApiKeyOptions): Promise<void>;
     /**
      * Resolves an OAuth credential, trying credentials in priority order.
      *

package/dist/types/auth/store.d.ts

@@ -170,7 +170,7 @@ export interface CredentialUpstream {
      *
      * `signal` propagates the agent's cancel down to the broker fetch.
      */
-    fetchUsageReports(signal?: AbortSignal): Promise<UsageReport[] | null>;
+    fetchUsageReports(signal?: AbortSignal, provider?: Provider): Promise<UsageReport[] | null>;
     /**
      * Optional store-supplied per-credential usage report lookup. When present,
      * `AuthStorage` consults this before its own per-credential upstream fetch

package/dist/types/auth/types.d.ts

@@ -32,7 +32,7 @@ export interface AuthAccountSelector {
 export interface AuthAccountPolicy {
     readonly provider: string;
     readonly account: AuthAccountSelector;
-    /** Higher values win after hard, plan, reserve, hot-window, and measured-usage safety checks. */
+    /** Higher values win after hard, plan, reserve and hot-window safety checks, and ahead of a missing usage report. */
     readonly priority?: number;
     /** Protected remaining quota percentage for this account. */
     readonly reservePct?: number;
@@ -698,6 +698,8 @@ export type RotateCredentialOptions = {
     apiKey?: string;
     credentialId?: number;
     signal?: AbortSignal;
+    /** Whether to wait for a briefly blocked sibling; defaults to true. The failed credential is blocked either way. */
+    waitForSibling?: boolean;
 };
 /**
  * Outcome of {@link LimitsApi.rotate}.
@@ -863,6 +865,12 @@ export interface KeysApi {
      * {@link KeysApi.getWithCredential}, which surfaces that failure.
      */
     get(provider: string, sessionId?: string, options?: AuthApiKeyOptions): Promise<string | undefined>;
+    /**
+     * Warm usage needed by an unpinned OAuth selection without choosing a key,
+     * advancing round-robin state, or pinning an account. Existing overrides,
+     * pinned sessions, and pools that do not rank usage do no work.
+     */
+    prefetchUsage(provider: string, sessionId?: string, options?: AuthApiKeyOptions): Promise<void>;
     /**
      * Resolve a bearer together with its durable stored credential row id, when known.
      * Same precedence as {@link KeysApi.get}, but rejects with
@@ -1136,8 +1144,9 @@ export interface SessionsApi {
 }
 /** Usage reporting, observation, and provider configuration. */
 export interface UsageApi {
-    /** Fetch aggregate usage reports for configured providers. */
+    /** Fetch usage reports for configured providers, optionally restricted to one provider. */
     reports(options?: {
+        provider?: Provider;
         baseUrlResolver?: (provider: Provider) => string | undefined;
         signal?: AbortSignal;
     }): Promise<UsageReport[] | null>;
@@ -1268,7 +1277,7 @@ export interface LimitsApi {
      *
      * For usage-limit and account-policy failures with no free sibling, waits
      * (abortable via `options.signal`) when a sibling's block expires within a
-     * few seconds, then reports `afterSiblingWait`.
+     * few seconds, then reports `afterSiblingWait`, unless `options.waitForSibling` is false.
      */
     rotate(provider: string, sessionId: string | undefined, options?: RotateCredentialOptions): Promise<CredentialRotation>;
     /** Invalidate a credential matching an API key after authentication failure. */

package/dist/types/auth/usage.d.ts

@@ -30,6 +30,7 @@ export interface UsageServiceDeps {
     logger: UsageLogger;
 }
 type UsageReportsOptions = {
+    provider?: Provider;
     baseUrlResolver?: (provider: Provider) => string | undefined;
     signal?: AbortSignal;
 };

package/dist/types/auth-broker/client.d.ts

@@ -67,12 +67,13 @@ export declare class AuthBrokerClient {
         signal?: AbortSignal;
     }): AsyncGenerator<SnapshotStreamEvent>;
     /**
-     * Fetch aggregate broker usage with a timeout sized for serialized
-     * same-provider account probes.
+     * Fetch broker usage, optionally for one provider, with a timeout sized
+     * for serialized same-provider account probes.
      */
     fetchUsage(options?: {
         signal?: AbortSignal;
         maxAccountsPerProvider?: number;
+        provider?: string;
     }): Promise<UsageResponse>;
     /** Recorded usage-limit snapshots from the broker host, oldest first. */
     fetchUsageHistory(query?: {

package/dist/types/auth-broker/remote-store.d.ts

@@ -145,11 +145,11 @@ export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
      * to the broker's `/v1/usage` endpoint. Shared per-credential caches and
      * cooldowns keep separate clients from multiplying provider probes.
      */
-    fetchUsageReports(signal?: AbortSignal): Promise<UsageReport[] | null>;
+    fetchUsageReports(signal?: AbortSignal, provider?: Provider): Promise<UsageReport[] | null>;
     /**
      * Per-credential usage hook consumed by `UsageService.report`. Pulls
-     * the aggregate broker `/v1/usage` once and serves all callers from the
-     * same response (coalesced + cached), then overlays any client-observed
+     * provider-scoped broker `/v1/usage` once and serves that provider's callers
+     * from the same response (coalesced + cached), then overlays any client-observed
      * header hints for the matching credential.
      *
      * The broker caches each credential independently; the short client TTL

package/dist/types/auth-gateway/dispatch.d.ts

@@ -5,7 +5,23 @@ import type { Api, FetchImpl, Model, Usage } from "../types.js";
 import type { ClientUsageIdentity } from "../usage.js";
 import type { AuthGatewayClientScope } from "./clients.js";
 import type { AuthGatewayServerOptions } from "./types.js";
-export type ModelResolver = (modelId: string) => Model<Api> | undefined;
+/** What a route knows about a request beyond the model id it names. */
+export interface ModelResolveOptions {
+    /**
+     * The api the route's wire format speaks natively (`anthropic-messages` for
+     * `/v1/messages`). A bare id served by several equally ranked providers
+     * prefers a model on this api.
+     */
+    api?: Api;
+    /**
+     * Models the caller may use. A bare id resolves to its best candidate this
+     * admits; a refused `provider/id` resolves to nothing, never to another
+     * provider's bare id spelled the same way.
+     */
+    accepts?: (model: Model<Api>) => boolean;
+}
+/** Resolves a client-requested model id, `provider/id` or bare `id`, to the model a route dispatches to. */
+export type ModelResolver = (modelId: string, options?: ModelResolveOptions) => Model<Api> | undefined;
 /** What the gateway's routes need, whatever transport carries the requests. */
 export interface AuthGatewayRouteOptions {
     /** Source of credentials: broker-backed for `serve`, the CLI's own for `stdio`. */

package/dist/types/error/abort.d.ts

@@ -12,3 +12,8 @@ export declare class AbortError extends Error {
         cause?: unknown;
     });
 }
+/**
+ * The text a caller gave `AbortController.abort(reason)`, a string or an `Error` other than an abort, such as the coding
+ * agent's user-interrupt label; `undefined` for a bare `abort()`, whose reason is the default `AbortError`.
+ */
+export declare function callerAbortReason(signal: AbortSignal | undefined): string | undefined;

package/dist/types/error/finalize.d.ts

@@ -26,7 +26,7 @@ export interface FinalizeResult {
     status: number | undefined;
     /** `"aborted"` when the caller cancelled, otherwise `"error"`. */
     stopReason: "aborted" | "error";
-    /** User-facing message from {@link formatMessage}, or a local abort reason. */
+    /** User-facing message: a local abort reason, else the caller's abort reason, else from {@link formatMessage}. */
     message: string;
 }
 /**
@@ -34,8 +34,9 @@ export interface FinalizeResult {
  * `stopReason` / `errorStatus` / `errorId` / `errorMessage` boilerplate.
  *
  * `stopReason` comes from the abort tracker (caller intent dominates) or, when
- * no tracker is supplied, the raw `signal.aborted`. A local abort reason (e.g. a
- * first-event timeout) supersedes the formatted message. Message formatting is
- * wrapped so a formatter throw can never skip the caller's `stream.end()`.
+ * no tracker is supplied, the raw `signal.aborted`. The message is, in order, a
+ * local abort reason (e.g. a first-event timeout), the reason the caller passed
+ * to `abort()` (e.g. "Interrupted by user"), or the formatted error. Message
+ * formatting is wrapped so a formatter throw can never skip the caller's `stream.end()`.
  */
 export declare function finalize(error: unknown, opts?: FinalizeOptions): Promise<FinalizeResult>;

package/dist/types/index.d.ts

@@ -17,6 +17,8 @@ export * from "./oneshot-retry.js";
 export * from "./provider-details.js";
 export * from "./provider-session-state.js";
 export type * from "./providers/anthropic.js";
+export type * from "./providers/anthropic-headers.js";
+export type * from "./providers/anthropic-http-options.js";
 export * from "./providers/anthropic-identity.js";
 export * from "./providers/anthropic-state.js";
 export type * from "./providers/anthropic-client.js";
@@ -34,6 +36,7 @@ export type * from "./providers/kimi.js";
 export type * from "./providers/mock.js";
 export type * from "./providers/ollama.js";
 export type * from "./providers/openai-codex-responses.js";
+export type * from "./providers/openai-codex-state.js";
 export type * from "./providers/openai-completions.js";
 export type * from "./providers/openai-responses.js";
 export type * from "./providers/synthetic.js";

package/dist/types/providers/anthropic-headers.d.ts

@@ -0,0 +1,84 @@
+export type AnthropicHeaderOptions = {
+    apiKey: string;
+    baseUrl?: string;
+    isOAuth?: boolean;
+    extraBetas?: string[];
+    stream?: boolean;
+    modelHeaders?: Record<string, string>;
+    isCloudflareAiGateway?: boolean;
+    claudeCodeSessionId?: string;
+    claudeCodeBetas?: readonly string[];
+    /** Allow explicit fingerprint headers to replace OAuth defaults on non-official endpoints. */
+    allowAnthropicHeaderOverrides?: boolean;
+};
+export declare function buildBetaHeader(baseBetas: readonly string[], extraBetas: readonly string[]): string;
+/**
+ * Merge an extra Anthropic beta into a caller-provided `anthropic-beta` header,
+ * preserving the caller's key casing and deduping the tokens. Returns a
+ * single-entry header record for a per-request `headers` override — used to
+ * attach a required beta to injected SDK clients that bypass the client-level
+ * beta construction.
+ */
+export declare function mergeAnthropicBetaHeader(callerHeaders: Record<string, string>, beta: string): Record<string, string>;
+export declare const midConversationSystemClearAtBeta = "mid-conversation-system-clear-at-2026-08-21";
+export declare const midConversationToolChangesBeta = "mid-conversation-tool-changes-2026-07-01";
+export declare const midConversationOutputConfigBeta = "mid-conversation-output-config-2026-07-01";
+export declare const contextManagementBeta = "context-management-2025-06-27";
+export declare const structuredOutputsBeta = "structured-outputs-2025-12-15";
+export declare const fallbackCreditBeta = "fallback-credit-2026-06-01";
+export declare const promptCachingScopeBeta = "prompt-caching-scope-2026-01-05";
+export declare const extendedCacheTtlBeta = "extended-cache-ttl-2025-04-11";
+export declare const fineGrainedToolStreamingBeta = "fine-grained-tool-streaming-2025-05-14";
+export declare const interleavedThinkingBeta = "interleaved-thinking-2025-05-14";
+export declare const fastModeBeta = "fast-mode-2026-02-01";
+export declare const taskBudgetBeta = "task-budgets-2026-03-13";
+export declare const effortBeta = "effort-2025-11-24";
+export declare const serverSideFallbackBeta = "server-side-fallback-2026-06-01";
+export declare function buildClaudeCodeBetas({ agentRequest, thinkingRequest, disableStrictTools, supportsContextManagement, dropPromptCacheBetas, }: {
+    agentRequest: boolean;
+    thinkingRequest: boolean;
+    disableStrictTools?: boolean;
+    supportsContextManagement?: boolean;
+    /**
+     * Withhold the prompt-cache betas: this endpoint rejected `cache_control`,
+     * so a request that carries no breakpoint must not advertise caching it
+     * cannot use. This deviates from Claude Code's header fingerprint, which is
+     * acceptable here precisely because an endpoint that refuses the field is
+     * not the first-party API the fingerprint exists to match.
+     */
+    dropPromptCacheBetas?: boolean;
+}): readonly string[];
+export declare function buildAnthropicHeaders(options: AnthropicHeaderOptions): Record<string, string>;
+/** Maps Node's platform identifier to the Stainless wire value. */
+export declare function mapStainlessOs(platform: string): "MacOS" | "Windows" | "Linux" | "FreeBSD" | `Other::${string}`;
+/** Maps Node's architecture identifier to the Stainless wire value. */
+export declare function mapStainlessArch(arch: string): "x64" | "arm64" | "x86" | `other::${string}`;
+/** Static headers emitted by Claude Code's CLI runtime. */
+export declare const claudeCodeHeaders: {
+    "X-Stainless-Arch": "arm64" | "x64" | "x86" | `other::${string}`;
+    "X-Stainless-Lang": string;
+    "X-Stainless-OS": "FreeBSD" | "Linux" | "MacOS" | "Windows" | `Other::${string}`;
+    "X-Stainless-Package-Version": string;
+    "X-Stainless-Retry-Count": string;
+    "X-Stainless-Runtime": string;
+    "X-Stainless-Runtime-Version": string;
+    "X-Stainless-Timeout": string;
+};
+/**
+ * Returns env-supplied custom headers (`ANTHROPIC_CUSTOM_HEADERS`) when they
+ * should be forwarded to the upstream endpoint.
+ *
+ * Foundry mode forwards them unconditionally. Outside Foundry, they're applied
+ * only when the configured base URL is a non-Anthropic host — i.e. an
+ * enterprise/corporate gateway that may require its own proprietary auth
+ * header. Stock `api.anthropic.com` would reject unknown headers, so they're
+ * omitted there.
+ */
+export declare function resolveAnthropicCustomHeadersForBaseUrl(baseUrl: string | undefined): Record<string, string> | undefined;
+/**
+ * Merge headers case-insensitively; later sources win and preserve their key casing.
+ * Undefined sources are ignored. Differently cased duplicates are removed so the
+ * Headers constructor cannot join competing values comma-separated on the wire.
+ */
+export declare function mergeHeaders(...headerSources: (Record<string, string> | undefined)[]): Record<string, string>;
+export declare function normalizeExtraBetas(betas?: string[] | string): string[];

package/dist/types/providers/anthropic-http-options.d.ts

@@ -0,0 +1,15 @@
+import type { Api, Model } from "../types.js";
+import type { AnthropicFetchOptions } from "./anthropic-client.js";
+export declare function resolveAnthropicBaseUrl(model: Model<"anthropic-messages">, apiKey?: string): string | undefined;
+export declare function buildClaudeCodeTlsFetchOptions(model: Model<"anthropic-messages">, baseUrl: string | undefined): AnthropicFetchOptions | undefined;
+/**
+ * Warm-up target for a first-party `anthropic` model: the effective official
+ * API URL plus the TLS options real requests use (sockets pool per TLS
+ * configuration, so a warm-up made with other options is never reused).
+ * `undefined` when requests resolve elsewhere — `ANTHROPIC_BASE_URL` or
+ * Foundry gateways never receive unsolicited probes.
+ */
+export declare function resolveAnthropicPrewarmTarget(model: Model<Api>): {
+    url: string;
+    init: RequestInit;
+} | undefined;

package/dist/types/providers/anthropic.d.ts

@@ -1,5 +1,5 @@
 import type { Effort } from "@oh-my-pi/pi-catalog/effort";
-import type { AnthropicCompactionRequest, AnthropicOutputEffort, Api, Context, FetchImpl, Message, Model, ServiceTier, SimpleStreamOptions, StreamFunction, StreamOptions, Usage } from "../types.js";
+import type { AnthropicCompactionRequest, AnthropicOutputEffort, Context, FetchImpl, Message, Model, ServiceTier, SimpleStreamOptions, StreamFunction, StreamOptions, Usage } from "../types.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
 import { type RawHttpRequestDump } from "../utils/http-inspector.js";
 import { type AnthropicFetchOptions, type AnthropicMessagesClientLike } from "./anthropic-client.js";
@@ -9,38 +9,8 @@ import { applyClaudeToolPrefix, deriveClaudeDeviceId, generateClaudeCloakingUser
 import { clearAnthropicFastModeFallback, isAnthropicFastModeFallbackDisabled, normalizeAnthropicBaseUrl } from "./anthropic-state.js";
 export { applyClaudeToolPrefix, clearAnthropicFastModeFallback, deriveClaudeDeviceId, generateClaudeCloakingUserId, isAnthropicFastModeFallbackDisabled, isClaudeCloakingUserId, normalizeAnthropicBaseUrl, resolveAnthropicMetadataUserId, stripClaudeToolPrefix, };
 export { resolvesToOfficialAnthropicEndpoint, supportsAnthropicCompaction, supportsAnthropicCompactionOnClient };
-export type AnthropicHeaderOptions = {
-    apiKey: string;
-    baseUrl?: string;
-    isOAuth?: boolean;
-    extraBetas?: string[];
-    stream?: boolean;
-    modelHeaders?: Record<string, string>;
-    isCloudflareAiGateway?: boolean;
-    claudeCodeSessionId?: string;
-    claudeCodeBetas?: readonly string[];
-    /** Allow explicit fingerprint headers to replace OAuth defaults on non-official endpoints. */
-    allowAnthropicHeaderOverrides?: boolean;
-};
-export declare function buildBetaHeader(baseBetas: readonly string[], extraBetas: readonly string[]): string;
-export declare function buildAnthropicHeaders(options: AnthropicHeaderOptions): Record<string, string>;
 type AnthropicCacheControl = NonNullable<TextBlockParam["cache_control"]>;
 export * from "./claude-code-fingerprint.js";
-/** Maps Node's platform identifier to the Stainless wire value. */
-export declare function mapStainlessOs(platform: string): "MacOS" | "Windows" | "Linux" | "FreeBSD" | `Other::${string}`;
-/** Maps Node's architecture identifier to the Stainless wire value. */
-export declare function mapStainlessArch(arch: string): "x64" | "arm64" | "x86" | `other::${string}`;
-/** Static headers emitted by Claude Code's CLI runtime. */
-export declare const claudeCodeHeaders: {
-    "X-Stainless-Arch": "arm64" | "x64" | "x86" | `other::${string}`;
-    "X-Stainless-Lang": string;
-    "X-Stainless-OS": "FreeBSD" | "Linux" | "MacOS" | "Windows" | `Other::${string}`;
-    "X-Stainless-Package-Version": string;
-    "X-Stainless-Retry-Count": string;
-    "X-Stainless-Runtime": string;
-    "X-Stainless-Runtime-Version": string;
-    "X-Stainless-Timeout": string;
-};
 /**
  * Wraps a fetch implementation to patch the Claude Code billing-header `cch`
  * attestation into outgoing request bodies. Bodies without the placeholder
@@ -170,23 +140,6 @@ export type AnthropicClientOptionsResult = {
     fetch?: FetchImpl;
     fetchOptions?: AnthropicFetchOptions;
 };
-/**
- * Returns env-supplied custom headers (`ANTHROPIC_CUSTOM_HEADERS`) when they
- * should be forwarded to the upstream endpoint.
- *
- * Foundry mode forwards them unconditionally. Outside Foundry, they're applied
- * only when the configured base URL is a non-Anthropic host — i.e. an
- * enterprise/corporate gateway that may require its own proprietary auth
- * header. Stock `api.anthropic.com` would reject unknown headers, so they're
- * omitted there.
- */
-export declare function resolveAnthropicCustomHeadersForBaseUrl(baseUrl: string | undefined): Record<string, string> | undefined;
-/**
- * Merge headers case-insensitively; later sources win and preserve their key casing.
- * Undefined sources are ignored. Differently cased duplicates are removed so the
- * Headers constructor cannot join competing values comma-separated on the wire.
- */
-export declare function mergeHeaders(...headerSources: (Record<string, string> | undefined)[]): Record<string, string>;
 export type AnthropicUsageLike = {
     cache_creation?: {
         ephemeral_5m_input_tokens?: number | null;
@@ -250,19 +203,7 @@ type SystemBlockOptions = {
     dropCacheControl?: boolean;
 };
 export declare function buildAnthropicSystemBlocks(systemPrompt: readonly string[] | undefined, options?: SystemBlockOptions): AnthropicSystemBlock[] | undefined;
-export declare function normalizeExtraBetas(betas?: string[] | string): string[];
 export declare function buildAnthropicClientOptions(args: AnthropicClientOptionsArgs): AnthropicClientOptionsResult;
-/**
- * Warm-up target for a first-party `anthropic` model: the effective official
- * API URL plus the TLS options real requests use (sockets pool per TLS
- * configuration, so a warm-up made with other options is never reused).
- * `undefined` when requests resolve elsewhere — `ANTHROPIC_BASE_URL` or
- * Foundry gateways never receive unsolicited probes.
- */
-export declare function resolveAnthropicPrewarmTarget(model: Model<Api>): {
-    url: string;
-    init: RequestInit;
-} | undefined;
 /**
  * True when enabled thinking on `model` is budget thinking
  * (`thinking.type: "enabled"` with `budget_tokens`) rather than adaptive.

package/dist/types/providers/cursor.d.ts

@@ -1,8 +1,8 @@
 import type { CursorRule, McpToolDefinition } from "@oh-my-pi/pi-catalog/discovery/cursor-proto";
 import { CURSOR_CLIENT_VERSION } from "@oh-my-pi/pi-catalog/wire/cursor";
-import { type AgentServerMessage, type ConversationStateStructure } from "@oh-my-pi/pi-catalog/discovery/cursor-proto";
+import { type AgentServerMessage, type ConversationStateStructure, type ExecServerMessage } from "@oh-my-pi/pi-catalog/discovery/cursor-proto";
 import { type JsonValue } from "@oh-my-pi/pi-catalog/discovery/protobuf";
-import type { AssistantMessage, Context, CursorExecHandlerResult, CursorExecHandlers, CursorExecPairing, CursorTodoSyncHandler, CursorToolResultHandler, Message, Model, StreamFunction, StreamOptions, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage } from "../types.js";
+import type { AssistantMessage, Context, CursorExecHandlerResult, CursorExecHandlers, CursorExecPairing, CursorMcpCall, CursorTodoSyncHandler, CursorToolResultHandler, Message, Model, StreamFunction, StreamOptions, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage } from "../types.js";
 import { kCursorExecResolved, kStreamingBlockIndex, kStreamingBlockKind, kStreamingEnvelopeId, kStreamingLastParseLen, kStreamingPartialJson } from "../utils/block-symbols.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
 export declare const CURSOR_API_URL = "https://api2.cursor.sh";
@@ -12,7 +12,14 @@ export interface CursorOptions extends StreamOptions {
     conversationId?: string;
     execHandlers?: CursorExecHandlers;
     onToolResult?: CursorToolResultHandler;
-    /** Treat unhandled MCP calls as accepted handoffs to an external executor. */
+    /**
+     * The caller's client runs every tool (auth-gateway). Cursor is limited to
+     * MCP calls, every context tool is advertised as one, and a turn that hands
+     * the client a call stops with `toolUse`. With a `providerSessionState` to
+     * park in, the run stays open for the next request to answer its calls
+     * in-band (`CursorParkedRun`); without one, each call is handed off and
+     * Cursor told its result comes with the next request.
+     */
     externalToolExecutor?: boolean;
     /** Wire model id selected after thinking-effort routing (`resolveWireModelId`). */
     wireModelId?: string;
@@ -76,6 +83,22 @@ export interface BlockState {
     openToolCalls: Map<string, ToolCallState>;
     /** MCP call IDs synthesized from exec frames before their redundant streamed block arrives. */
     resolvedMcpToolCallIds: Set<string>;
+    /**
+     * Calls a relayed run handed its client in an earlier response
+     * (`CursorParkedRun`). Each response fills its own message, so a streamed
+     * announcement that trails the handoff must not open the call again there.
+     * Optional so existing test harnesses stay valid.
+     */
+    handedOffToolCallIds?: Set<string>;
+    /**
+     * MCP calls a relayed run (`CursorParkedRun`) has seen announced but holds
+     * no exec frame for, by call id. A streaming client runs every call it is
+     * sent and a streamed event cannot be taken back, while a response may hand
+     * the client only held calls; so a call stays off the stream and out of the
+     * message until its exec frame is held (`streamUnheldExternalCall`).
+     * Set only for a relayed run.
+     */
+    unheldExternalCalls?: Map<string, ToolCallState>;
     /**
      * Native `editToolCall` (StrReplace) ids whose materialization `readArgs` /
      * `writeArgs` must stay raw and must not synthesize extra transcript blocks.
@@ -104,6 +127,12 @@ export interface BlockState {
      * matching result and every transcript rebuild strips it as dangling.
      */
     onToolResult?: CursorToolResultHandler;
+    /**
+     * Keep an external executor's MCP exec frame open instead of handing the
+     * call off: a relayed run answers it in-band once the client's next request
+     * brings the result (`CursorParkedRun`).
+     */
+    holdExternalCall?: (execMsg: ExecServerMessage, call: CursorMcpCall) => void;
 }
 export interface UsageState {
     sawTokenDelta: boolean;
@@ -236,10 +265,11 @@ export declare function processInteractionUpdate(update: any, output: AssistantM
  * Cursor AgentService reconstructs the model prompt from `requestContext.rules`,
  * not from the client-supplied `rootPromptMessagesJson` system blobs. Map each
  * OMP system-prompt entry to a global CursorRule so always-apply rules survive
- * that reconstruction.
+ * that reconstruction. The server only does this while the root carries no
+ * history; later turns rely on {@link buildCursorRulesEntryJson}.
  */
 export declare function buildCursorRequestContextRules(systemPrompt: readonly string[] | undefined): CursorRule[];
-export declare function buildMcpToolDefinitions(tools: Tool[] | undefined, requiresCursorToolSchemaProjection?: boolean): McpToolDefinition[];
+export declare function buildMcpToolDefinitions(tools: Tool[] | undefined, requiresCursorToolSchemaProjection?: boolean, externalToolExecutor?: boolean): McpToolDefinition[];
 /**
  * Build `ConversationStateStructure.rootPromptMessagesJson` blob IDs for the
  * system prompt plus prior conversation history, as JSON blobs matching