@oh-my-pi/pi-ai 18.14.0 → 18.14.1

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## [Unreleased]
 
+## [18.14.1] - 2026-10-31
+
+### Added
+
+- Added the `codexAccessPrograms` stream option and `configureCodexAccessPrograms()` process default to turn off the automatic Daybreak Blue `access_programs` request on Codex ([#17508](https://github.com/can1357/oh-my-pi/pull/17508) by [@H4vC](https://github.com/H4vC))
+- Added `waitForSibling` to `RotateCredentialOptions`; set it to `false` to skip the short sibling-unblock wait in `limits.rotate()` while still blocking the failed credential ([#17439](https://github.com/can1357/oh-my-pi/pull/17439) by [@wolfiesch](https://github.com/wolfiesch))
+
+### Changed
+
+- Cursor runs served through `omp auth-gateway` are limited to the client's own tools, all advertised as MCP; Cursor's built-in tools (file, shell, edit, todo, web fetch, SCM) are no longer offered on that path ([#17382](https://github.com/can1357/oh-my-pi/pull/17382) by [@eggpeat](https://github.com/eggpeat))
+
+### Fixed
+
+- Fixed native judgment requests (TypeSafe, OpenRouter Decisions, OpenAI Decisions, Workers AI) sending credentials in their state unredacted while credential redaction was on ([#17443](https://github.com/can1357/oh-my-pi/pull/17443))
+- Fixed every new Codex session, including each subagent, losing a response and retrying when the native turn lane refuses live steering; once refused, later sessions on the same account, endpoint, and model queue follow-ups for four hours ([#14158](https://github.com/can1357/oh-my-pi/issues/14158), [#17438](https://github.com/can1357/oh-my-pi/pull/17438) by [@wolfiesch](https://github.com/wolfiesch))
+- Fixed Cursor models served through `omp auth-gateway` being told their file and shell tools were unavailable while the client ran the calls anyway, in Cursor's own argument shape (edits failed validation); each call now reaches the client as one of its own tools and the turn stops with `toolUse` until the result comes back ([#17382](https://github.com/can1357/oh-my-pi/pull/17382) by [@eggpeat](https://github.com/eggpeat))
+- Fixed Cursor models served through `omp auth-gateway` being told each tool call was handed off, which left Composer issuing calls blind and answering their results with empty stops; the gateway now keeps the Cursor run open while the client runs a step's calls and answers them in-band with the client's results on its next request (up to 30 minutes; otherwise the turn is rebuilt from history as before) ([#17382](https://github.com/can1357/oh-my-pi/pull/17382) by [@eggpeat](https://github.com/eggpeat))
+- Fixed Anthropic-compatible endpoints behind a relay opening a new connection for every turn: the response body is now drained for up to 2.5 s after `message_stop` instead of being cancelled, so the kept-alive connection is reused ([#17432](https://github.com/can1357/oh-my-pi/pull/17432) by [@flosrn](https://github.com/flosrn))
+
 ## [18.14.0] - 2026-10-29
 
 ### Breaking Changes
@@ -2300,27 +2319,4 @@
 - Enabled freeform tool patch support for Azure OpenAI and Codex models.
 - Fixed an issue where the `/usage show` command returned "No usage data available" when using a custom proxy base URL for Codex.
 
-## [16.2.2] - 2026-06-27
-
-### Added
-
-- Added a comprehensive, public-facing error module exported via the "./error" path, featuring structured error classification, provider-specific HTTP error classes (e.g., Anthropic, OpenAI, Gemini), OAuth/Auth-specific errors, rate-limit utilities, and retryability predicates.
-
-### Changed
-
-- Updated OpenAI Codex defaults to increase default text verbosity to medium, enable detailed reasoning summaries by default, and include all turns in the reasoning context by default.
-- Updated the OpenAI Codex WebSocket transport to resolve its configuration (via PI_CODEX_WEBSOCKET_* environment variables) once at startup rather than re-parsing on every request.
-- Enhanced cross-model reasoning recovery and preservation to render demoted reasoning in the target model's canonical inline thinking dialect (such as Gemini's thinking fence or standard think tags) to prevent leaking inert context or control tokens into history.
-- Broadened the leaked-thinking stream healer to recover reasoning emitted in any dialect's canonical idiom (including Gemini, Gemma, Harmony, and scratchpads) and route them to thinking events instead of raw markup.
-- Implemented automatic retry logic for detected thinking-loop stalls to improve response reliability.
-- Hardened stateful delta chaining to ignore transient streaming bookkeeping symbols during structural equality checks, preventing unnecessary full-transcript replays.
-
-### Fixed
-
-- Fixed preservation of OpenAI Responses assistant message phase values across auth-gateway parsing, streaming, and history replay, ensuring GPT-5.4/GPT-5.5 intermediate updates and final answers retain their original phase labels.
-
-### Removed
-
-- Removed Pi dialect support and related serialization/parsing logic.
-
-Older entries are archived in [packages/ai/CHANGELOG.md@ef4bc35e85d8](https://github.com/can1357/oh-my-pi/blob/ef4bc35e85d88932d92b01ae7121c9f47208cf40/packages/ai/CHANGELOG.md).
+Older entries are archived in [packages/ai/CHANGELOG.md@cef4a452836c](https://github.com/can1357/oh-my-pi/blob/cef4a452836c7a8d547dd14470c34c9ed2dbb5f8/packages/ai/CHANGELOG.md).

package/dist/types/auth/rotation.d.ts

@@ -63,7 +63,8 @@ export declare class RateLimits implements LimitsApi {
      * For usage-limit and account-policy failures with no free sibling, sleeps
      * until the earliest sibling unblocks when that is at most
      * {@link SIBLING_UNBLOCK_WAIT_MAX_MS} away, then reports `afterSiblingWait`.
-     * Aborting `options.signal` during that wait rejects.
+     * Setting `options.waitForSibling` to false skips that wait without skipping
+     * the failed credential's block. Aborting `options.signal` during the wait rejects.
      */
     rotate(provider: string, sessionId: string | undefined, options?: RotateCredentialOptions): Promise<CredentialRotation>;
 }

package/dist/types/auth/types.d.ts

@@ -698,6 +698,8 @@ export type RotateCredentialOptions = {
     apiKey?: string;
     credentialId?: number;
     signal?: AbortSignal;
+    /** Whether to wait for a briefly blocked sibling; defaults to true. The failed credential is blocked either way. */
+    waitForSibling?: boolean;
 };
 /**
  * Outcome of {@link LimitsApi.rotate}.
@@ -1275,7 +1277,7 @@ export interface LimitsApi {
      *
      * For usage-limit and account-policy failures with no free sibling, waits
      * (abortable via `options.signal`) when a sibling's block expires within a
-     * few seconds, then reports `afterSiblingWait`.
+     * few seconds, then reports `afterSiblingWait`, unless `options.waitForSibling` is false.
      */
     rotate(provider: string, sessionId: string | undefined, options?: RotateCredentialOptions): Promise<CredentialRotation>;
     /** Invalidate a credential matching an API key after authentication failure. */

package/dist/types/providers/cursor.d.ts

@@ -1,8 +1,8 @@
 import type { CursorRule, McpToolDefinition } from "@oh-my-pi/pi-catalog/discovery/cursor-proto";
 import { CURSOR_CLIENT_VERSION } from "@oh-my-pi/pi-catalog/wire/cursor";
-import { type AgentServerMessage, type ConversationStateStructure } from "@oh-my-pi/pi-catalog/discovery/cursor-proto";
+import { type AgentServerMessage, type ConversationStateStructure, type ExecServerMessage } from "@oh-my-pi/pi-catalog/discovery/cursor-proto";
 import { type JsonValue } from "@oh-my-pi/pi-catalog/discovery/protobuf";
-import type { AssistantMessage, Context, CursorExecHandlerResult, CursorExecHandlers, CursorExecPairing, CursorTodoSyncHandler, CursorToolResultHandler, Message, Model, StreamFunction, StreamOptions, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage } from "../types.js";
+import type { AssistantMessage, Context, CursorExecHandlerResult, CursorExecHandlers, CursorExecPairing, CursorMcpCall, CursorTodoSyncHandler, CursorToolResultHandler, Message, Model, StreamFunction, StreamOptions, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage } from "../types.js";
 import { kCursorExecResolved, kStreamingBlockIndex, kStreamingBlockKind, kStreamingEnvelopeId, kStreamingLastParseLen, kStreamingPartialJson } from "../utils/block-symbols.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
 export declare const CURSOR_API_URL = "https://api2.cursor.sh";
@@ -12,7 +12,14 @@ export interface CursorOptions extends StreamOptions {
     conversationId?: string;
     execHandlers?: CursorExecHandlers;
     onToolResult?: CursorToolResultHandler;
-    /** Treat unhandled MCP calls as accepted handoffs to an external executor. */
+    /**
+     * The caller's client runs every tool (auth-gateway). Cursor is limited to
+     * MCP calls, every context tool is advertised as one, and a turn that hands
+     * the client a call stops with `toolUse`. With a `providerSessionState` to
+     * park in, the run stays open for the next request to answer its calls
+     * in-band (`CursorParkedRun`); without one, each call is handed off and
+     * Cursor told its result comes with the next request.
+     */
     externalToolExecutor?: boolean;
     /** Wire model id selected after thinking-effort routing (`resolveWireModelId`). */
     wireModelId?: string;
@@ -76,6 +83,22 @@ export interface BlockState {
     openToolCalls: Map<string, ToolCallState>;
     /** MCP call IDs synthesized from exec frames before their redundant streamed block arrives. */
     resolvedMcpToolCallIds: Set<string>;
+    /**
+     * Calls a relayed run handed its client in an earlier response
+     * (`CursorParkedRun`). Each response fills its own message, so a streamed
+     * announcement that trails the handoff must not open the call again there.
+     * Optional so existing test harnesses stay valid.
+     */
+    handedOffToolCallIds?: Set<string>;
+    /**
+     * MCP calls a relayed run (`CursorParkedRun`) has seen announced but holds
+     * no exec frame for, by call id. A streaming client runs every call it is
+     * sent and a streamed event cannot be taken back, while a response may hand
+     * the client only held calls; so a call stays off the stream and out of the
+     * message until its exec frame is held (`streamUnheldExternalCall`).
+     * Set only for a relayed run.
+     */
+    unheldExternalCalls?: Map<string, ToolCallState>;
     /**
      * Native `editToolCall` (StrReplace) ids whose materialization `readArgs` /
      * `writeArgs` must stay raw and must not synthesize extra transcript blocks.
@@ -104,6 +127,12 @@ export interface BlockState {
      * matching result and every transcript rebuild strips it as dangling.
      */
     onToolResult?: CursorToolResultHandler;
+    /**
+     * Keep an external executor's MCP exec frame open instead of handing the
+     * call off: a relayed run answers it in-band once the client's next request
+     * brings the result (`CursorParkedRun`).
+     */
+    holdExternalCall?: (execMsg: ExecServerMessage, call: CursorMcpCall) => void;
 }
 export interface UsageState {
     sawTokenDelta: boolean;
@@ -240,7 +269,7 @@ export declare function processInteractionUpdate(update: any, output: AssistantM
  * history; later turns rely on {@link buildCursorRulesEntryJson}.
  */
 export declare function buildCursorRequestContextRules(systemPrompt: readonly string[] | undefined): CursorRule[];
-export declare function buildMcpToolDefinitions(tools: Tool[] | undefined, requiresCursorToolSchemaProjection?: boolean): McpToolDefinition[];
+export declare function buildMcpToolDefinitions(tools: Tool[] | undefined, requiresCursorToolSchemaProjection?: boolean, externalToolExecutor?: boolean): McpToolDefinition[];
 /**
  * Build `ConversationStateStructure.rootPromptMessagesJson` blob IDs for the
  * system prompt plus prior conversation history, as JSON blobs matching

package/dist/types/providers/factory-droid/gemini.d.ts

@@ -1,7 +1,30 @@
 import type { RequestPolicy } from "@oh-my-pi/pi-catalog/compat/types";
 import type { Effort } from "@oh-my-pi/pi-catalog/effort";
-import type { Context, Model, StreamOptions } from "../../types.js";
+import type { Context, Message, Model, StreamOptions, Tool } from "../../types.js";
 import { AssistantMessageEventStream } from "../../utils/event-stream.js";
+/**
+ * Apply Factory's replay provenance before canonical normalization: only
+ * signed, Google-origin thinking and Google-origin call signatures survive;
+ * everything else is DROPPED (never demoted to visible text). A text block
+ * keeps its signature only when this model signed it.
+ *
+ * Tool-call names are encoded to their wire form here, before
+ * `transformMessages` drops calls whose names no provider could declare: the
+ * proxy accepts any caller tool name once sanitized, so a declared
+ * `my.tool/name` call must survive replay.
+ *
+ * Only Google-origin turns are stamped as the target, so `transformMessages`
+ * keeps their surviving signatures verbatim instead of demoting/stripping them
+ * as cross-model. Their ids are plain in either stamp, so pairing is
+ * unaffected. Every other turn keeps its real provenance: tool-result pairing
+ * reads it (Responses `call_id|item_id` results pair only with a
+ * Responses-origin call), and with its reasoning already gone there is
+ * nothing left for a cross-model pass to demote.
+ */
+export declare function adoptFactoryReplay(message: Message, model: Model<"factory-droid-agent">): Message;
+export declare function toGeminiTools(tools: Tool[] | undefined): Array<{
+    functionDeclarations: unknown[];
+}> | undefined;
 export interface FactoryDroidGeminiOptions extends StreamOptions {
     /** Base URL including the `/api/llm/g/v1` namespace. */
     baseUrl: string;

package/dist/types/providers/openai-codex/access-programs.d.ts

@@ -1,10 +1,18 @@
 import type { Model } from "../../types.js";
 import type { RequestBody } from "./request-transformer.js";
 /**
- * Request Daybreak Blue on `body` when `accountId` may use it on `model` and
- * no earlier rejection dropped it.
+ * Set the process-wide default for requests that leave `codexAccessPrograms`
+ * unset. Hosts call this from their settings so side calls that bypass a
+ * session stream function still follow it; session requests pass their own
+ * value, so concurrent sessions with different settings stay independent.
  */
-export declare function applyCodexAccessPrograms(body: RequestBody, model: Model<"openai-codex-responses">, accountId: string | undefined): void;
+export declare function configureCodexAccessPrograms(enabled: boolean): void;
+/**
+ * Request Daybreak Blue on `body` when `requested` (else the process default)
+ * allows it, `accountId` may use it on `model`, and no earlier rejection
+ * dropped it.
+ */
+export declare function applyCodexAccessPrograms(body: RequestBody, model: Model<"openai-codex-responses">, accountId: string | undefined, requested: boolean | undefined): void;
 /**
  * Strip `access_programs` from `body` when `error` is the backend rejecting it,
  * remembering the drop for (account, model). Returns `true` when the caller

package/dist/types/providers/openai-codex/live-steering.d.ts

@@ -23,6 +23,8 @@ export interface CodexAcceptedSteer {
 export interface CodexSteerOutcome {
     responseId: string | undefined;
     accepted: CodexAcceptedSteer[];
+    /** A steer was submitted, whether or not the server accepted it. */
+    submitted: boolean;
     /**
      * A submission ended without an acknowledgement, so the server may or may
      * not hold it. The caller must drop the socket rather than chain from it.

package/dist/types/types.d.ts

@@ -372,6 +372,13 @@ export interface StreamOptions {
      * without the capability.
      */
     storeResponses?: boolean;
+    /**
+     * Request the Daybreak Blue cyber access program on Codex when the account
+     * is eligible (see `openai-codex/access-programs.ts`). `false` omits
+     * `access_programs`. Unset falls back to the host's
+     * `configureCodexAccessPrograms` default, else on. Ignored elsewhere.
+     */
+    codexAccessPrograms?: boolean;
     /**
      * Disable native reasoning when the caller supplies an external scratchpad.
      * OpenAI Responses emits `reasoning: { effort: "none" }`; Anthropic and
@@ -572,7 +579,7 @@ export interface SimpleStreamOptions extends Omit<StreamOptions, "apiKey"> {
      * A rejecting transformer is swallowed and the reserved payload stands in.
      */
     cursorOnToolResult?: CursorToolResultHandler;
-    /** Cursor hands unhandled MCP calls to an external executor instead of reporting them as missing. */
+    /** The caller's client runs every tool: Cursor offers them all as MCP tools and hands each call off to it. */
     cursorExternalToolExecutor?: boolean;
     /**
      * Amazon Bedrock Guardrail settings forwarded through transports that do not

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.14.0",
+	"version": "18.14.1",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,11 +155,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.14.0",
-		"@oh-my-pi/pi-catalog": "18.14.0",
-		"@oh-my-pi/pi-natives": "18.14.0",
-		"@oh-my-pi/pi-utils": "18.14.0",
-		"@oh-my-pi/pi-wire": "18.14.0"
+		"@oh-my-pi/omptype": "18.14.1",
+		"@oh-my-pi/pi-catalog": "18.14.1",
+		"@oh-my-pi/pi-natives": "18.14.1",
+		"@oh-my-pi/pi-utils": "18.14.1",
+		"@oh-my-pi/pi-wire": "18.14.1"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/auth/rotation.ts

@@ -395,7 +395,8 @@ export class RateLimits implements LimitsApi {
 	 * For usage-limit and account-policy failures with no free sibling, sleeps
 	 * until the earliest sibling unblocks when that is at most
 	 * {@link SIBLING_UNBLOCK_WAIT_MAX_MS} away, then reports `afterSiblingWait`.
-	 * Aborting `options.signal` during that wait rejects.
+	 * Setting `options.waitForSibling` to false skips that wait without skipping
+	 * the failed credential's block. Aborting `options.signal` during the wait rejects.
 	 */
 	async rotate(
 		provider: string,
@@ -421,7 +422,7 @@ export class RateLimits implements LimitsApi {
 				credentialId: options?.credentialId,
 				signal: options?.signal,
 			});
-			return awaitSiblingUnblock(mark, options?.signal);
+			return awaitSiblingUnblock(mark, options?.signal, options?.waitForSibling);
 		}
 
 		const deniedModel = AIError.codexChatGPTAccountPolicyModel(error);
@@ -467,7 +468,7 @@ export class RateLimits implements LimitsApi {
 				routing,
 				false,
 			);
-			return awaitSiblingUnblock(mark, options?.signal);
+			return awaitSiblingUnblock(mark, options?.signal, options?.waitForSibling);
 		}
 
 		const providerKey = providerTypeKey(provider, sessionCredential.type);
@@ -533,9 +534,13 @@ export class RateLimits implements LimitsApi {
  * Turn a no-sibling mark into a rotation by sleeping out the soonest sibling
  * block when it expires within {@link SIBLING_UNBLOCK_WAIT_MAX_MS}.
  */
-async function awaitSiblingUnblock(mark: UsageLimitMarkResult, signal?: AbortSignal): Promise<CredentialRotation> {
+async function awaitSiblingUnblock(
+	mark: UsageLimitMarkResult,
+	signal?: AbortSignal,
+	waitForSibling = true,
+): Promise<CredentialRotation> {
 	if (mark.switched) return { switched: true };
-	if (mark.retryAtMs === undefined) return { switched: false };
+	if (!waitForSibling || mark.retryAtMs === undefined) return { switched: false };
 	const waitMs = mark.retryAtMs - Date.now() + SIBLING_UNBLOCK_SLACK_MS;
 	if (waitMs > SIBLING_UNBLOCK_WAIT_MAX_MS) return { switched: false };
 	if (waitMs > 0) await scheduler.wait(waitMs, { signal });

package/src/auth/types.ts

@@ -778,6 +778,8 @@ export type RotateCredentialOptions = {
 	apiKey?: string;
 	credentialId?: number;
 	signal?: AbortSignal;
+	/** Whether to wait for a briefly blocked sibling; defaults to true. The failed credential is blocked either way. */
+	waitForSibling?: boolean;
 };
 
 /**
@@ -1379,7 +1381,7 @@ export interface LimitsApi {
 	 *
 	 * For usage-limit and account-policy failures with no free sibling, waits
 	 * (abortable via `options.signal`) when a sibling's block expires within a
-	 * few seconds, then reports `afterSiblingWait`.
+	 * few seconds, then reports `afterSiblingWait`, unless `options.waitForSibling` is false.
 	 */
 	rotate(
 		provider: string,

package/src/judgment/native.ts

@@ -28,6 +28,7 @@ import { type ApiKey, withAuth } from "../auth-retry";
 import * as AIError from "../error";
 import { validateImageInput } from "../images/shared";
 import { withInferenceUserAgent } from "../providers/inference-headers";
+import { redactSensitiveInObject } from "../providers/transform-messages";
 import type { ImageContent, Model, Usage } from "../types";
 import { getRetryAfterMsFromHeaders } from "../utils/retry-after";
 import { openaiDecisionsWire } from "./openai-decisions";
@@ -38,6 +39,7 @@ import {
 	type JudgeOptions,
 	type JudgmentRequest,
 	type JudgmentResult,
+	type JudgmentState,
 	type Questions,
 	tokenUsage,
 } from "./types";
@@ -357,6 +359,9 @@ export class NativeJudge implements Judge {
 		request: JudgmentRequest<Q>,
 		options?: NativeJudgeCallOptions,
 	): Promise<JudgmentResult<Q>> {
+		// The state goes to the wire as is, past the message transforms that redact chat requests.
+		const redacted = redactSensitiveInObject(request.state);
+		if (redacted.changed) request = { ...request, state: redacted.result as JudgmentState };
 		checkJudgmentImages(
 			this.label,
 			this.#wire,

package/src/providers/anthropic.ts

@@ -89,7 +89,12 @@ import {
 import { withReplaySafeStreamRetry } from "../utils/empty-completion-retry";
 import { AssistantMessageEventStream } from "../utils/event-stream";
 import { finalizeErrorMessage, type RawHttpRequestDump } from "../utils/http-inspector";
-import { getStreamFirstEventTimeoutMs, getStreamIdleTimeoutMs, iterateWithIdleTimeout } from "../utils/idle-iterator";
+import {
+	getStreamFirstEventTimeoutMs,
+	getStreamIdleTimeoutMs,
+	iterateWithIdleTimeout,
+	iterateWithTerminalGrace,
+} from "../utils/idle-iterator";
 import {
 	ANTHROPIC_SLOW_USAGE_LIMIT,
 	ANTHROPIC_USAGE_LIMIT_HEADER,
@@ -1115,6 +1120,16 @@ const PROVIDER_MAX_RETRIES = 10;
  */
 const PING_PROGRESS_MAX_IDLE_MULTIPLIER = 3;
 
+/**
+ * How long to keep reading the HTTP body after `message_stop`. The turn is
+ * complete at that frame, but cancelling a body whose terminal chunk has not
+ * arrived yet makes Bun close the socket instead of returning it to the pool,
+ * so every turn behind a relay that flushes `message_stop` separately pays a
+ * fresh connection (TCP, TLS, slow start). The drain runs after the turn
+ * completes; the window only elapses on hosts that hold the body open.
+ */
+const ANTHROPIC_POST_STOP_GRACE_MS = 2_500;
+
 /**
  * Log a malformed-stream-envelope anomaly without aborting the turn. The strict
  * parser would `throw new AnthropicStreamEnvelopeError(...)` here; we instead
@@ -2619,6 +2634,7 @@ const streamAnthropicOnce = (
 					let sawMessageStart = false;
 					let sawTerminalEnvelope = false;
 					let sawMessageStop = false;
+					let messageStopAtMs: number | undefined;
 					// Set when a duplicate message_start splices a second envelope onto
 					// the stream; closed indexes then refuse to reopen so replayed
 					// content cannot duplicate (see content_block_start guard).
@@ -2676,10 +2692,20 @@ const streamAnthropicOnce = (
 							return true;
 						},
 					});
+					const drainRequestAbortController = activeAbortTracker.requestAbortController;
+					const drainedAnthropicStream = iterateWithTerminalGrace(timedAnthropicStream, {
+						finishedAtMs: () => messageStopAtMs,
+						graceMs: ANTHROPIC_POST_STOP_GRACE_MS,
+						// The idle-timeout generator is parked mid-`next()` when the window
+						// closes; aborting the transport settles that read. A bare abort sets
+						// no local reason, so the completed turn is not reported as an error.
+						onGraceEnd: () => drainRequestAbortController.abort(),
+						awaitDrainOnReturn: options?.waitForTerminalDrain,
+					});
 					const observedAnthropicStream =
 						rawSseObserver && !recordsRawSseEvents
-							? observeDecodedAnthropicEvents(timedAnthropicStream, rawSseObserver)
-							: timedAnthropicStream;
+							? observeDecodedAnthropicEvents(drainedAnthropicStream, rawSseObserver)
+							: drainedAnthropicStream;
 					for await (const event of observedAnthropicStream) {
 						sawEvent = true;
 
@@ -3094,7 +3120,9 @@ const streamAnthropicOnce = (
 						} else if (event.type === "message_stop") {
 							sawTerminalEnvelope = true;
 							sawMessageStop = true;
-							// The protocol is complete even if a broken keep-alive leaves the HTTP body open.
+							// The protocol is complete even if a broken keep-alive leaves the HTTP
+							// body open; the terminal-grace wrapper drains the rest in the background.
+							messageStopAtMs = Date.now();
 							break;
 						}
 					}

package/src/providers/cursor/proto/agent.proto

@@ -857,6 +857,10 @@ message StepCompletedUpdate {
    int64 step_duration_ms = 2;
 }
 
+message ToolRequestsListedUpdate {
+   uint32 call_count = 1;
+}
+
 message InteractionUpdate {
    oneof message {
       TextDeltaUpdate text_delta = 1;
@@ -876,6 +880,7 @@ message InteractionUpdate {
       TurnEndedUpdate turn_ended = 14;
       StepStartedUpdate step_started = 16;
       StepCompletedUpdate step_completed = 17;
+      ToolRequestsListedUpdate tool_requests_listed = 27;
    }
 }