@oh-my-pi/pi-ai 18.14.1 → 18.15.0

package/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 ## [Unreleased]
 
+## [18.15.0] - 2026-11-01
+
+### Fixed
+
+- Fixed Codex conversation replay failing with an unknown `internal_chat_message_metadata_passthrough.content_token_count` parameter by omitting backend-internal response metadata from replayed input ([#17590](https://github.com/can1357/oh-my-pi/pull/17590), [#17597](https://github.com/can1357/oh-my-pi/pull/17597) by [@briankeefe](https://github.com/briankeefe)).
+- Fixed `service_tier: "ultrafast"` being dropped for OpenAI-family models on custom providers even when the model's `serviceTiers` lists it ([#17577](https://github.com/can1357/oh-my-pi/pull/17577) by [@jakehemmerle](https://github.com/jakehemmerle))
+- Fixed Google Vertex requests with Workforce Identity Federation ADC failing token refresh against the wrong endpoint ([#17447](https://github.com/can1357/oh-my-pi/issues/17447)).
+- Fixed Anthropic (and other rotating-token) OAuth accounts being signed out automatically when a background usage poll's token refresh got `invalid_grant`, including refreshes a client delegates to an auth broker; usage polling no longer disables credentials, so only a real request's refresh can do that ([#17468](https://github.com/can1357/oh-my-pi/issues/17468))
+
+## [18.14.2] - 2026-10-31
+
+### Breaking Changes
+
+- Replaced `isLoopGuardedModel` with `loopGuardLevel`, which returns `"off"`, `"exact"`, or `"semantic"` from the model's `thinking-loop-guard` catalog rule
+
+### Added
+
+- Added `disableServerSideFallback` to `FactoryDroidOptions` and `SimpleStreamOptions`: a Factory Droid request leaves out the server-side refusal fallback chain and fails, before any of its content is streamed, if another model answers it ([#12229](https://github.com/can1357/oh-my-pi/pull/12229) by [@Xytronix](https://github.com/Xytronix))
+
+### Changed
+
+- DeepSeek and Grok models on Amazon Bedrock now get the same near-duplicate reasoning-loop checks as on other hosts
+
+### Fixed
+
+- Fixed Claude turns failing with "Thinking loop detected" when summarized thinking repeated a progress line such as "Still writing the parser..."; Claude models no longer run the loop guard
+- Fixed the loop guard discarding turns from other models whose reasoning summary repeats one status line a few times; whole-line repetition now has to cover about 1 KB before it counts as a loop
+- Fixed per-request OpenAI-compatible headers being combined with differently cased model headers instead of overriding them ([#17513](https://github.com/can1357/oh-my-pi/pull/17513) by [@jchanghong023](https://github.com/jchanghong023))
+- Fixed a stalled Anthropic stream that keeps sending empty content deltas never timing out, because those deltas were treated as stream progress ([#17484](https://github.com/can1357/oh-my-pi/pull/17484) by [@jchanghong023](https://github.com/jchanghong023))
+- Fixed Anthropic-compatible endpoints that put a thinking signature on the streamed content block losing it, so replayed reasoning keeps its signed block ([#17483](https://github.com/can1357/oh-my-pi/pull/17483) by [@jchanghong023](https://github.com/jchanghong023))
+- Fixed `AuthStorage.close()` and `replaceStore()` losing a rotated OAuth refresh token when a refresh was still in flight, with or without durable refresh leases; the store now stays open until that token is saved, and new refreshes are refused ([#17518](https://github.com/can1357/oh-my-pi/issues/17518))
+- Fixed `/usage` showing Cursor's "Other Models" meter as an inflated dollar amount; it now shows the percentage Cursor reports, like Cursor Models ([#17462](https://github.com/can1357/oh-my-pi/pull/17462) by [@eggpeat](https://github.com/eggpeat))
+- Fixed the `omp auth-gateway` Responses endpoint rejecting documented null values for temperature, `top_p`, output limits, reasoning, and reasoning summaries ([#17466](https://github.com/can1357/oh-my-pi/pull/17466) by [@Xytronix](https://github.com/Xytronix)).
+- Fixed provider HTTP errors printing the response body twice when the thrown error already carried it, including responses with a retry header ([#17503](https://github.com/can1357/oh-my-pi/pull/17503) by [@metaphoric-dev](https://github.com/metaphoric-dev))
+- Fixed Gemini tool calls through the `omp auth-gateway` chat-completions endpoint failing on the next turn: the gateway now returns each call's thought signature in `extra_content` and replays the one a client sends back ([#17509](https://github.com/can1357/oh-my-pi/pull/17509) by [@justdoGIT](https://github.com/justdoGIT))
+
 ## [18.14.1] - 2026-10-31
 
 ### Added
@@ -2260,63 +2296,4 @@
 - Fixed an issue where malformed tool-call JSON from local Ollama or llama.cpp models was incorrectly retried as generic 500 errors, now surfacing a clear recovery message.
 - Fixed a race condition in OAuth callback flows where abort signals triggered before the callback listener was registered were ignored.
 
-## [16.2.7] - 2026-06-30
-
-### Added
-
-- Added service tier support for Google Gemini and Vertex AI, including model-specific service tier configurations via ServiceTierByFamily.
-- Added Google Vertex AI Interactions API support for Gemini 3+ models by default, with automatic fallback to :streamGenerateContent and a useInteractionsApi: false option to force standard generation.
-- Added support for explicit Vertex bearer access tokens via GOOGLE_CLOUD_ACCESS_TOKEN or CLOUDSDK_AUTH_ACCESS_TOKEN environment variables.
-
-### Changed
-
-- Updated service tier logic to use per-provider configurations instead of global scopes.
-- Refactored priority request billing and accounting to better align with specific provider capabilities.
-- Updated API key resolution precedence so explicit environment variables (e.g., GEMINI_API_KEY) override stored or broker-migrated static API keys, while deliberate OAuth logins still take highest precedence.
-
-### Fixed
-
-- Improved Vertex AI reliability by automatically falling back to global endpoints on 404 errors.
-- Fixed safety setting application for Google Vertex AI models.
-- Fixed Kimi Code's Anthropic-compatible request path to keep thinking enabled and downgrade forced tool choice for Kimi K2.7 Code title generation.
-- Fixed leaked reasoning fences (such as ```thinking or <think>) across all providers by splitting them into structured thinking blocks during streaming.
-- Fixed Codex requests failing with unsupported all_turns errors on older models (gpt-5.1 and gpt-5.3) by gating the reasoning.context: "all_turns" default to gpt-5.4+ models.
-
-## [16.2.6] - 2026-06-29
-
-### Fixed
-
-- Fixed Antigravity usage reporting to correctly infer daily and weekly quota windows from unlabeled reset-only rows, preventing Cloud Code Assist payloads from collapsing these counters into the default category.
-
-## [16.2.5] - 2026-06-28
-
-### Fixed
-
-- Fixed Google and Cloud Code Assist streams that end without a finish reason (dropped connections or truncated responses) being treated as fatal; they are now classified as transient so the coding agent automatically retries.
-
-## [16.2.4] - 2026-06-28
-
-### Added
-
-- Enabled freeform tool patch support for Azure OpenAI and Codex models
-
-### Fixed
-
-- Fixed usage reporting for Antigravity and Z.AI to correctly surface and preserve distinct quota windows (daily, weekly, monthly) instead of collapsing or duplicating them
-- Fixed an issue where `/usage show` returned "No usage data available" when using a custom proxy base URL for Codex
-- Fixed OpenAI stream read errors being incorrectly classified as non-transient, enabling the coding agent to automatically retry after recoverable stream failures
-
-## [16.2.3] - 2026-06-28
-
-### Changed
-
-- Enabled automatic removal of leaked reasoning tags for all models
-- Prevented reasoning text duplication when models emit both structured and inline thinking
-- Defaulted reasoning context to all turns for all Codex requests.
-
-### Fixed
-
-- Enabled freeform tool patch support for Azure OpenAI and Codex models.
-- Fixed an issue where the `/usage show` command returned "No usage data available" when using a custom proxy base URL for Codex.
-
-Older entries are archived in [packages/ai/CHANGELOG.md@cef4a452836c](https://github.com/can1357/oh-my-pi/blob/cef4a452836c7a8d547dd14470c34c9ed2dbb5f8/packages/ai/CHANGELOG.md).
+Older entries are archived in [packages/ai/CHANGELOG.md@7dc0d0325754](https://github.com/can1357/oh-my-pi/blob/7dc0d0325754955b01c15b64b220b2cf27e670db/packages/ai/CHANGELOG.md).

package/dist/types/auth/refresh.d.ts

@@ -40,6 +40,14 @@ export declare class OAuthRefresher {
      * Refresh one stored OAuth credential under durable row ownership.
      */
     refreshStored<T extends OAuthCredential = OAuthCredential>(provider: string, options: StoredOAuthRefreshOptions<T>): Promise<StoredOAuthRefreshResult<T>>;
+    /**
+     * Stop admitting refreshes, then run `closeStore` once tracked work settles:
+     * a token exchange already under way, its save, a lease hand-back. Runs it at
+     * once when nothing is in flight. Closing the store under that work would
+     * lose a refresh token the provider already rotated. Called by
+     * {@link AuthStorage.close} and {@link AuthStorage.replaceStore}.
+     */
+    close(closeStore: () => void): void;
     /**
      * Handles a definitively-dead OAuth grant discovered during refresh (`invalid_grant`,
      * `revoked`, …): checks for a peer rotation that raced the failure, then CAS-disables
@@ -54,6 +62,11 @@ export declare class OAuthRefresher {
      * continuing.
      */
     disableDefinitiveFailure(provider: string, credentialId: number | undefined, attemptedCredential: OAuthCredential, index: number, errorMsg: string): Promise<"disabled" | "peer-rotated" | "cas-lost">;
+    /**
+     * Refresh `credential` unless it is still fresh. Shutdown waits for the
+     * refresh, and for the caller's synchronous save of its result, before the
+     * store closes.
+     */
     refresh(provider: Provider, credential: OAuthCredential, credentialId: number | undefined, signal?: AbortSignal, reason?: OAuthRefreshReason, rejectedAccess?: string): Promise<OAuthCredentials>;
     /**
      * Refresh the OAuth credential with the given id through a per-credential

package/dist/types/auth/types.d.ts

@@ -279,8 +279,13 @@ export interface CredentialDisabledEvent {
     orgId?: string;
     orgName?: string;
 }
-/** Why a delegated OAuth refresh was requested. */
-export type OAuthRefreshReason = "auth-recovery";
+/**
+ * Why an OAuth refresh was requested.
+ * - `auth-recovery`: a provider rejected the bearer with a 401.
+ * - `usage-probe`: a background usage poll; advisory, so a definitive refresh
+ *   failure never disables the credential (an interactive request decides).
+ */
+export type OAuthRefreshReason = "auth-recovery" | "usage-probe";
 /** Configuration supplied when constructing credential storage. */
 export type AuthStorageOptions = {
     usageProviderResolver?: (provider: Provider) => UsageProvider | undefined;
@@ -979,9 +984,10 @@ export interface OAuthRefreshByIdOptions {
      */
     reuseRecentMint?: boolean;
     /**
-     * Provider-401 recovery intent. Forwarded to a delegated refresh (an auth
-     * broker), which may then return a token it minted in the last five minutes.
-     * Local reuse still requires {@link reuseRecentMint}.
+     * Why the refresh was requested. `auth-recovery` is forwarded to a delegated
+     * refresh (an auth broker), which may then return a token it minted in the
+     * last five minutes; local reuse still requires {@link reuseRecentMint}.
+     * `usage-probe` never disables the row on a definitive refresh failure.
      */
     reason?: OAuthRefreshReason;
     /** The access token a provider 401 rejected; see {@link AuthApiKeyOptions.rejectedAccessToken}. */

package/dist/types/auth-storage.d.ts

@@ -46,9 +46,10 @@ export declare class AuthStorage {
     /**
      * Swap the backing credential store in place (live `auth.broker.url` change).
      * Loads `store` into fresh store-bound state — pins, blocks, and usage caches are
-     * keyed by the old store's row ids — then closes the previous store. Runtime key
-     * overrides, account policies, session account restrictions, usage-provider
-     * overrides, and credential event subscribers carry over. On a load failure
+     * keyed by the old store's row ids — then retires the previous store like
+     * {@link AuthStorage.close}. Runtime key overrides, account policies, session
+     * account restrictions, usage-provider overrides, and credential event
+     * subscribers carry over. On a load failure
      * `store` is closed and the current store stays active.
      */
     replaceStore(store: AuthCredentialStore, options?: {
@@ -56,7 +57,11 @@ export declare class AuthStorage {
     }): Promise<void>;
     /** Open the SQLite store at `dbPath` and wrap it (standalone use, e.g. the pi-ai CLI). */
     static create(dbPath: string, options?: AuthStorageOptions): Promise<AuthStorage>;
-    /** Close the underlying credential store; the instance must not be reused. */
+    /**
+     * Close the underlying credential store; the instance must not be reused.
+     * New OAuth refreshes are refused at once; a token exchange already under way
+     * keeps the store open until it has saved the rotated token.
+     */
     close(): void;
     /**
      * Legacy redirect for callers of the pre-namespace flat API (e.g. repo scripts).

package/dist/types/providers/anthropic.d.ts

@@ -17,6 +17,11 @@ export * from "./claude-code-fingerprint.js";
  * pass through untouched, so installing it on every OAuth flow is safe.
  */
 export declare function wrapFetchForCch(base: FetchImpl): FetchImpl;
+/**
+ * Whether a request to `model` sends the tool `name` for the host to run itself, never dispatching the call to the
+ * client: the same decision `encodeAnthropicToolName` makes on the wire.
+ */
+export declare function anthropicHostRunsTool(model: Model<"anthropic-messages">, name: string, headers?: Record<string, string>): boolean;
 export type AnthropicEffort = AnthropicOutputEffort | "adaptive";
 export type AnthropicThinkingDisplay = "summarized" | "omitted";
 export interface AnthropicOptions extends StreamOptions {

package/dist/types/providers/factory-droid.d.ts

@@ -3,6 +3,8 @@ import { type FactoryDroidWire } from "@oh-my-pi/pi-catalog/wire/factory-droid";
 import type { OAuthRequestIdentity } from "../auth/types.js";
 import type { Api, Model, ServiceTier, StreamFunction, StreamOptions, ToolChoice } from "../types.js";
 export interface FactoryDroidOptions extends StreamOptions {
+    /** Per-call workers only: send no refusal fallbacks or fallback-credit beta, and fail a response served by another model. */
+    disableServerSideFallback?: boolean;
     reasoning?: Effort;
     disableReasoning?: boolean;
     toolChoice?: ToolChoice;

package/dist/types/providers/google-auth.d.ts

@@ -3,10 +3,9 @@
  *
  * Replaces `google-auth-library` with a direct WebCrypto + REST implementation.
  * Sources, in priority order:
- *   1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT exchange)
- *     or `type: "authorized_user"` (refresh-token exchange).
+ *   1. `GOOGLE_APPLICATION_CREDENTIALS` env → service account, user, or workforce ADC file.
  *   2. gcloud user ADC: `%APPDATA%\gcloud\application_default_credentials.json` on Windows,
- *     `~/.config/gcloud/application_default_credentials.json` elsewhere (authorized_user flow).
+ *     `~/.config/gcloud/application_default_credentials.json` elsewhere.
  *   3. GCE / Cloud Run metadata server (`metadata.google.internal`).
  *
  * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` before expiry

package/dist/types/providers/openai-chat-server.d.ts

@@ -3,9 +3,15 @@
  * `stream(model, context, options)`.
  */
 import type { AuthGatewayStreamControl, AuthGatewayParsedRequest as ParsedRequest } from "../auth-gateway/types.js";
-import type { AssistantMessage, AssistantMessageEventStream } from "../types.js";
+import type { AssistantMessage, AssistantMessageEventStream, Context, Model } from "../types.js";
 export type { ParsedRequest };
 export declare function parseRequest(body: unknown, headers?: Headers): ParsedRequest;
+/**
+ * Stamp the replayed tool-call turns that carry a Gemini signature as `model`'s own: they came from this gateway
+ * model, and a turn labeled as a foreign model loses its signature in `transformMessages`. Native Gemini
+ * transports replay the raw signature; every other transport keeps the stored envelope.
+ */
+export declare function adoptReplayedGeminiSignatures(context: Context, model: Model): void;
 export declare function encodeResponse(message: AssistantMessage, requestedModelId: string): Record<string, unknown>;
 export declare function encodeStream(events: AssistantMessageEventStream, requestedModelId: string, options?: ParsedRequest["options"], control?: AuthGatewayStreamControl): ReadableStream<Uint8Array>;
 /**

package/dist/types/providers/openai-codex/request-transformer.d.ts

@@ -31,6 +31,7 @@ export interface InputItem {
     type?: string | null;
     role?: string;
     content?: unknown;
+    internal_chat_message_metadata_passthrough?: unknown;
     call_id?: string | null;
     name?: string;
     output?: unknown;

package/dist/types/providers/openai-completions.d.ts

@@ -3,6 +3,19 @@ import type { AssistantMessage, Context, Model, ServiceTier, StreamFunction, Str
 import type { ChatCompletionMessageParam } from "./openai-chat-wire.js";
 import { type OpenAIPromptCacheOptions } from "./openai-shared.js";
 export { applyOpenRouterRoutingVariant } from "./openai-shared.js";
+type GeminiThoughtSignatureNamespace = "google" | "vertex";
+type GeminiThoughtSignatureExtraContent = Partial<Record<GeminiThoughtSignatureNamespace, {
+    thought_signature: string;
+}>>;
+/** The stored signature envelope for a client-replayed `extra_content` (`google` or `vertex`), as this provider writes it. */
+export declare function storeGeminiToolCallSignature(extraContent: unknown): string | undefined;
+/**
+ * The `extra_content` that replays a tool call's Gemini signature on an OpenAI-compatible wire: read from the
+ * envelope this provider stores, or wrapped from the raw signature a native Gemini transport recorded.
+ */
+export declare function geminiToolCallExtraContent(thoughtSignature: string | undefined): GeminiThoughtSignatureExtraContent | undefined;
+/** The raw Gemini signature behind a tool call's `thoughtSignature`, as native Gemini parts carry it. */
+export declare function rawGeminiToolCallSignature(thoughtSignature: string | undefined): string | undefined;
 /**
  * Whether a thinking block's signature is a raw LiteLLM (Anthropic) one, not a
  * reasoning field name or the Mistral content-parts marker.

package/dist/types/providers/openai-responses-server-schema.d.ts

@@ -853,10 +853,10 @@ export declare const toolChoiceSchema: import("@oh-my-pi/omptype").FluentType<"a
 }>;
 export declare const reasoningConfigSchema: import("@oh-my-pi/omptype").FluentType<{
     effort?: string | undefined;
-    summary?: "auto" | "concise" | "detailed" | "none" | undefined;
+    summary?: "auto" | "concise" | "detailed" | "none" | null | undefined;
 }, {
     effort?: string | undefined;
-    summary?: "auto" | "concise" | "detailed" | "none" | undefined;
+    summary?: "auto" | "concise" | "detailed" | "none" | null | undefined;
 }>;
 export declare const stopSchema: import("@oh-my-pi/omptype").FluentType<string | string[] | null, string | string[] | null>;
 export declare const openaiResponsesRequestSchema: import("@oh-my-pi/omptype").FluentType<{
@@ -1101,7 +1101,7 @@ export declare const openaiResponsesRequestSchema: import("@oh-my-pi/omptype").F
         type: string;
     })[] | undefined;
     instructions?: string | null | undefined;
-    max_output_tokens?: number | undefined;
+    max_output_tokens?: number | null | undefined;
     metadata?: unknown;
     model: string;
     parallel_tool_calls?: boolean | undefined;
@@ -1111,14 +1111,14 @@ export declare const openaiResponsesRequestSchema: import("@oh-my-pi/omptype").F
     prompt_cache_key?: string | undefined;
     reasoning?: {
         effort?: string | undefined;
-        summary?: "auto" | "concise" | "detailed" | "none" | undefined;
-    } | undefined;
+        summary?: "auto" | "concise" | "detailed" | "none" | null | undefined;
+    } | null | undefined;
     safety_identifier?: unknown;
     service_tier?: string | undefined;
     stop?: string | string[] | null | undefined;
     store?: boolean | undefined;
     stream?: boolean | undefined;
-    temperature?: number | undefined;
+    temperature?: number | null | undefined;
     text?: unknown;
     tool_choice?: "auto" | "none" | "required" | {
         name: string;
@@ -1148,7 +1148,7 @@ export declare const openaiResponsesRequestSchema: import("@oh-my-pi/omptype").F
         type: string;
     })[] | undefined;
     top_logprobs?: unknown;
-    top_p?: number | undefined;
+    top_p?: number | null | undefined;
     truncation?: unknown;
     user?: string | undefined;
 }, {
@@ -1393,7 +1393,7 @@ export declare const openaiResponsesRequestSchema: import("@oh-my-pi/omptype").F
         type: string;
     })[] | undefined;
     instructions?: string | null | undefined;
-    max_output_tokens?: number | undefined;
+    max_output_tokens?: number | null | undefined;
     metadata?: unknown;
     model: string;
     parallel_tool_calls?: boolean | undefined;
@@ -1403,14 +1403,14 @@ export declare const openaiResponsesRequestSchema: import("@oh-my-pi/omptype").F
     prompt_cache_key?: string | undefined;
     reasoning?: {
         effort?: string | undefined;
-        summary?: "auto" | "concise" | "detailed" | "none" | undefined;
-    } | undefined;
+        summary?: "auto" | "concise" | "detailed" | "none" | null | undefined;
+    } | null | undefined;
     safety_identifier?: unknown;
     service_tier?: string | undefined;
     stop?: string | string[] | null | undefined;
     store?: boolean | undefined;
     stream?: boolean | undefined;
-    temperature?: number | undefined;
+    temperature?: number | null | undefined;
     text?: unknown;
     tool_choice?: "auto" | "none" | "required" | {
         name: string;
@@ -1440,7 +1440,7 @@ export declare const openaiResponsesRequestSchema: import("@oh-my-pi/omptype").F
         type: string;
     })[] | undefined;
     top_logprobs?: unknown;
-    top_p?: number | undefined;
+    top_p?: number | null | undefined;
     truncation?: unknown;
     user?: string | undefined;
 }>;

package/dist/types/types.d.ts

@@ -144,8 +144,10 @@ export declare function resolveModelServiceTier(tiers: ServiceTierByFamily | nul
  * `service_tier_for_request`); an empty or missing list counts as "not
  * reported" — accounts whose `/models` lists no tiers keep `/fast` — so the
  * provider-level answer stands. `flex` and `default` are never gated.
- * First-party OpenAI takes `ultrafast` as-is. A bare provider string cannot
- * carry the list, so it answers for the provider alone.
+ * First-party OpenAI takes `ultrafast` as-is. An OpenAI-family relay on the
+ * Responses/Completions APIs gets `ultrafast` only when its discovered
+ * `service_tiers` lists it. A bare provider string cannot carry the list, so
+ * it answers for the provider alone.
  */
 export declare function shouldSendServiceTier(serviceTier: ServiceTier | null | undefined, target: Provider | ServiceTierModel | undefined): boolean;
 /**
@@ -631,6 +633,8 @@ export interface SimpleStreamOptions extends Omit<StreamOptions, "apiKey"> {
      * provider. Non-Anthropic providers ignore the field.
      */
     fallbacks?: FallbackParam[];
+    /** Factory Droid only: omit refusal fallbacks and reject responses served by another model. */
+    disableServerSideFallback?: boolean;
 }
 export type StreamFunction<TApi extends Api> = (model: Model<TApi>, context: Context, options: OptionsForApi<TApi>) => AssistantMessageEventStream;
 export interface TextSignatureV1 {

package/dist/types/utils/retry-after.d.ts

@@ -1,6 +1,8 @@
 export type HeadersLike = Headers | Record<string, string | undefined> | undefined | null;
 /** Extracts retry timing using the provider's catalog-declared timestamp timezone. */
 export declare function extractProviderRetryHint(provider: string | undefined, message: string | undefined): number | undefined;
-export declare function formatErrorMessageWithRetryAfter(error: unknown, headers?: HeadersLike): string;
+export declare function errorMessageText(error: unknown): string;
+export declare function appendRetryAfterHint(message: string, headers: HeadersLike): string;
+export declare function formatErrorMessageWithRetryAfter(error: unknown): string;
 export declare function getRetryAfterMsFromHeaders(headers: HeadersLike): number | undefined;
 export declare function getHeadersFromError(error: unknown): HeadersLike;

package/dist/types/utils/thinking-loop.d.ts

@@ -5,11 +5,17 @@ import { AssistantMessageEventStream } from "./event-stream.js";
  *  classifiers treat it as a transient (retryable) stop without bespoke rules. */
 export declare const THINKING_LOOP_ERROR_MARKER = "Thinking loop detected";
 /**
- * True when resolved compatibility policy enables semantic loop heuristics for
- * this model. Exact suffix-cycle detection applies to every enabled model
- * independently of this predicate.
+ * How much of the loop guard runs on a stream: `off` none, `exact` only
+ * exact suffix cycles, `semantic` exact cycles plus the near-duplicate and
+ * progress-lexicon paragraph heuristics.
  */
-export declare function isLoopGuardedModel(model: Model<Api>, options?: StreamOptions): boolean;
+export type LoopGuardLevel = "off" | "exact" | "semantic";
+/**
+ * Loop-guard level for a model stream. `PI_NO_THINKING_LOOP_GUARD=1` and
+ * `loopGuard.enabled: false` turn it off; otherwise the model line's
+ * `thinking-loop-guard` catalog axis decides, and unassigned lines get `exact`.
+ */
+export declare function loopGuardLevel(model: Model<Api>, options?: StreamOptions): LoopGuardLevel;
 /**
  * Stateful detector fed the streamed thinking deltas. `push` returns a
  * human-readable reason the first time a loop shape is recognized; the caller
@@ -75,11 +81,10 @@ export declare class GeminiHeaderRunDetector {
  */
 export declare function guardThinkingLoopStream(inner: AssistantMessageEventStream, model: Model<Api>, controller: AbortController, options?: StreamOptions): AssistantMessageEventStream;
 /**
- * Apply the loop guard around a provider dispatch. Unless explicitly disabled,
- * every model gets exact suffix-cycle detection; Gemini, DeepSeek, and Grok also
- * get the semantic heuristics selected by {@link isLoopGuardedModel}. The guard
- * injects an abort signal into the provider call so a detected loop tears down
- * the upstream, then wraps the returned stream. Bounding result-path re-samples
+ * Apply the loop guard around a provider dispatch at the model's
+ * {@link loopGuardLevel}; `off` dispatches unwrapped. The guard injects an
+ * abort signal into the provider call so a detected loop tears down the
+ * upstream, then wraps the returned stream. Bounding result-path re-samples
  * lives in the result-awaiting caller.
  */
 export declare function withThinkingLoopGuard<O extends {

package/dist/types/utils.d.ts

@@ -34,6 +34,11 @@ export declare function stripOpenAIResponsesOutputOnlyStatusesForReplay<TItem ex
     type?: unknown;
     status?: unknown;
 }>(items: TItem[]): TItem[];
+/** Remove Codex-rejected backend metadata; preserve clean-item identity by default, or copy while keeping/dropping id. */
+export declare function stripOpenAIResponsesInternalMetadataForReplay<TItem extends {
+    id?: unknown;
+    internal_chat_message_metadata_passthrough?: unknown;
+}>(item: TItem, mode?: "preserve" | "copy" | "drop-id"): TItem;
 /** Clamp replayed images without changing item identities or other native replay fields. */
 export declare function clampOpenAIResponsesImageDetailForReplay<TItem extends {
     type?: unknown;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.14.1",
+	"version": "18.15.0",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,11 +155,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.14.1",
-		"@oh-my-pi/pi-catalog": "18.14.1",
-		"@oh-my-pi/pi-natives": "18.14.1",
-		"@oh-my-pi/pi-utils": "18.14.1",
-		"@oh-my-pi/pi-wire": "18.14.1"
+		"@oh-my-pi/omptype": "18.15.0",
+		"@oh-my-pi/pi-catalog": "18.15.0",
+		"@oh-my-pi/pi-natives": "18.15.0",
+		"@oh-my-pi/pi-utils": "18.15.0",
+		"@oh-my-pi/pi-wire": "18.15.0"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/auth/refresh.ts

@@ -367,10 +367,7 @@ export class OAuthRefresher {
 		this.#armShutdownDrain();
 		const settled = () => {
 			this.#pendingRefreshes.delete(pending);
-			if (this.#pendingRefreshes.size === 0 && !this.#shuttingDown) {
-				this.#cancelRefreshCleanup?.();
-				this.#cancelRefreshCleanup = undefined;
-			}
+			if (this.#pendingRefreshes.size === 0 && !this.#shuttingDown) this.#disarmShutdownDrain();
 		};
 		void pending.then(settled, settled);
 		return pending;
@@ -389,12 +386,41 @@ export class OAuthRefresher {
 		});
 	}
 
+	#disarmShutdownDrain(): void {
+		this.#cancelRefreshCleanup?.();
+		this.#cancelRefreshCleanup = undefined;
+	}
+
 	async #drainRefreshes(): Promise<void> {
 		this.#shuttingDown = true;
 		// Work tracked while draining (a lease hand-back a returning caller left behind) is waited for too.
 		while (this.#pendingRefreshes.size > 0) await Promise.allSettled(this.#pendingRefreshes);
 	}
 
+	/**
+	 * Stop admitting refreshes, then run `closeStore` once tracked work settles:
+	 * a token exchange already under way, its save, a lease hand-back. Runs it at
+	 * once when nothing is in flight. Closing the store under that work would
+	 * lose a refresh token the provider already rotated. Called by
+	 * {@link AuthStorage.close} and {@link AuthStorage.replaceStore}.
+	 */
+	close(closeStore: () => void): void {
+		this.#shuttingDown = true;
+		if (this.#pendingRefreshes.size === 0) {
+			this.#disarmShutdownDrain();
+			closeStore();
+			return;
+		}
+		void this.#drainRefreshes().then(() => {
+			this.#disarmShutdownDrain();
+			try {
+				closeStore();
+			} catch (error) {
+				logger.warn("Credential store close after OAuth refresh drain failed", { error: String(error) });
+			}
+		});
+	}
+
 	async #refreshStored<T extends OAuthCredential = OAuthCredential>(
 		provider: string,
 		options: StoredOAuthRefreshOptions<T>,
@@ -884,7 +910,12 @@ export class OAuthRefresher {
 		return "disabled";
 	}
 
-	async refresh(
+	/**
+	 * Refresh `credential` unless it is still fresh. Shutdown waits for the
+	 * refresh, and for the caller's synchronous save of its result, before the
+	 * store closes.
+	 */
+	refresh(
 		provider: Provider,
 		credential: OAuthCredential,
 		credentialId: number | undefined,
@@ -892,13 +923,14 @@ export class OAuthRefresher {
 		reason?: OAuthRefreshReason,
 		rejectedAccess?: string,
 	): Promise<OAuthCredentials> {
+		if (this.#shuttingDown) return Promise.reject(new AIError.AbortError("OAuth refresh stopped during shutdown"));
 		const authRecovery = reason === "auth-recovery";
 		if (authRecovery && credentialId !== undefined && !this.#oauthCredentialRefreshInFlight.has(credentialId)) {
 			const recent = this.#recentMint(credentialId);
 			// A token the provider has just rejected is not a usable recent mint.
-			if (recent && recent.credential.access !== rejectedAccess) return recent.credential;
+			if (recent && recent.credential.access !== rejectedAccess) return Promise.resolve(recent.credential);
 		}
-		return this.#refreshSingleFlight(provider, credential, credentialId, signal, reason, rejectedAccess);
+		return this.#track(this.#refreshSingleFlight(provider, credential, credentialId, signal, reason, rejectedAccess));
 	}
 
 	/** Refresh without recent-mint reuse; still shares the per-credential in-flight request. */
@@ -947,7 +979,8 @@ export class OAuthRefresher {
 			.finally(() => {
 				this.#oauthCredentialRefreshInFlight.delete(credentialId);
 			});
-		this.#oauthCredentialRefreshInFlight.set(credentialId, promise);
+		// Tracked apart from the caller: a refresh its caller abandoned still has to finish before the store closes.
+		this.#oauthCredentialRefreshInFlight.set(credentialId, this.#track(promise));
 		return raceSignal(promise, signal, "credential refresh aborted");
 	}
 
@@ -973,7 +1006,9 @@ export class OAuthRefresher {
 				// `refreshStored` owns the caller budget and the exchange backstop.
 				refresh: (current, refreshSignal) =>
 					this.#requestOAuthCredentialRefresh(provider, current, credentialId, refreshSignal, reason, undefined),
-				isDefinitiveFailure: error => AIError.isDefinitiveOAuthFailure(String(error)),
+				// A usage probe is advisory: leave a dead grant for an interactive request to disable.
+				isDefinitiveFailure:
+					reason === "usage-probe" ? undefined : error => AIError.isDefinitiveOAuthFailure(String(error)),
 				disabledCause: error => `oauth refresh failed: ${String(error)}`,
 			});
 			if (result.credential) {
@@ -1088,6 +1123,7 @@ export class OAuthRefresher {
 		signal?: AbortSignal,
 		options?: OAuthRefreshByIdOptions,
 	): Promise<AuthCredentialSnapshotEntry> {
+		if (this.#shuttingDown) throw new AIError.AbortError("OAuth refresh stopped during shutdown");
 		const existing = this.#oauthRefreshInFlight.get(id);
 		if (existing) {
 			const joined = await raceSignal(existing, signal, "credential refresh aborted");
@@ -1122,7 +1158,8 @@ export class OAuthRefresher {
 				this.#oauthRefreshInFlight.delete(id);
 			}
 		})();
-		this.#oauthRefreshInFlight.set(id, promise);
+		// Saves by id itself; tracked so the store stays open until that save lands.
+		this.#oauthRefreshInFlight.set(id, this.#track(promise));
 		return raceSignal(promise, signal, "credential refresh aborted");
 	}
 
@@ -1164,7 +1201,8 @@ export class OAuthRefresher {
 				// A definitively-dead grant tears the row down here, where the
 				// attempted credential is known. CAS on the persisted credential so a
 				// peer/login rotation in flight leaves the freshly-rotated row intact.
-				if (AIError.isDefinitiveOAuthFailure(String(error))) {
+				// A usage probe is advisory: leave a dead grant for an interactive request to disable.
+				if (reason !== "usage-probe" && AIError.isDefinitiveOAuthFailure(String(error))) {
 					// CAS-loss (false) means a peer/login rotated the row mid-refresh, so
 					// our #data copy is stale — reload so the next caller serves the
 					// freshly-rotated credential rather than the dead token we attempted.