@oh-my-pi/pi-ai 18.2.0 → 18.2.2

package/CHANGELOG.md

@@ -2,6 +2,59 @@
 
 ## [Unreleased]
 
+## [18.2.2] - 2026-09-16
+
+### Added
+
+- Added configurable `baseUrl` support for `bedrock-converse-stream` requests, enabling Amazon Bedrock providers and compatible custom providers to use VPC or PrivateLink endpoints, FIPS hosts, and internal gateways, including endpoints mounted under a path or authenticated with query parameters.
+
+### Fixed
+
+- Corrupt credential databases are now backed up privately and recreated instead of preventing startup; signing in again restores credentials.
+- Fixed malformed Anthropic thinking signatures that could freeze sessions at 100% CPU.
+- Fixed Anthropic-compatible gateway tool-call handling so client-declared tools are reported with `stop_reason: "tool_use"` and already-executed native provider tools are not exposed for clients to run again.
+- Fixed gateway session isolation when clients omit a session key, preventing one conversation's retained provider state from affecting another.
+- Fixed retained provider state across credential switches so account-specific capabilities are re-evaluated while reusable endpoint capabilities remain available.
+- Fixed session retention limits closing provider state while a request is still streaming.
+- ChatGPT accounts that have exhausted a plan's usage window but still have available Codex credit can now continue to be selected for Codex requests.
+- Cursor requests now honor explicit max-mode markers on wire-backed models instead of inferring the mode from the model suffix.
+- OpenAI-compatible chat responses containing only structured tool calls now report time to first token correctly.
+
+## [18.2.1] - 2026-09-15
+
+### Added
+
+- Added support for Cerebras Qwen 3.8-27b with improved reasoning effort control
+- Added optional host browser-session callbacks for Perplexity SSO login, keeping browser automation out of pi-ai and preserving email and authenticator-code login.
+
+### Fixed
+
+- Fixed the auth-gateway sending a model's own reasoning back to Anthropic as demoted plain text, which tripped the `reasoning_extraction` classifier on Fable, leaked reasoning into visible answers on Opus, Sonnet and Haiku, and broke the prompt cache prefix on every tool-calling turn. Replayed assistant turns now carry the model id the request resolves to and a `stopReason` derived from the turn's own tool calls, so same-model thinking blocks keep their signatures and replay natively ([#12115](https://github.com/can1357/oh-my-pi/pull/12115) by [@Zhu-Aemon](https://github.com/Zhu-Aemon)).
+- Fixed custom OpenAI-compatible Responses streams crashing on omitted delta payloads or reasoning-summary fields, and recovered text delivered only in completed snapshots ([#11863](https://github.com/can1357/oh-my-pi/pull/11863) by [@moodiness](https://github.com/moodiness)).
+- Fixed streaming CPU blowup on long Responses turns: per-delta content-index lookups are now O(1) instead of re-scanning the accumulated content blocks, eliminating the quadratic work that could freeze the TUI for tens of seconds to minutes while a subagent streams ([#10605](https://github.com/can1357/oh-my-pi/issues/10605)).
+- Fixed sessions permanently wedged by `400 Invalid signature in thinking block` after a failover proxy swapped upstream models mid-conversation (e.g. Claude -> GLM -> Claude): when the unsigned-demotion retry fails identically, the anthropic-messages transport now retries once with replayed thinking dropped and pins that mode for the session, so the conversation continues without starting a new session ([#12006](https://github.com/can1357/oh-my-pi/pull/12006) by [@Damin-Lee](https://github.com/Damin-Lee)).
+- Fixed OpenAI Codex backend rejecting requests with HTTP 400 (`string_above_max_length`) when replaying tool call IDs exceeding 64 characters or containing composite delimiters (`|`, `\n`) by sanitizing and deterministically clamping call IDs on the wire ([#11342](https://github.com/can1357/oh-my-pi/pull/11342)).
+- Fixed OpenRouter multi-turn tool-call sessions failing with `400 Referenced reasoning item ... was not found or has expired` on Meta Muse Spark models by suppressing reasoning reconstruction when history is filtered and synthetic replay is disallowed, while preserving Anthropic and DeepSeek replay ([#10966](https://github.com/can1357/oh-my-pi/issues/10966)).
+- The auth gateway now keeps provider session state per session, so a model reached through it stops re-learning the same rejection every turn. Sticky fallbacks such as strict-tools and fast mode previously did nothing on the `pi-native` transport used by containerized and robomp deployments, because the state cannot cross the wire and the gateway kept none of its own ([#12058](https://github.com/can1357/oh-my-pi/pull/12058) by [@camjac251](https://github.com/camjac251)).
+- Fixed full OpenAI Responses request-body timeout recovery so the exact HTTP 408 is surfaced for a changed-request recovery instead of repeated unchanged transport retries when eligible tool-result history can be safely elided ([#11878](https://github.com/can1357/oh-my-pi/pull/11878) by [@hellofrommorgan](https://github.com/hellofrommorgan)).
+- Fixed Codex sessions producing unrelated visible output on later turns after a progress-only response. ([#11466](https://github.com/can1357/oh-my-pi/issues/11466))
+- Fixed OpenRouter reasoning models (e.g. Meta Muse Spark) rejecting every turn with `400 Provider returned error` after the session history contains a tool-call turn from another provider, by no longer sending a fabricated reasoning item id ([#11791](https://github.com/can1357/oh-my-pi/pull/11791) by [@brndnmtthws](https://github.com/brndnmtthws)).
+- Fixed statusless stream-drop diagnostics (stream disconnected/closed before `response.completed`, upstream stream interrupted or ended before its terminal chunk, socket disconnected before the secure TLS handshake) classifying as terminal errors, so they now retry like their status-tagged twins instead of settling the turn ([#11805](https://github.com/can1357/oh-my-pi/issues/11805)).
+- OpenAI-compatible endpoints that report `ReasoningEffort` in CamelCase now trigger effort-downgrade retries instead of terminating turns with HTTP 400 ([#11804](https://github.com/can1357/oh-my-pi/issues/11804)).
+- Fixed openai-responses replay wedging a repaired orphan tool-result note between another call's `function_call` and `function_call_output`, which broke round pairing on strict validators (e.g. DeepSeek) with `400 No tool output found for tool call …`: orphan-output/call repair now runs before the interleaved-message hoist, so any injected note is relocated out of the tool-call batch ([#11473](https://github.com/can1357/oh-my-pi/issues/11473)).
+- A stale Anthropic tier block (`tier:fable`, `tier:mythos`) is now cleared once a live usage report shows headroom on both the tier row and the shared windows, instead of idling a usable account until the reported reset. Healing requires a live report, and a credential held by an unscoped block spends no usage request on a probe that cannot lift it ([#11334](https://github.com/can1357/oh-my-pi/pull/11334) by [@AshishKumar4](https://github.com/AshishKumar4)).
+- A running session now picks up credentials another process committed: adding an account in a second terminal is visible to credential selection and rotation without restarting the session, and a session's pinned account is re-resolved by row id so a row another process deleted cannot hand its slot to a sibling ([#11329](https://github.com/can1357/oh-my-pi/pull/11329) by [@AshishKumar4](https://github.com/AshishKumar4)).
+- Fixed rate-limit/overload failures that arrive *inside* an HTTP 200 body (Azure, LiteLLM-style aggregators, and reverse proxies that already committed to the stream) not advancing `retry.fallbackChains`: a `{"error":{…}}`/`{"code":429}` chunk or a plain-text throttle frame (`429 Too Many Requests`, an nginx page) is now classified as a retryable 429/5xx through the same path an HTTP-status 429 takes, so a busy provider backs off and fails over instead of ending the session. Only bodies the provider actually reported are used: no status is inferred from error wording, and an unreadable body can no longer consume a credential.
+- Fixed tool schema normalization and cycle detection for frozen, sealed, and nonextensible schemas.
+- Reduced memory retained by `complete()` and `completeSimple()` while streaming responses.
+- Antigravity quota summaries now identify Claude/GPT routing copies as one shared upstream pool while preserving model-specific quota selection ([#11268](https://github.com/can1357/oh-my-pi/issues/11268)).
+- Fixed the auth-gateway rejecting `content: null` on `/v1/responses` and `/v1/chat/completions` message items with a 400; Codex and other OpenAI clients that emit null content on empty turns now work, matching OpenAI's tolerance ([#10956](https://github.com/can1357/oh-my-pi/issues/10956)).
+- Fixed Azure GPT-6 Astra Chat Completions requests with function tools sending a non-`none` reasoning effort, which Azure rejects with HTTP 400 ([#11052](https://github.com/can1357/oh-my-pi/issues/11052)).
+- Fixed Z.AI and Zhipu usage-limit credential blocks and oneshot completion retries (titles, summaries, classifiers) resolving eight hours late when provider responses omit the reset timestamp timezone ([#11014](https://github.com/can1357/oh-my-pi/issues/11014)).
+- Fixed provider requests failing with `ENOENT` when another process removes a stale shared concurrency lock during acquisition.
+- Fixed Devin-hosted Gemini models rejecting turns that include nullable tool parameters by normalizing tool schemas to Gemini's supported JSON Schema dialect ([#8647](https://github.com/can1357/oh-my-pi/issues/8647), [#10233](https://github.com/can1357/oh-my-pi/pull/10233) by [@will-bogusz](https://github.com/will-bogusz)).
+- Fixed Devin gateway failures leaking raw proxy HTML into turn errors; HTTP status and retry metadata remain available for recovery ([#10233](https://github.com/can1357/oh-my-pi/pull/10233) by [@will-bogusz](https://github.com/will-bogusz)).
+
 ## [18.2.0] - 2026-09-15
 
 ### Added

package/README.md

@@ -1084,6 +1084,8 @@ omp auth-broker logout             # interactive — pick a stored credential to
 
 Credentials are saved to `agent.db` in the agent directory. `/login qianfan` opens the Qianfan console and stores the pasted API key.
 
+If SQLite reports corruption during startup, the damaged database and remaining journal sidecars are preserved beside it as private `agent.db.corrupt-<timestamp>-<id>*` backups before a fresh database is created. The log records the backup path. This restores startup, not unreadable credentials: log in again; retain the backups for manual data recovery. Lock contention and other non-corruption errors never reset the database.
+
 `login` supports OAuth providers (Anthropic, OpenAI Codex, GitHub Copilot, Gemini CLI, Antigravity) and API-key onboarding flows.
 
 For the current API-key onboarding flows, the library covers Together, Moonshot, Qianfan, NVIDIA, NanoGPT, Novita, DeepInfra, Hugging Face, Venice, Xiaomi, vLLM, LiteLLM, Cloudflare AI Gateway, Qwen Portal, and Ollama Cloud. Ollama remains the local runtime integration; set `OLLAMA_API_KEY` only when your local or self-hosted deployment enforces bearer auth.

package/dist/types/auth/sqlite-credential-store.d.ts

@@ -4,7 +4,7 @@
  * The public AuthCredentialStore interface remains in ../auth-storage so local
  * and remote stores share the same contract.
  */
-import { Database } from "bun:sqlite";
+import type { Database } from "bun:sqlite";
 import { isSqliteBusyError, isSqliteCorruptionError } from "@oh-my-pi/pi-utils";
 import type { AuthCredential, AuthCredentialStore, CredentialRefreshLeaseFence, DisabledCredentialSummary, StoredAuthCredential, StoredCredentialBlock } from "../auth-storage.js";
 import type { OAuthCredentials } from "../registry/oauth/types.js";
@@ -29,6 +29,7 @@ export declare function resolveCredentialIdentityKey(provider: string, credentia
 export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
     #private;
     constructor(db: Database);
+    /** Opens credential storage with bounded busy retries and one-shot corruption recovery. */
     static open(dbPath?: string): Promise<SqliteAuthCredentialStore>;
     listAuthCredentials(provider?: string): StoredAuthCredential[];
     listDisabledCredentials(provider?: string): Promise<DisabledCredentialSummary[]>;

package/dist/types/auth-broker/remote-store.d.ts

@@ -51,6 +51,23 @@ export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
     get snapshot(): SnapshotResponse;
     /** Re-hydrate the in-memory snapshot from the broker. */
     refreshSnapshot(): Promise<SnapshotResponse>;
+    /**
+     * Stateful probe for broker-side credential changes, mirroring
+     * {@link SqliteAuthCredentialStore.pollExternalChanges} so long-lived broker
+     * clients (notably `auth-gateway serve`) pick up logins/logouts made by
+     * another process without a restart.
+     *
+     * Compares a local content revision, not the broker's numeric generation:
+     * generation is an in-memory counter that resets when the broker process
+     * restarts, so a reconnecting stream can deliver a different credential set
+     * under a repeated (or lower) generation. {@link #refreshCredentialRevision}
+     * bumps the revision whenever the applied credential material actually
+     * changes, catching those cases too. Records foreground activity first: a
+     * low-traffic client's background sync parks after `#backgroundIdleMs`, and
+     * without this wakeup it would never fetch the new snapshot to report in the
+     * first place.
+     */
+    pollExternalChanges(): boolean;
     listAuthCredentials(provider?: string): StoredAuthCredential[];
     /** Broker-backed disabled tombstones; empty against brokers predating the endpoint. */
     listDisabledCredentials(provider?: string, signal?: AbortSignal): Promise<DisabledCredentialSummary[]>;

package/dist/types/auth-gateway/index.d.ts

@@ -1,3 +1,4 @@
 export * from "./http.js";
+export * from "./session-state.js";
 export * from "./server.js";
 export * from "./types.js";

package/dist/types/auth-gateway/session-state.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Server-owned provider session state for the auth-gateway.
+ *
+ * `SimpleStreamOptions.providerSessionState` is how a provider keeps what it
+ * learned about an endpoint across turns of one conversation: Anthropic's
+ * sticky `strictToolsDisabled` / `fastModeDisabled` /
+ * `replayUnsignedThinkingDisabled` flags and dropped-thinking-prefix set,
+ * OpenAI's strict-tools and reasoning-effort fallbacks, Codex's WebSocket and
+ * turn-state sessions. An in-process omp session owns that `Map` for its whole
+ * lifetime, so a grammar-too-large 400 or a fast-mode rejection costs one
+ * wasted round-trip per session rather than one per turn.
+ *
+ * The map is deliberately non-serializable — `Set`/`Map` fields, live sockets,
+ * a `close()` method — so `pi-native-client` strips it from the wire and
+ * `pi-native-server` never accepts it. Gateway clients therefore cannot bring
+ * their own, and without a server-side owner every containerized / robomp turn
+ * re-learns every lesson from a fresh upstream rejection.
+ *
+ * A plain `Map<sessionId, …>` in a long-lived server process is a leak: nothing
+ * ever reclaims an entry, and the entries own timers and sockets. This store is
+ * an LRU with a hard entry ceiling that calls `close()` on everything it drops
+ * and on everything it still holds at shutdown — but it only ever drops an
+ * entry no request is holding, because `close()` on a live entry tears down
+ * state an in-flight stream is still streaming through.
+ */
+import type { Api, Context, Model, ProviderSessionState } from "../types.js";
+/**
+ * Retained logical sessions. Each entry is a handful of small provider records
+ * plus, for Codex, a WebSocket session — cheap to keep, but not free, so the
+ * ceiling is what turns "one entry per session id forever" into a bounded cost.
+ * Eviction is least-recently-used, so the ceiling only ever drops sessions that
+ * have been quiet longer than the 256 most recent ones.
+ */
+export declare const AUTH_GATEWAY_MAX_SESSION_STATES = 256;
+/**
+ * One request's claim on a retained session.
+ *
+ * `release()` is what makes the entry evictable again, so it MUST run for every
+ * outcome of the request — a `finally` at the call site for the synchronous
+ * paths, stream completion for the streaming ones. It is idempotent, so the
+ * two can overlap.
+ */
+export interface AuthGatewaySessionStateLease {
+    /** The map to hand to `streamSimple` as `providerSessionState`. */
+    readonly states: Map<string, ProviderSessionState>;
+    /** Reset account-scoped records if an in-request auth retry switches accounts. */
+    updateAccount(account: string): void;
+    /** Give up this request's claim. Idempotent. */
+    release(): void;
+}
+/** Everything the store needs to place one request on a retained session. */
+export interface AuthGatewaySessionStateRequest {
+    /**
+     * The client's own session key (`prompt_cache_key` / `sessionId`), or
+     * `undefined` when it sent none — blank counts as none. A supplied key is
+     * authoritative: the client is telling us which conversation this is.
+     */
+    clientKey: string | undefined;
+    model: Model<Api>;
+    /**
+     * System prompt, tools and message history of this request. Used only when
+     * `clientKey` is absent, to place the request on the conversation it
+     * continues.
+     */
+    context: Context;
+    /**
+     * Stable identity of the account this request's credential resolved to.
+     * A change means the gateway switched the session to a sibling credential,
+     * so the account-dependent lessons in the retained map are re-probed. The
+     * comparison happens on acquire and whenever an in-request auth retry
+     * resolves a sibling credential.
+     */
+    account: string;
+}
+/**
+ * Bounded per-session provider state, owned by one gateway server instance.
+ *
+ * Two gateways in the same process get separate stores, so neither can hand a
+ * request another gateway's learned state or close it out from under one.
+ *
+ * The recency order is this class's own (a `Map` iterates in insertion order,
+ * and every acquire re-inserts) rather than `LRUCache`'s, because the policy
+ * needs two things a general cache cannot express: an entry that a request is
+ * still holding must be skipped when picking a victim, and an entry must be
+ * able to change key — `LRUCache` disposes on every removal, which is precisely
+ * the `close()` we must not run here.
+ */
+export declare class AuthGatewaySessionStateStore {
+    #private;
+    constructor(max?: number);
+    /** Retained logical sessions. */
+    get size(): number;
+    /**
+     * Claim the provider-session map for one request, created on first use and
+     * returned by reference so provider mutations persist into the next request.
+     *
+     * Keyed by provider + model + conversation (see {@link sessionKeys}). A
+     * client is free to reuse one session id across models, and the coarsest
+     * provider entries do not separate models themselves (`openai-responses`
+     * keys its strict-tools / history-replay record by provider alone,
+     * Antigravity by a single constant), so the model belongs in the key here.
+     * Endpoint is deliberately absent: every provider whose learning is
+     * endpoint-specific already sub-keys it internally
+     * (`anthropic-messages:${baseUrl}\0${modelId}`,
+     * `openai-completions:${provider}:${baseUrl}:${modelId}`), and repeating it
+     * would only fragment the map. The credential is absent for the same reason
+     * — most of what is retained is true of the endpoint whoever calls it, and
+     * Codex already sub-keys its transport by account and bearer — so a
+     * credential switch resets the account-dependent subset instead of
+     * splitting the entry (see `resetAccountScopedProviderSessionState`).
+     *
+     * The returned lease MUST be released; until then the entry cannot be
+     * evicted.
+     */
+    acquire(request: AuthGatewaySessionStateRequest): AuthGatewaySessionStateLease;
+    /** Close and drop every retained state. Called when the gateway shuts down. */
+    close(): void;
+}

package/dist/types/auth-storage.d.ts

@@ -502,6 +502,11 @@ export { isDefinitiveOAuthFailure } from "./error/auth-classify.js";
  * the usage report reveals. Callers that wait the account out (instead of
  * rotating) must sleep until this, not the error-text hint alone.
  *
+ * `requestedBlockedUntilMs` (epoch ms) is this mark call's initial deadline,
+ * before usage-report correction and longest-wins merging. Callers use it to
+ * distinguish the call's replaceable heuristic from a longer merged block
+ * that credential selection will continue enforcing.
+ *
  * `priorBlockedUntilMs` (epoch ms) is the live block deadline the map already
  * stored for this credential before this call. The merged `blockedUntilMs`
  * masks a pre-existing block shorter than this call's own heuristic
@@ -527,6 +532,8 @@ export interface UsageLimitMarkResult {
     switched: boolean;
     retryAtMs?: number;
     blockedUntilMs?: number;
+    /** This mark call's initial deadline, before report correction and merging. */
+    requestedBlockedUntilMs?: number;
     priorBlockedUntilMs?: number;
     priorBlockedUntilTimed?: boolean;
     reportResetAtMs?: number;
@@ -969,6 +976,7 @@ export declare class AuthStorage {
     ingestUsageHeaders(provider: Provider, headers: Record<string, string>, options?: {
         sessionId?: string;
         baseUrl?: string;
+        responseStatus?: number;
     }): boolean;
     /**
      * The {@link UsageProvider} registered for `provider`, or undefined when the
@@ -1116,6 +1124,15 @@ export declare class AuthStorage {
     pinSessionOAuthAccount(provider: string, sessionId: string, credentialId: number, options?: {
         lastUsedAtMs?: number;
     }): boolean;
+    /**
+     * Copy every stored credential affinity from one live session to another.
+     *
+     * The target receives its own sticky entries, so request resolution, usage
+     * blocking, credential rotation, metadata, and persisted pins all continue
+     * through the target session id without retaining a live dependency on the
+     * source session.
+     */
+    inheritSessionCredentials(sourceSessionId: string, targetSessionId: string): number;
     /**
      * Resolve every stored OAuth credential for `provider` independently.
      *

package/dist/types/error/body-error.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Build the classified error for an in-band failure frame, or `undefined` when
+ * the frame is not a retryable in-band failure (in which case the caller keeps
+ * its existing handling and message).
+ *
+ * @param frame decoded SSE `data:` payload, or the `{ error, response }` subset of one
+ */
+export declare function createInBandProviderError(frame: unknown): Error | undefined;
+/**
+ * Build the classified error for a non-JSON SSE frame: gateways and reverse
+ * proxies that answer `data: 429 Too Many Requests` or an HTML throttle page
+ * instead of an OpenAI envelope. `undefined` when the text is not recognisable
+ * as a throttle, so genuinely malformed payloads keep failing loudly.
+ */
+export declare function createInBandProviderErrorFromText(text: string): Error | undefined;

package/dist/types/error/flags.d.ts

@@ -34,6 +34,15 @@ export declare const PYTHON_HTTP2_STREAM_RESET_PATTERN: RegExp;
 export declare const PYTHON_HTTP_INCOMPLETE_CHUNK_PATTERN: RegExp;
 /** reqwest body-frame failures forwarded by the Codex HTTP proxy. */
 export declare const CODEX_HTTP_BODY_READ_ERROR_PATTERN: RegExp;
+/** Exact HTTP request-body-read timeout diagnostic. */
+export declare function isRequestBodyReadTimeout(status: number | undefined, message: string | undefined): boolean;
+/** Exact pre-output Responses 408 that needs a changed-request recovery path. */
+export declare function isResponsesRequestBodyReadTimeout(message: {
+    api?: Api;
+    errorStatus?: number;
+    errorMessage?: string;
+    requestBodyReadTimeoutFullReplay?: boolean;
+}): boolean;
 export declare const TRANSIENT_TRANSPORT_PATTERN: RegExp;
 /**
  * Local llama.cpp / Ollama deterministic tool-call argument JSON parse failure.
@@ -131,6 +140,13 @@ export declare function stringify(id: number | undefined): string;
  * low-signal to trust once detached from a live transport `Error`, which keeps the broad pattern.
  */
 export declare function isTransientStreamParseError(error: unknown): boolean;
+/**
+ * Transport stream-drop diagnostic (see {@link STREAM_DROP_PATTERN}). Unlike
+ * {@link isTransientStreamParseError}, one pattern serves both the live `Error`
+ * and the persisted-string forms: the phrasings are high-signal enough to trust
+ * detached from a transport `Error`.
+ */
+export declare function isTransientStreamDropError(error: unknown): boolean;
 /** Any malformed stream-envelope error (prefix-tagged or out-of-order events). */
 export declare function isStreamEnvelopeError(error: unknown): boolean;
 /** Stream-envelope errors safe to retry against the provider (event ordering only). */

package/dist/types/error/index.d.ts

@@ -2,6 +2,7 @@ export * from "./abort.js";
 export * from "./auth.js";
 export * from "./auth-classify.js";
 export * from "./aws.js";
+export * from "./body-error.js";
 export * from "./classes.js";
 export * from "./finalize.js";
 export * from "./flags.js";

package/dist/types/index.d.ts

@@ -8,6 +8,7 @@ export * from "./auth-storage.js";
 export * from "./error/rate-limit.js";
 export * from "./oneshot-retry.js";
 export * from "./provider-details.js";
+export * from "./provider-session-state.js";
 export * from "./providers/anthropic.js";
 export * from "./providers/anthropic-client.js";
 export * from "./providers/azure-openai-responses.js";

package/dist/types/oneshot-retry.d.ts

@@ -63,6 +63,12 @@ export interface OneshotRetryOptions {
      * Thrown errors need no wiring — headers are recovered from the error itself.
      */
     getResponseHeaders?: () => HeadersLike;
+    /**
+     * Provider id of the model being retried. Selects the catalog-declared
+     * timezone for a timezone-naive absolute reset stamp (Z.AI/Zhipu report
+     * Beijing time), so an over-cap wait is not misread as UTC and discarded.
+     */
+    provider?: string;
     /** Observability hook. Fires immediately before sleeping. */
     onRetry?: (info: OneshotRetryInfo) => void;
 }

package/dist/types/provider-session-state.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Credential-rotation handling for a retained `providerSessionState` map.
+ *
+ * A host that keeps one provider-session map per logical conversation (the
+ * auth-gateway's server-owned store, an in-process omp session) can outlive the
+ * credential that filled it: `AuthStorage.markUsageLimitReached` and the
+ * auth-retry resolver both switch a session to a sibling account mid-flight.
+ * Most of what a provider learns is a property of the *endpoint*, so rebuilding
+ * the whole map on a switch would re-pay every rejected round-trip the map
+ * exists to avoid. A minority is a property of the *account*, and keeping that
+ * across a switch is a bug.
+ *
+ * Audit of what the retained records hold, per provider:
+ *
+ * - **Anthropic** — `fastModeDisabled` is account-scoped: the rejection reads
+ *   "this model does not support fast mode for your account", i.e. a plan
+ *   entitlement, so a switch to an entitled sibling must re-probe. Its
+ *   siblings are endpoint-scoped and stay: `strictToolsDisabled`
+ *   (grammar-too-large 400 for the model's tool schema),
+ *   `replayUnsignedThinkingDisabled` / `thinkingReplayDisabled` (the endpoint
+ *   is a signing proxy), `prefixDroppedThinkingBlocks` (blocks the API itself
+ *   dropped), `controlStates` (per-conversation control baselines).
+ * - **OpenAI Responses** — the `previous_response_id` chain baselines are
+ *   account-scoped: a stored response belongs to the account that created it.
+ *   Strict-tools / reasoning-effort fallbacks, replay warmup and the chaining
+ *   circuit breaker are endpoint-scoped and stay.
+ * - **OpenAI Completions** — strict-tools and reasoning-effort fallbacks only;
+ *   both endpoint-scoped. Nothing to reset.
+ * - **Codex** — already sub-keys its WebSocket sessions by account id AND
+ *   bearer (`getCodexWebSocketSessionKey`), so a switch naturally lands on a
+ *   fresh transport session while the old one stays reachable for teardown.
+ *   Resetting from the outside would close a socket a retry may still be on.
+ * - **Antigravity** — `lastGoodEndpoint` is endpoint-scoped; the agent /
+ *   conversation ids are conversation-scoped. Neither depends on the account.
+ * - **GitLab Duo** — the active workflow is account-bound, but it is a live
+ *   server-side workflow plus socket, and the switch happens *inside* the
+ *   request that may still be resuming it. Tearing it down here would abort the
+ *   very turn that rotated; it stays on its existing session-close path.
+ */
+import type { ProviderSessionState } from "./types.js";
+/**
+ * Reset the account-dependent lessons in `states`, keeping everything a
+ * provider learned about the endpoint. Call when a retained map is about to be
+ * reused for a session whose credential now resolves to a different account.
+ */
+export declare function resetAccountScopedProviderSessionState(states: Map<string, ProviderSessionState>): void;

package/dist/types/providers/amazon-bedrock.d.ts

@@ -5,6 +5,9 @@
  * SigV4 signing and decodes the `application/vnd.amazon.eventstream` response.
  * No `@aws-sdk/*`, no `@smithy/*`, no `proxy-agent`. Proxies are honored via
  * Bun's native `HTTPS_PROXY` support.
+ *
+ * A `models.yml` `baseUrl` is the request origin verbatim (VPC endpoint, gateway, …);
+ * only AWS's own regional host is re-pointed at the resolved region. SigV4 unaffected.
  */
 import type { Effort } from "@oh-my-pi/pi-catalog/effort";
 import type { StreamFunction, StreamOptions, ThinkingBudgets } from "../types.js";

package/dist/types/providers/aws-sigv4.d.ts

@@ -45,6 +45,18 @@ export declare function formatAmzDate(d: Date): {
     longDate: string;
     shortDate: string;
 };
+/**
+ * AWS's canonical-request spec encodes each name/value first, THEN sorts by
+ * the encoded form ("Sort the encoded parameter names by character code" —
+ * https://docs.aws.amazon.com/IAM/latest/UserGuide/create-canonical-request.html).
+ * Sorting the decoded form instead gives the wrong order whenever encoding
+ * changes a character's relative position — e.g. raw key `%7B` (decodes to
+ * `{`, 0x7B) vs `x` (0x78): decoded, `x` < `{`; encoded, `%` (0x25) < `x`, so
+ * `%7B` sorts first. A gateway that validates SigV4 (or AWS itself) computes
+ * the signature over ITS OWN canonicalization and rejects ours if the two
+ * disagree on order.
+ */
+export declare function canonicalQuery(query: string | undefined): string;
 export interface SignedHeaders {
     host: string;
     "x-amz-date": string;

package/dist/types/providers/openai-codex/request-transformer.d.ts

@@ -74,6 +74,33 @@ export interface RequestBody {
  * explicit option; normal inference defaults to the full Responses contract.
  */
 export declare function resolveCodexResponsesLite(requested: boolean | undefined): boolean;
+/**
+ * Repair both halves of unpaired tool exchanges so the Responses input grammar
+ * stays valid — the API rejects either orphan with a 400:
+ *
+ * - `function_call_output` / `custom_tool_call_output` with no matching call →
+ *   folded into an assistant message (`400 No tool call found for … output`).
+ *   Regression of #472 / #1351.
+ * - `function_call` / `custom_tool_call` with no matching `*_output` → a
+ *   placeholder output is synthesized immediately after the call
+ *   (`400 No tool output found for function call …`). Hit when the user
+ *   branches/navigates the session tree to a node that ends on a tool call (the
+ *   tool-result child is dropped from the reconstructed history) or when a turn
+ *   is aborted/crashes after the call streamed but before its result persisted.
+ */
+/**
+ * Sanitize an OpenAI Responses/Codex tool call ID to <= 64 characters and valid charset.
+ * Composite IDs with '|' or '\n' have their secondary/item part stripped.
+ * Hashing is anchored on the canonical base part so assistant and result composites
+ * with different item halves stay identical. Short lossy changes include a hash suffix
+ * to preserve collision resistance across distinct IDs.
+ */
+export declare function sanitizeCodexCallId(rawCallId: string): string;
+/**
+ * In-place mutates the `call_id` property on every input item in the array to conform
+ * to the OpenAI Responses/Codex 64-character limit and valid charset constraints.
+ */
+export declare function sanitizeInputCallIds(input: InputItem[]): void;
 /**
  * Structural view of a Responses-style body mutated by the Lite rewrite.
  * Loose (`unknown`) property types let the turn transformer (`RequestBody`)

package/dist/types/providers/openai-responses.d.ts

@@ -85,6 +85,21 @@ interface OpenAIResponsesChainState {
     /** Set once chaining is judged unsupported for this session (circuit breaker). */
     disabled: boolean;
 }
+/**
+ * Drop the account-bound half of every retained `openai-responses` record in
+ * `states`: the stateful `previous_response_id` chain baselines.
+ *
+ * Chaining stores the turn server-side under the account that created it, so a
+ * baseline minted by one credential is dead weight the moment the session is
+ * switched to a sibling account — the next delta request answers
+ * `Previous response not found` and burns a turn re-learning that. Everything
+ * else this record holds describes the *deployment*, not the account
+ * (strict-tools demotion, reasoning-effort fallback, native-history-replay
+ * warmup, the chaining circuit breaker), and is deliberately preserved:
+ * re-learning an endpoint's limits on every credential switch is the cost this
+ * state exists to avoid.
+ */
+export declare function resetOpenAIResponsesAccountScopedState(states: Map<string, ProviderSessionState>): void;
 type OpenRouterAnthropicCacheControl = {
     type: "ephemeral";
     ttl?: "1h";

package/dist/types/providers/openai-shared.d.ts

@@ -6,7 +6,7 @@ import { kStreamingLastParseLen, kStreamingPartialJson } from "../utils/block-sy
 import type { AssistantMessageEventStream } from "../utils/event-stream.js";
 import type { CapturedHttpErrorResponse } from "../utils/http-inspector.js";
 import type { ChatCompletionCreateParamsStreaming } from "./openai-chat-wire.js";
-import type { InputItem } from "./openai-codex/request-transformer.js";
+import { type InputItem } from "./openai-codex/request-transformer.js";
 import type { ResponseComputerToolCall, ResponseContentPartAddedEvent, ResponseCreateParamsStreaming, ResponseInput, ResponseInputContent, ResponseInputItem, ResponseOutputItem, ResponseOutputMessage, ResponseReasoningItem, ResponseStatus, ResponseStreamEvent } from "./openai-responses-wire.js";
 /**
  * Keyless-provider sentinel. Custom providers configured with `auth: none`
@@ -222,6 +222,21 @@ export interface OpenAIExtraBodyOptions {
 export declare function applyOpenAIExtraBody<P extends object>(params: P & {
     venice_parameters?: Record<string, unknown>;
 }, extraBody: Record<string, unknown> | undefined, options?: OpenAIExtraBodyOptions): void;
+/**
+ * Normalize `content: null` to `[]` in place across a list of inbound wire
+ * message items.
+ *
+ * Codex (and other OpenAI clients) emit `content: null` on empty message items
+ * during multi-turn/tool turns; OpenAI tolerates it. Normalizing before the
+ * auth-gateway's request schema validation lets the item take the same path as
+ * an explicit empty content array — for both validation and any native
+ * history-replay clone — instead of 400ing. Shared by the `/v1/responses`
+ * (`input[]`) and `/v1/chat/completions` (`messages[]`) routes.
+ *
+ * `isEligible` lets a route skip items whose content is not array-typed, e.g.
+ * the chat `function` role whose content is `string | null`. See issue #10956.
+ */
+export declare function coerceNullMessageContentInPlace(items: unknown, isEligible?: (item: Record<string, unknown>) => boolean): void;
 /**
  * Chat Completions streaming request body shaped by the OpenAI-family providers.
  * (binary `thinking`, Qwen `enable_thinking`/`chat_template_kwargs`, Venice
@@ -273,7 +288,7 @@ export interface ChatCompletionsReasoningOptions {
     thinkingBudgets?: Partial<Record<Effort, number>>;
 }
 export type OpenAICompatEndpoint = "chat-completions" | "responses";
-export type OpenAIReasoningDisableReason = "caller" | "forced-tool-choice" | "tool-choice" | "not-requested";
+export type OpenAIReasoningDisableReason = "caller" | "forced-tool-choice" | "tool-choice" | "tools" | "not-requested";
 export type OpenAICompatPolicyCompat = ResolvedOpenAISharedCompat & Partial<ResolvedOpenAICompat> & Partial<ResolvedOpenAIResponsesCompat>;
 export interface ResolveOpenAICompatPolicyOptions {
     endpoint: OpenAICompatEndpoint;
@@ -281,6 +296,7 @@ export interface ResolveOpenAICompatPolicyOptions {
     reasoning?: string;
     disableReasoning?: boolean;
     toolChoice?: unknown;
+    hasTools?: boolean;
     strictResponsesPairing?: boolean;
     includeEncryptedReasoning?: boolean;
     filterReasoningHistory?: boolean;
@@ -351,6 +367,7 @@ export declare function resolveOpenAICompatPolicy<TApi extends Api>(model: Model
 export declare function applyChatCompletionsCompatPolicy(params: OpenAICompletionsParams, policy: OpenAICompatPolicy): void;
 export declare function applyChatCompletionsReasoningParams(params: OpenAICompletionsParams, model: Model<"openai-completions">, compat: ResolvedOpenAICompat, options: (ChatCompletionsReasoningOptions & {
     toolChoice?: unknown;
+    hasTools?: boolean;
 }) | undefined): void;
 export declare function disableChatCompletionsReasoningForDialect(params: OpenAICompletionsParams, compat: ResolvedOpenAICompat): void;
 /**
@@ -550,7 +567,7 @@ type ResponsesToolCallBlock = ToolCall & {
     [kStreamingPartialJson]: string;
     [kStreamingLastParseLen]?: number;
 };
-export declare function appendReasoningSummaryPart(item: ResponseReasoningItem, part: ResponseReasoningItem["summary"][number]): void;
+export declare function appendReasoningSummaryPart(item: ResponseReasoningItem, part: ResponseReasoningItem["summary"][number] | undefined): void;
 /**
  * Response-global accumulator for the sequential-cutoff summary contract.
  *

package/dist/types/registry/oauth/perplexity.d.ts

@@ -1,9 +1,3 @@
 import type { OAuthController, OAuthCredentials } from "./types.js";
-/**
- * Login to Perplexity.
- *
- * Tries auto-extraction from the desktop app, then runs HTTP email OTP login.
- *
- * No browser/manual token paste fallback is used.
- */
+/** Prefer legacy app borrowing, then offer browser SSO when the host supports it. */
 export declare function loginPerplexity(ctrl: OAuthController): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/types.d.ts

@@ -63,12 +63,20 @@ export interface OAuthProviderInfo {
      */
     storeCredentialsAs?: string;
 }
+/** Sign-in URL and accepted cookies for an isolated, host-owned browser. */
+export type OAuthBrowserSessionRequest = {
+    url: string;
+    /** Cookie names in preference order; return the first non-empty matching value. */
+    cookieNames: readonly string[];
+};
 export interface OAuthController {
     onAuth?(info: OAuthAuthInfo): void;
     onProgress?(message: string): void;
     /** Request pasted callback input; stop any visible prompt when `signal` aborts. */
     onManualCodeInput?(signal?: AbortSignal): Promise<string>;
     onPrompt?(prompt: OAuthPrompt): Promise<string>;
+    /** Complete browser login and return one matching cookie value privately. Reject on cancellation or failure. */
+    onBrowserSession?(request: OAuthBrowserSessionRequest, signal?: AbortSignal): Promise<string>;
     signal?: AbortSignal;
     fetch?: FetchImpl;
 }

package/dist/types/stream.d.ts

@@ -17,6 +17,8 @@ export declare const __providerInFlightForTesting: {
     setHeartbeatWriter(writer: ((writeProviderInFlightInfo: () => Promise<void>) => Promise<void>) | undefined): void;
     setLeaseRemover(remover: ((leasePath: string) => Promise<void>) | undefined): void;
     setWaitObserver(observer: ((provider: string) => void) | undefined): void;
+    setLockCreatedObserver(observer: ((lockDir: string) => Promise<void>) | undefined): void;
+    setLockIdentifiedObserver(observer: ((lockDir: string) => Promise<void>) | undefined): void;
     providerDir(provider: string): string;
     lockDir(provider: string): string;
     captureStaleLockRelease(provider: string): Promise<(() => Promise<void>) | null>;

package/dist/types/types.d.ts

@@ -853,6 +853,8 @@ export interface AssistantMessage {
     errorMessage?: string;
     /** Stable recovery-classification text when errorMessage includes display-only diagnostics. */
     errorClassificationMessage?: string;
+    /** True only when an exact request-body-read timeout failed on a full Responses replay, not a previous-response delta. */
+    requestBodyReadTimeoutFullReplay?: boolean;
     /** Per-tool abort messages used when an aborted assistant turn needs different placeholder results per tool call. */
     toolCallAbortMessages?: Record<string, string>;
     /** HTTP status surfaced by the provider when the request failed. Populated by every provider's catch block alongside `errorMessage` so consumers (auth retry, telemetry, UI) can branch without regex-scraping the message. */
@@ -973,7 +975,7 @@ export interface CursorTodoSnapshot {
  * provider persists this value verbatim. When no handler is registered at all,
  * the provider falls back to its own summary-only result.
  */
-export type CursorTodoSyncHandler = (snapshot: CursorTodoSnapshot | null, toolCallId: string, error: string | null) => ToolResultMessage;
+export type CursorTodoSyncHandler = (snapshot: CursorTodoSnapshot | null, toolCallId: string, error: string | null, origin?: "read" | "update") => ToolResultMessage;
 export interface CursorShellStreamCallbacks {
     onStdout(data: string): void;
     onStderr(data: string): void;