@oh-my-pi/pi-ai 18.2.0 → 18.2.2

package/dist/types/usage/openai-codex.d.ts

@@ -5,6 +5,8 @@ import type { CredentialRankingStrategy, UsageProvider, UsageReport } from "../u
  * ingesting them lets credential selection block an exhausted account before
  * the next request burns a wire 429.
  */
-export declare function parseCodexRateLimitHeaders(headers: Record<string, string>, now?: number): UsageReport | null;
+export declare function parseCodexRateLimitHeaders(headers: Record<string, string>, now?: number, context?: {
+    responseStatus?: number;
+}): UsageReport | null;
 export declare const openaiCodexUsageProvider: UsageProvider;
 export declare const codexRankingStrategy: CredentialRankingStrategy;

package/dist/types/usage.d.ts

@@ -43,6 +43,8 @@ export interface UsageScope {
     tier?: string;
     windowId?: string;
     shared?: boolean;
+    /** Stable identity shared by routing-specific copies of one upstream quota. */
+    sharedGroup?: string;
 }
 /** Normalized limit entry for a single window or quota bucket. */
 export interface UsageLimit {
@@ -241,6 +243,7 @@ export declare const usageScopeSchema: import("@oh-my-pi/omptype").FluentType<{
     projectId?: string | undefined;
     provider: string;
     shared?: boolean | undefined;
+    sharedGroup?: string | undefined;
     tier?: string | undefined;
     windowId?: string | undefined;
 }, {
@@ -250,6 +253,7 @@ export declare const usageScopeSchema: import("@oh-my-pi/omptype").FluentType<{
     projectId?: string | undefined;
     provider: string;
     shared?: boolean | undefined;
+    sharedGroup?: string | undefined;
     tier?: string | undefined;
     windowId?: string | undefined;
 }>;
@@ -272,6 +276,7 @@ export declare const usageLimitSchema: import("@oh-my-pi/omptype").FluentType<{
         projectId?: string | undefined;
         provider: string;
         shared?: boolean | undefined;
+        sharedGroup?: string | undefined;
         tier?: string | undefined;
         windowId?: string | undefined;
     };
@@ -302,6 +307,7 @@ export declare const usageLimitSchema: import("@oh-my-pi/omptype").FluentType<{
         projectId?: string | undefined;
         provider: string;
         shared?: boolean | undefined;
+        sharedGroup?: string | undefined;
         tier?: string | undefined;
         windowId?: string | undefined;
     };
@@ -359,6 +365,7 @@ export declare const usageReportSchema: import("@oh-my-pi/omptype").FluentType<{
             projectId?: string | undefined;
             provider: string;
             shared?: boolean | undefined;
+            sharedGroup?: string | undefined;
             tier?: string | undefined;
             windowId?: string | undefined;
         };
@@ -404,6 +411,7 @@ export declare const usageReportSchema: import("@oh-my-pi/omptype").FluentType<{
             projectId?: string | undefined;
             provider: string;
             shared?: boolean | undefined;
+            sharedGroup?: string | undefined;
             tier?: string | undefined;
             windowId?: string | undefined;
         };
@@ -472,7 +480,9 @@ export interface UsageProvider {
     id: Provider;
     fetchUsage(params: UsageFetchParams, ctx: UsageFetchContext): Promise<UsageReport | null>;
     /** Parse provider rate-limit response headers (lowercased keys) into a usage report, if supported. */
-    parseRateLimitHeaders?(headers: Record<string, string>, now?: number): UsageReport | null;
+    parseRateLimitHeaders?(headers: Record<string, string>, now?: number, context?: {
+        responseStatus?: number;
+    }): UsageReport | null;
     supports?(params: UsageFetchParams): boolean;
     /** True when fetchUsage contacts upstream and can authenticate the credential for health checks. */
     validatesCredentials?: boolean;

package/dist/types/utils/block-symbols.d.ts

@@ -113,3 +113,39 @@ export type SyntheticUserCarrier = object & {
 };
 /** True for `user` messages synthesized by message transformation. */
 export declare function isSyntheticUser(message: SyntheticUserCarrier | null | undefined): boolean;
+/**
+ * Marks a message synthesized by a per-call context transform rather than
+ * loaded from persisted conversation history.
+ *
+ * Prompt-cache boundaries must skip these messages: their content is rebuilt
+ * for each request and cannot anchor a prefix reused by the next turn.
+ * Symbol-keyed so the marker never persists or reaches the provider wire.
+ */
+export declare const kPerCallContextMessage: unique symbol;
+/** Carries per-call context provenance without exposing a string-keyed property. */
+export type PerCallContextMessageCarrier = object & {
+    [kPerCallContextMessage]?: true;
+};
+/** Marks a message as synthesized for the current provider call. */
+export declare function markPerCallContextMessage(message: PerCallContextMessageCarrier): void;
+/** Copies per-call context provenance to a converted or projected message. */
+export declare function copyPerCallContextMessage(target: PerCallContextMessageCarrier, source: PerCallContextMessageCarrier): void;
+/** True when a message was synthesized for the current provider call. */
+export declare function isPerCallContextMessage(message: PerCallContextMessageCarrier | null | undefined): boolean;
+/**
+ * Original history position carried by a context message clone.
+ *
+ * Object-spread transforms retain this symbol, allowing the extension runner
+ * to distinguish byte-identical historical copies from inserted messages.
+ */
+export declare const kContextHistoryIndex: unique symbol;
+/** Carries a context message's original history position. */
+export type ContextHistoryIndexCarrier = object & {
+    [kContextHistoryIndex]?: number;
+};
+/** Reads a context message's original history position. */
+export declare function getContextHistoryIndex(message: ContextHistoryIndexCarrier | null | undefined): number | undefined;
+/** Records a context message's original history position. */
+export declare function setContextHistoryIndex(message: ContextHistoryIndexCarrier, index: number): void;
+/** Removes context-history tracking before provider conversion. */
+export declare function clearContextHistoryIndex(message: ContextHistoryIndexCarrier): void;

package/dist/types/utils/openai-http.d.ts

@@ -26,6 +26,8 @@ export interface OpenAIStreamRequestInit {
     body: unknown;
     signal: AbortSignal;
     fetch?: FetchImpl;
+    /** Optional caller-specific gate composed with shared transport retry exclusions. */
+    shouldRetryResponse?: (response: Response, bodyText: string) => boolean | Promise<boolean>;
     /** Raw wire-frame observer (`onSseEvent` debug pipeline). */
     onSseEvent?: SseEventObserver;
 }

package/dist/types/utils/retry-after.d.ts

@@ -1,4 +1,6 @@
 export type HeadersLike = Headers | Record<string, string | undefined> | undefined | null;
+/** Extracts retry timing using the provider's catalog-declared timestamp timezone. */
+export declare function extractProviderRetryHint(provider: string | undefined, message: string | undefined): number | undefined;
 export declare function formatErrorMessageWithRetryAfter(error: unknown, headers?: HeadersLike): string;
 export declare function getRetryAfterMsFromHeaders(headers: HeadersLike): number | undefined;
 export declare function getHeadersFromError(error: unknown): HeadersLike;

package/dist/types/utils/schema/wire.d.ts

@@ -41,10 +41,9 @@ export declare function arkToWireSchema(schema: Type): Record<string, unknown>;
 export declare function toolWireSchema(tool: Tool): Record<string, unknown>;
 /**
  * Return a deep clone of `schema` with every `description` annotation removed.
- * The result is memoized on the input via a non-enumerable symbol (`stamp`) so
- * repeated provider requests reuse the same stripped object; the input is never
- * mutated, so the stamped `toolWireSchema` cache stays intact for
- * system-prompt/UI rendering.
+ * The result is memoized against the input (`stamp`) so repeated provider
+ * requests reuse the same stripped object; the input is never mutated, so the
+ * memoized `toolWireSchema` result stays intact for system-prompt/UI rendering.
  */
 export declare function stripSchemaDescriptions(schema: Record<string, unknown>): Record<string, unknown>;
 /**
@@ -53,6 +52,6 @@ export declare function stripSchemaDescriptions(schema: Record<string, unknown>)
  * Used when the full tool catalog is rendered into the system prompt instead, so
  * the descriptions ride the wire once (in the prompt) rather than duplicated on
  * every tool definition. Parameters are resolved to wire JSON Schema and cloned,
- * leaving the original tool objects and the stamped schema cache untouched.
+ * leaving the original tool objects and the memoized schema cache untouched.
  */
 export declare function stripToolDescriptions(tools: readonly Tool[]): Tool[];

package/dist/types/utils.d.ts

@@ -48,6 +48,15 @@ export declare function stripUnpairedOpenAIResponsesComputerReasoningIdsForRepla
  * Returns `undefined` for hidden-empty turns that only contain reasoning and an
  * empty assistant message, allowing callers to rebuild visible transcript
  * history instead of replaying stale native state.
+ *
+ * When the turn does carry replayable output, whitespace-only assistant
+ * messages are dropped rather than replayed. gpt-5.6 Codex ends a turn whose
+ * text all landed in the `commentary` phase with an empty `final_answer`
+ * message; replaying that item verbatim seeds the next turn with an empty slot
+ * the model then fills - `""` → `"\n\n"` → stray words → non-Latin residue -
+ * and each contaminated item is replayed in turn, so the drift compounds until
+ * the visible answer collapses. Codex CLI replays the empty item too
+ * (openai/codex#32389); this is the layer where omp can refuse to.
  */
 export declare function sanitizeOpenAIResponsesAssistantHistoryItemsForReplay(items: Array<Record<string, unknown>>, options?: OpenAIResponsesReplaySanitizeOptions): ResponseInput | undefined;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.2.0",
+	"version": "18.2.2",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -124,11 +124,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.2.0",
-		"@oh-my-pi/pi-catalog": "18.2.0",
-		"@oh-my-pi/pi-natives": "18.2.0",
-		"@oh-my-pi/pi-utils": "18.2.0",
-		"@oh-my-pi/pi-wire": "18.2.0"
+		"@oh-my-pi/omptype": "18.2.2",
+		"@oh-my-pi/pi-catalog": "18.2.2",
+		"@oh-my-pi/pi-natives": "18.2.2",
+		"@oh-my-pi/pi-utils": "18.2.2",
+		"@oh-my-pi/pi-wire": "18.2.2"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/auth/sqlite-credential-store.ts

@@ -4,7 +4,7 @@
  * The public AuthCredentialStore interface remains in ../auth-storage so local
  * and remote stores share the same contract.
  */
-import { Database, type Statement } from "bun:sqlite";
+import type { Database, Statement } from "bun:sqlite";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { parseAlibabaTokenPlanCredential } from "@oh-my-pi/pi-catalog/wire/alibaba-token-plan";
@@ -15,6 +15,7 @@ import {
 	isSqliteBusyError,
 	isSqliteCorruptionError,
 	logger,
+	openSqliteDatabase,
 } from "@oh-my-pi/pi-utils";
 import type {
 	AuthCredential,
@@ -25,7 +26,6 @@ import type {
 	StoredAuthCredential,
 	StoredCredentialBlock,
 } from "../auth-storage";
-import * as AIError from "../error";
 import type { OAuthCredentials } from "../registry/oauth/types";
 import type { Provider } from "../types";
 import type {
@@ -509,6 +509,7 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		);
 	}
 
+	/** Opens credential storage with bounded busy retries and one-shot corruption recovery. */
 	static async open(dbPath: string = getAgentDbPath()): Promise<SqliteAuthCredentialStore> {
 		const dir = path.dirname(dbPath);
 		const dirExists = await fs
@@ -519,23 +520,9 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 			await fs.mkdir(dir, { recursive: true, mode: 0o700 });
 		}
 
-		// Concurrent omp startups can race against WAL recovery and the schema
-		// init's first lock-taking statement. Bun's default `busy_timeout` is 0,
-		// so retry the open on `SQLITE_BUSY` / `SQLITE_BUSY_RECOVERY` with bounded
-		// exponential backoff before surfacing the failure. See issue #2421.
-		const maxAttempts = 4;
-		const baseDelayMs = 100;
-		let lastBusyError: Error | undefined;
-		for (let attempt = 0; attempt < maxAttempts; attempt++) {
-			let db: Database | undefined;
-			try {
-				db = new Database(dbPath);
-				// Install the busy handler BEFORE the first lock-taking statement
-				// on this connection. The leases DDL below and the constructor's
-				// schema init both acquire locks during WAL recovery; without a
-				// non-zero `busy_timeout` they fail immediately with SQLITE_BUSY.
-				// See issue #2421.
-				SqliteAuthCredentialStore.#installBusyTimeout(db);
+		return openSqliteDatabase(
+			dbPath,
+			async db => {
 				try {
 					await fs.chmod(dbPath, 0o600);
 				} catch {
@@ -543,20 +530,8 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 				}
 				SqliteAuthCredentialStore.#ensureAuthCredentialRefreshLeasesTable(db);
 				return new SqliteAuthCredentialStore(db);
-			} catch (err) {
-				db?.close();
-				if (!isSqliteBusyError(err)) {
-					throw err;
-				}
-				lastBusyError = err instanceof Error ? err : new Error(String(err));
-				if (attempt < maxAttempts - 1) {
-					await Bun.sleep(baseDelayMs * 2 ** attempt);
-				}
-			}
-		}
-		throw new AIError.ConfigurationError(
-			`Failed to open auth database at '${dbPath}' after ${maxAttempts} attempts: ${lastBusyError?.message}`,
-			{ cause: lastBusyError },
+			},
+			{ recoverCorruption: true },
 		);
 	}
 

package/src/auth-broker/remote-store.ts

@@ -255,6 +255,18 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 	#snapshot: SnapshotResponse = emptySnapshot();
 	#snapshotReceivedAt = Date.now();
 	#generation = 0;
+	/**
+	 * Content fingerprint of the credential set in {@link #snapshot} (id +
+	 * provider + credential material), recomputed after every snapshot mutation.
+	 * Drives {@link #credentialRevision} independently of the broker's numeric
+	 * generation, which is an in-memory counter that resets when the broker
+	 * process restarts and so cannot be trusted for change detection.
+	 */
+	#credentialFingerprint = "";
+	/** Monotonic local counter bumped whenever {@link #credentialFingerprint} changes. */
+	#credentialRevision = 0;
+	/** Revision last reported as "seen" by {@link pollExternalChanges}; seeded from the initial snapshot. */
+	#acknowledgedRevision = 0;
 	#usageOverlays: Map<string, UsageReport> = new Map();
 	#backgroundAbort = new AbortController();
 	readonly #backgroundIdleMs: number;
@@ -300,6 +312,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 			? new Map([...opts.accountPool].map(([provider, identities]) => [provider, new Set(identities)]))
 			: undefined;
 		this.#applySnapshot(opts.initialSnapshot ?? emptySnapshot(), opts.initialSnapshot?.generation ?? 0);
+		this.#acknowledgedRevision = this.#credentialRevision;
 		this.#onSnapshot = opts.onSnapshot;
 		void this.#runBackground();
 	}
@@ -325,6 +338,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		this.#snapshot = { ...snapshot, credentials };
 		this.#generation = generation;
 		this.#snapshotReceivedAt = nowMs;
+		this.#refreshCredentialRevision();
 		const onSnapshot = this.#onSnapshot;
 		if (!onSnapshot) return;
 		try {
@@ -333,6 +347,34 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 			logger.debug("auth-broker snapshot callback failed", { error: String(error) });
 		}
 	}
+
+	/**
+	 * Recompute the credential-content fingerprint and bump
+	 * {@link #credentialRevision} when it changes. Called after every snapshot
+	 * mutation so {@link pollExternalChanges} detects add/remove/replace even
+	 * when the broker's numeric generation repeats (e.g. after a broker
+	 * restart resets its in-memory counter).
+	 */
+	#refreshCredentialRevision(): void {
+		const fingerprint = this.#computeCredentialFingerprint();
+		if (fingerprint === this.#credentialFingerprint) return;
+		this.#credentialFingerprint = fingerprint;
+		this.#credentialRevision += 1;
+	}
+
+	/**
+	 * Order-independent digest of the routable credential material — exactly the
+	 * fields {@link listAuthCredentials} exposes (id, provider, credential). A
+	 * token rotation or an add/remove changes it; credential blocks and usage
+	 * overlays do not.
+	 */
+	#computeCredentialFingerprint(): string {
+		const parts = this.#snapshot.credentials.map(
+			entry => `${entry.id}\u0000${entry.provider}\u0000${JSON.stringify(entry.credential)}`,
+		);
+		parts.sort();
+		return parts.join("\u0001");
+	}
 	#protectNewSnapshotBlocks(previous: readonly SnapshotEntry[], next: readonly SnapshotEntry[], nowMs: number): void {
 		const previousBlocksByKey = new Map<string, string>();
 		for (const entry of previous) {
@@ -499,15 +541,13 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 	#applyStreamEvent(event: SnapshotStreamEvent): void {
 		switch (event.kind) {
 			case "snapshot": {
-				// Strip the discriminator so we store the wire-shape SnapshotResponse.
+				// The first frame of every SSE connection is a full authoritative
+				// snapshot. Always adopt it as the new generation baseline: the
+				// broker's in-memory generation counter resets on restart and may
+				// therefore be lower than the previous stream's last value.
+				// Subsequent entry/removal frames remain guarded against reordering
+				// relative to this new baseline below.
 				const { kind: _kind, ...snapshot } = event;
-				if (snapshot.generation < this.#generation) {
-					logger.debug("auth-broker stream snapshot older than local; ignoring", {
-						local: this.#generation,
-						incoming: snapshot.generation,
-					});
-					return;
-				}
 				this.#applySnapshot(snapshot, snapshot.generation);
 				return;
 			}
@@ -548,6 +588,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		this.#snapshot = { ...this.#snapshot, generation, serverNowMs, refresher, credentials };
 		this.#generation = generation;
 		this.#snapshotReceivedAt = Date.now();
+		this.#refreshCredentialRevision();
 	}
 
 	#removeStreamCredential(
@@ -564,6 +605,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		this.#snapshot = { ...this.#snapshot, generation, serverNowMs, refresher, credentials };
 		this.#generation = generation;
 		this.#snapshotReceivedAt = Date.now();
+		this.#refreshCredentialRevision();
 	}
 
 	/** Re-hydrate the in-memory snapshot from the broker. */
@@ -574,6 +616,29 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		return this.#snapshot;
 	}
 
+	/**
+	 * Stateful probe for broker-side credential changes, mirroring
+	 * {@link SqliteAuthCredentialStore.pollExternalChanges} so long-lived broker
+	 * clients (notably `auth-gateway serve`) pick up logins/logouts made by
+	 * another process without a restart.
+	 *
+	 * Compares a local content revision, not the broker's numeric generation:
+	 * generation is an in-memory counter that resets when the broker process
+	 * restarts, so a reconnecting stream can deliver a different credential set
+	 * under a repeated (or lower) generation. {@link #refreshCredentialRevision}
+	 * bumps the revision whenever the applied credential material actually
+	 * changes, catching those cases too. Records foreground activity first: a
+	 * low-traffic client's background sync parks after `#backgroundIdleMs`, and
+	 * without this wakeup it would never fetch the new snapshot to report in the
+	 * first place.
+	 */
+	pollExternalChanges(): boolean {
+		this.#noteActivity();
+		if (this.#credentialRevision === this.#acknowledgedRevision) return false;
+		this.#acknowledgedRevision = this.#credentialRevision;
+		return true;
+	}
+
 	listAuthCredentials(provider?: string): StoredAuthCredential[] {
 		this.#noteActivity();
 		const out: StoredAuthCredential[] = [];

package/src/auth-broker/wire-schemas.ts

@@ -220,6 +220,7 @@ const usageScopeSchema = type({
 	"tier?": "string",
 	"windowId?": "string",
 	"shared?": "boolean",
+	"sharedGroup?": "string",
 });
 
 const usageLimitSchema = type({

package/src/auth-gateway/index.ts

@@ -1,3 +1,4 @@
 export * from "./http";
+export * from "./session-state";
 export * from "./server";
 export * from "./types";