@oh-my-pi/pi-ai 18.2.2 → 18.2.3

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [18.2.3] - 2026-09-17
+
+### Added
+
+- `stream()` and `streamSimple()` support asynchronous model header resolution for each request attempt, including authentication retries and cancellation.
+- Provider login prompts can request masked entry with `secret: true`.
+
 ## [18.2.2] - 2026-09-16
 
 ### Added

package/dist/types/auth-storage.d.ts

@@ -1,5 +1,5 @@
 import type { ApiKeyResolver } from "./auth-retry.js";
-import type { OAuthAuthInfo, OAuthController, OAuthCredentials, OAuthProviderId } from "./registry/oauth/types.js";
+import type { OAuthAuthInfo, OAuthController, OAuthCredentials, OAuthPrompt, OAuthProviderId } from "./registry/oauth/types.js";
 import type { Provider } from "./types.js";
 import type { ClientUsageIdentity, ClientUsageReport, ClientUsageSummary, CredentialRankingStrategy, ObservedUsageEntry, UsageHistoryEntry, UsageHistoryQuery, UsageLogger, UsageProvider, UsageReport } from "./usage.js";
 import { type CodexResetConsumeCode, type CodexResetCredit } from "./usage/openai-codex-reset.js";
@@ -800,7 +800,7 @@ export declare class AuthStorage {
      * Lower priority than {@link setRuntimeApiKey} so a CLI `--api-key`
      * still wins for the duration of a single invocation.
      */
-    setConfigApiKey(provider: string, apiKey: string): void;
+    setConfigApiKey(provider: string, apiKeyConfig: string): void;
     /**
      * Remove a single config-sourced API key override.
      */
@@ -815,6 +815,13 @@ export declare class AuthStorage {
      * Used for custom provider keys from models.json.
      */
     setFallbackResolver(resolver: (provider: string) => string | undefined): void;
+    /**
+     * Install the host's async config-value resolver. Coding-agent uses this so
+     * every stored/config credential reference shares command caching,
+     * failure backoff, and process hardening even when AuthStorage was created
+     * independently and later attached to a registry.
+     */
+    setConfigValueResolver(resolver: (config: string) => Promise<string | undefined>): void;
     /**
      * Reload credentials from storage.
      */
@@ -935,10 +942,7 @@ export declare class AuthStorage {
         /** onAuth is required by auth-storage but optional in OAuthController */
         onAuth: (info: OAuthAuthInfo) => void;
         /** onPrompt is required for some providers (github-copilot, openai-codex) */
-        onPrompt: (prompt: {
-            message: string;
-            placeholder?: string;
-        }) => Promise<string>;
+        onPrompt: (prompt: OAuthPrompt) => Promise<string>;
     }): Promise<OAuthLoginIdentity | undefined>;
     /**
      * Logout from a provider.

package/dist/types/registry/oauth/github-copilot.d.ts

@@ -1,12 +1,8 @@
 import type { FetchImpl } from "../../types.js";
-import type { OAuthController, OAuthCredentials } from "./types.js";
+import type { OAuthController, OAuthCredentials, OAuthPrompt } from "./types.js";
 type GitHubCopilotLoginOptions = {
     onAuth: (url: string, instructions?: string) => void;
-    onPrompt: (prompt: {
-        message: string;
-        placeholder?: string;
-        allowEmpty?: boolean;
-    }) => Promise<string>;
+    onPrompt: (prompt: OAuthPrompt) => Promise<string>;
     onProgress?: (message: string) => void;
     copilotIntegrationId?: unknown;
     signal?: AbortSignal;

package/dist/types/registry/oauth/kimi.d.ts

@@ -1,7 +1,8 @@
 /**
  * Kimi Code OAuth flow (device authorization grant)
  */
-export declare let getKimiCommonHeaders: () => Readonly<{
+/** Lazily resolve the process-stable device headers used by Kimi requests. */
+export declare const getKimiCommonHeaders: () => Readonly<{
     "User-Agent": `KimiCLI/${string}`;
     "X-Msh-Platform": "kimi_cli";
     "X-Msh-Version": string;

package/dist/types/registry/oauth/types.d.ts

@@ -33,6 +33,8 @@ export type OAuthPrompt = {
     message: string;
     placeholder?: string;
     allowEmpty?: boolean;
+    /** Request masked entry from interactive hosts. Hosts that cannot hide input must reject the prompt. */
+    secret?: boolean;
 };
 export type OAuthAuthInfo = {
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.2.2",
+	"version": "18.2.3",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -124,11 +124,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.2.2",
-		"@oh-my-pi/pi-catalog": "18.2.2",
-		"@oh-my-pi/pi-natives": "18.2.2",
-		"@oh-my-pi/pi-utils": "18.2.2",
-		"@oh-my-pi/pi-wire": "18.2.2"
+		"@oh-my-pi/omptype": "18.2.3",
+		"@oh-my-pi/pi-catalog": "18.2.3",
+		"@oh-my-pi/pi-natives": "18.2.3",
+		"@oh-my-pi/pi-utils": "18.2.3",
+		"@oh-my-pi/pi-wire": "18.2.3"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/auth-storage.ts

@@ -26,6 +26,7 @@ import type {
 	OAuthAuthInfo,
 	OAuthController,
 	OAuthCredentials,
+	OAuthPrompt,
 	OAuthProvider,
 	OAuthProviderId,
 } from "./registry/oauth/types";
@@ -1635,8 +1636,8 @@ export class AuthStorage {
 	 * Lower priority than {@link setRuntimeApiKey} so a CLI `--api-key`
 	 * still wins for the duration of a single invocation.
 	 */
-	setConfigApiKey(provider: string, apiKey: string): void {
-		this.#configOverrides.set(provider, apiKey);
+	setConfigApiKey(provider: string, apiKeyConfig: string): void {
+		this.#configOverrides.set(provider, apiKeyConfig);
 	}
 
 	/**
@@ -1661,6 +1662,15 @@ export class AuthStorage {
 	setFallbackResolver(resolver: (provider: string) => string | undefined): void {
 		this.#fallbackResolver = resolver;
 	}
+	/**
+	 * Install the host's async config-value resolver. Coding-agent uses this so
+	 * every stored/config credential reference shares command caching,
+	 * failure backoff, and process hardening even when AuthStorage was created
+	 * independently and later attached to a registry.
+	 */
+	setConfigValueResolver(resolver: (config: string) => Promise<string | undefined>): void {
+		this.#configValueResolver = resolver;
+	}
 
 	/**
 	 * Reload credentials from storage.
@@ -3169,7 +3179,7 @@ export class AuthStorage {
 			/** onAuth is required by auth-storage but optional in OAuthController */
 			onAuth: (info: OAuthAuthInfo) => void;
 			/** onPrompt is required for some providers (github-copilot, openai-codex) */
-			onPrompt: (prompt: { message: string; placeholder?: string }) => Promise<string>;
+			onPrompt: (prompt: OAuthPrompt) => Promise<string>;
 		},
 	): Promise<OAuthLoginIdentity | undefined> {
 		// Only paste-code providers (fixed non-loopback redirect, e.g. GitLab Duo
@@ -5960,8 +5970,8 @@ export class AuthStorage {
 		}
 
 		const configKey = this.#configOverrides.get(provider);
-		if (configKey) {
-			return configKey;
+		if (configKey !== undefined) {
+			return await this.#configValueResolver(configKey);
 		}
 
 		await this.#adoptExternalCredentialChanges();
@@ -6028,8 +6038,8 @@ export class AuthStorage {
 		// honor it instead of forwarding an upstream OAuth token that the proxy
 		// won't accept.
 		const configKey = this.#configOverrides.get(provider);
-		if (configKey) {
-			return configKey;
+		if (configKey !== undefined) {
+			return await this.#configValueResolver(configKey);
 		}
 
 		// Precedence: a deliberate OAuth/login credential wins, then an explicit env var,

package/src/registry/oauth/github-copilot.ts

@@ -29,7 +29,7 @@ import {
 } from "../../providers/github-copilot-headers";
 import * as AIError from "../../error";
 import type { FetchImpl } from "../../types";
-import type { OAuthController, OAuthCredentials } from "./types";
+import type { OAuthController, OAuthCredentials, OAuthPrompt } from "./types";
 
 const OPENCODE_CLIENT_ID = "Ov23li8tweQw6odWQebz";
 const COPILOT_CLI_CLIENT_ID = "Ov23ctDVkRmgkPke0Mmm";
@@ -55,7 +55,7 @@ const SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;
 
 type GitHubCopilotLoginOptions = {
 	onAuth: (url: string, instructions?: string) => void;
-	onPrompt: (prompt: { message: string; placeholder?: string; allowEmpty?: boolean }) => Promise<string>;
+	onPrompt: (prompt: OAuthPrompt) => Promise<string>;
 	onProgress?: (message: string) => void;
 	copilotIntegrationId?: unknown;
 	signal?: AbortSignal;

package/src/registry/oauth/kimi.ts

@@ -6,7 +6,7 @@ import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { getAgentDir } from "@oh-my-pi/pi-utils";
+import { getAgentDir, once } from "@oh-my-pi/pi-utils";
 import packageJson from "../../../package.json" with { type: "json" };
 
 const DEVICE_ID_FILENAME = "kimi-device-id";
@@ -57,7 +57,8 @@ function sanitizeHeaderValue(value: string, fallback = ""): string {
 	return sanitized || fallback;
 }
 
-export let getKimiCommonHeaders = () => {
+/** Lazily resolve the process-stable device headers used by Kimi requests. */
+export const getKimiCommonHeaders = once(() => {
 	const headers = Object.freeze({
 		"User-Agent": `KimiCLI/${packageJson.version}`,
 		"X-Msh-Platform": "kimi_cli",
@@ -67,6 +68,5 @@ export let getKimiCommonHeaders = () => {
 		"X-Msh-Os-Version": sanitizeHeaderValue(os.version(), "unknown"),
 		"X-Msh-Device-Id": sanitizeHeaderValue(getDeviceId(), "unknown"),
 	});
-	getKimiCommonHeaders = () => headers;
 	return headers;
-};
+});

package/src/registry/oauth/types.ts

@@ -37,6 +37,8 @@ export type OAuthPrompt = {
 	message: string;
 	placeholder?: string;
 	allowEmpty?: boolean;
+	/** Request masked entry from interactive hosts. Hosts that cannot hide input must reject the prompt. */
+	secret?: boolean;
 };
 
 export type OAuthAuthInfo = {

package/src/stream.ts

@@ -15,7 +15,7 @@ import {
 } from "@oh-my-pi/pi-catalog/model-thinking";
 import { providerEntries } from "@oh-my-pi/pi-catalog/compat/providers";
 import { CODEX_BASE_URL } from "@oh-my-pi/pi-catalog/wire/codex";
-import { $env, $pickenv, getProviderInFlightRoot, isEnoent, logger } from "@oh-my-pi/pi-utils";
+import { $env, $pickenv, getProviderInFlightRoot, isEnoent, logger, untilAborted } from "@oh-my-pi/pi-utils";
 import { getCustomApi } from "./api-registry";
 import { createAuthRetryKeyState, isApiKeyResolver, resolveNextAuthRetryKey } from "./auth-retry";
 import * as AIError from "./error";
@@ -889,11 +889,40 @@ export function listProvidersWithEnvKey(): string[] {
 	return Object.keys(serviceProviderMap);
 }
 
+function withResolvedModelHeaders<TApi extends Api>(
+	model: Model<TApi>,
+	signal: AbortSignal | undefined,
+	run: (resolvedModel: Model<TApi>) => AssistantMessageEventStream,
+): AssistantMessageEventStream {
+	const resolveHeaders = model.resolveHeaders;
+	if (!resolveHeaders) return run(model);
+
+	const outer = new AssistantMessageEventStream();
+	void (async () => {
+		try {
+			const headers = await untilAborted(signal, () => resolveHeaders(signal));
+			signal?.throwIfAborted();
+			const inner = run({ ...model, resolveHeaders: undefined, headers: headers ? { ...headers } : undefined });
+			for await (const event of inner) {
+				outer.push(event);
+				if (outer.done) return;
+			}
+			if (!outer.done) outer.end(await inner.result());
+		} catch (error) {
+			outer.fail(error);
+		}
+	})();
+	return outer;
+}
+
 export function stream<TApi extends Api>(
 	model: Model<TApi>,
 	context: Context,
 	options?: OptionsForApi<TApi>,
 ): AssistantMessageEventStream {
+	if (model.resolveHeaders) {
+		return withResolvedModelHeaders(model, options?.signal, resolvedModel => stream(resolvedModel, context, options));
+	}
 	if (!model.requiresGlyphTokenization) {
 		return withThinkingLoopGuard(model, options, opts =>
 			withProviderInFlightLimit(model, opts, () => streamDispatch(model, context, opts)),
@@ -1623,6 +1652,12 @@ function streamSimpleRequest<TApi extends Api>(
 		return outer;
 	}
 
+	if (model.resolveHeaders) {
+		return withResolvedModelHeaders(model, requestOptions.signal, resolvedModel =>
+			streamSimpleRequest(resolvedModel, context, requestOptions),
+		);
+	}
+
 	// Pi-native transport short-circuits the per-provider dispatch entirely:
 	// the gateway resolves provider + credential server-side, so we don't
 	// need an `apiKey` from `getEnvApiKey` here — `options.apiKey` carries