@oh-my-pi/pi-ai 18.2.4 → 18.2.5

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [18.2.5] - 2026-09-17
+
+### Added
+
+- Added support for templating and custom base and authentication URLs in OAuth flows.
+
+### Fixed
+
+- Fixed Anthropic prompt-cache breakpoints stalling when conversations include mid-conversation tool changes, preventing growing message tails from being unnecessarily re-billed as uncached input.
+
 ## [18.2.4] - 2026-09-17
 
 ### Added

package/dist/types/registry/engine/common.d.ts

@@ -48,7 +48,7 @@ export declare function postTokenRequest(request: CompiledOAuthRequest, standard
     response: Response;
 }>;
 /** Bearer GET declared by `userinfo`; failures leave identity fields unset. */
-export declare function applyUserinfo(userinfo: CompiledUserinfo | undefined, credentials: OAuthCredentials, context: RequestContext): Promise<OAuthCredentials>;
+export declare function applyUserinfo(userinfo: CompiledUserinfo | undefined, credentials: OAuthCredentials, context: RequestContext, vars?: TemplateVars): Promise<OAuthCredentials>;
 /** Runs the rule's after-exchange / after-refresh hook, if declared. */
 export declare function applyAfterExchange(hook: string | undefined, credentials: OAuthCredentials, context: ExchangeContext): Promise<OAuthCredentials>;
 export declare function describeError(error: unknown): string;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.2.4",
+	"version": "18.2.5",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -128,11 +128,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.2.4",
-		"@oh-my-pi/pi-catalog": "18.2.4",
-		"@oh-my-pi/pi-natives": "18.2.4",
-		"@oh-my-pi/pi-utils": "18.2.4",
-		"@oh-my-pi/pi-wire": "18.2.4"
+		"@oh-my-pi/omptype": "18.2.5",
+		"@oh-my-pi/pi-catalog": "18.2.5",
+		"@oh-my-pi/pi-natives": "18.2.5",
+		"@oh-my-pi/pi-utils": "18.2.5",
+		"@oh-my-pi/pi-wire": "18.2.5"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/providers/anthropic.ts

@@ -1563,7 +1563,9 @@ async function* iterateAnthropicEvents(
 	let sawMessageStart = false;
 	let sawMessageEnd = false;
 
-	for await (const sse of readSseEvents(response.body, signal)) {
+	// Capture `raw` only when the diagnostic observer exists; otherwise the
+	// per-frame wire-line array is pure token-path garbage.
+	for await (const sse of readSseEvents(response.body, signal, onSseEvent ? { captureRaw: true } : undefined)) {
 		notifyRawSseEvent(onSseEvent, sse);
 		if (sse.event === "error") {
 			throw createAnthropicSseStreamError(sse.data);
@@ -3978,11 +3980,26 @@ function applyPromptCaching(params: MessageCreateParamsStreaming, cacheControl?:
 	// Stable historical decimation checkpoint every 15 user turns (15th, 30th, 45th...)
 	const decimationIndices = userIndices.filter((_, ordinal) => (ordinal + 1) % ANTHROPIC_DECIMATION_INTERVAL === 0);
 
-	// Collect up to 2 trailing candidates from the reusable prefix.
+	// Collect up to 2 trailing candidates from the reusable prefix, skipping
+	// mid-conversation tool-control messages. They contain only tool_addition /
+	// tool_removal blocks, so cache_control is always rejected there; parking
+	// the rolling window on one spends the tail breakpoint on a decoration
+	// that always fails, and with decimation checkpoints present the remaining
+	// breakpoints land on already-cached history while the growing tail is
+	// re-billed as uncached input every turn.
 	const trailingCandidates: number[] = [];
 	for (let index = stableMessageEnd; index >= 0 && trailingCandidates.length < 2; index--) {
 		const message = params.messages[index];
 		if (!message) continue;
+		if (
+			message.role === "system" &&
+			typeof message.content !== "string" &&
+			Array.isArray(message.content) &&
+			message.content.length > 0 &&
+			message.content.every(block => block.type === "tool_addition" || block.type === "tool_removal")
+		) {
+			continue;
+		}
 		trailingCandidates.push(index);
 	}
 

package/src/registry/engine/common.ts

@@ -267,10 +267,11 @@ export async function applyUserinfo(
 	userinfo: CompiledUserinfo | undefined,
 	credentials: OAuthCredentials,
 	context: RequestContext,
+	vars: TemplateVars = {},
 ): Promise<OAuthCredentials> {
 	if (!userinfo) return credentials;
 	try {
-		const response = await context.fetch(userinfo.url, {
+		const response = await context.fetch(template(userinfo.url, vars), {
 			headers: { ...context.headers, Authorization: `Bearer ${credentials.access}` },
 			signal: context.signal,
 		});

package/src/registry/engine/oauth-code.ts

@@ -93,6 +93,8 @@ export class DeclarativeOAuthCodeFlow extends OAuthCallbackFlow {
 	#verifier = "";
 	#clientId?: string;
 	#clientSecret?: string;
+	#base?: string;
+	#auth?: string;
 
 	constructor(
 		ctrl: OAuthController,
@@ -123,6 +125,8 @@ export class DeclarativeOAuthCodeFlow extends OAuthCallbackFlow {
 		const signal = this.ctrl.signal;
 		this.#clientId = rule.clientId ? await resolveValue(rule.clientId, signal) : undefined;
 		this.#clientSecret = rule.clientSecret ? await resolveValue(rule.clientSecret, signal) : undefined;
+		this.#base = rule.baseUrl ? (await resolveValue(rule.baseUrl, signal)).replace(/\/+$/, "") : undefined;
+		this.#auth = rule.authUrl ? (await resolveValue(rule.authUrl, signal)).replace(/\/+$/, "") : undefined;
 		let challenge: string | undefined;
 		if (rule.pkce) {
 			const pkce = await generatePKCE();
@@ -136,6 +140,8 @@ export class DeclarativeOAuthCodeFlow extends OAuthCallbackFlow {
 			scope,
 			state,
 			code_challenge: challenge,
+			base: this.#base,
+			auth: this.#auth,
 		};
 		const params = new URLSearchParams();
 		if (rule.standardAuthorizeParams) {
@@ -150,7 +156,7 @@ export class DeclarativeOAuthCodeFlow extends OAuthCallbackFlow {
 			if (state) params.set("state", state);
 		}
 		for (const key in rule.authorizeParams) params.set(key, template(rule.authorizeParams[key], vars));
-		const authorizeUrl = await resolveValue(rule.authorizeUrl, signal);
+		const authorizeUrl = template(await resolveValue(rule.authorizeUrl, signal), vars);
 		return { url: `${authorizeUrl}?${params.toString()}`, instructions: rule.instructions };
 	}
 
@@ -185,6 +191,8 @@ export class DeclarativeOAuthCodeFlow extends OAuthCallbackFlow {
 			code_verifier: rule.pkce ? this.#verifier : undefined,
 			client_id: this.#clientId,
 			client_secret: this.#clientSecret,
+			base: this.#base,
+			auth: this.#auth,
 		};
 		const context = { provider: this.#provider, fetch: this.#fetch, signal };
 		const { body } = await postTokenRequest(
@@ -203,7 +211,7 @@ export class DeclarativeOAuthCodeFlow extends OAuthCallbackFlow {
 		);
 		throwIfCancelled(signal);
 		let credentials = mapCredentials(rule.credential, body, this.#provider);
-		credentials = await applyUserinfo(rule.userinfo, credentials, context);
+		credentials = await applyUserinfo(rule.userinfo, credentials, context, vars);
 		throwIfCancelled(signal);
 		return applyAfterExchange(rule.afterExchange, credentials, {
 			provider: this.#provider,

package/src/registry/engine/refresh.ts

@@ -31,7 +31,8 @@ async function loginClient(policy: CompiledAuthProvider, signal?: AbortSignal) {
 			redirectUri: login.callback.redirectUri
 				? await resolveValue(login.callback.redirectUri, signal)
 				: `http://${login.callback.hostname}:${login.callback.port}${login.callback.path}`,
-			base: undefined,
+			base: login.baseUrl ? (await resolveValue(login.baseUrl, signal)).replace(/\/+$/, "") : undefined,
+			auth: login.authUrl ? (await resolveValue(login.authUrl, signal)).replace(/\/+$/, "") : undefined,
 		};
 	}
 	if (login?.kind === "device-code") {
@@ -40,9 +41,10 @@ async function loginClient(policy: CompiledAuthProvider, signal?: AbortSignal) {
 			clientSecret: undefined,
 			redirectUri: undefined,
 			base: login.baseUrl ? await resolveValue(login.baseUrl, signal) : undefined,
+			auth: undefined,
 		};
 	}
-	return { clientId: undefined, clientSecret: undefined, redirectUri: undefined, base: undefined };
+	return { clientId: undefined, clientSecret: undefined, redirectUri: undefined, base: undefined, auth: undefined };
 }
 
 function createRequestRefresh(rule: RequestRefresh, policy: CompiledAuthProvider): Refresher {
@@ -66,6 +68,7 @@ function createRequestRefresh(rule: RequestRefresh, policy: CompiledAuthProvider
 			client_secret: client.clientSecret,
 			redirect_uri: client.redirectUri,
 			base: client.base,
+			auth: client.auth,
 			claude_code_sdk_version: claudeCodeSdkVersion,
 		};
 		const { body } = await postTokenRequest(