@oh-my-pi/pi-ai 18.2.8 → 18.2.9

package/src/providers/amazon-bedrock.ts

@@ -71,6 +71,43 @@ const SIGNER_OWNED_HEADERS = new Set(["host", "x-amz-date", "x-amz-content-sha25
 // mismatch.
 const BEDROCK_RESERVED_HEADERS = new Set(["content-type", "accept", "authorization", "content-length"]);
 
+/**
+ * HTTP status for a ConverseStream in-stream failure, keyed by lowercased
+ * exception shape name. Exception and error frames ride inside an HTTP 200
+ * event stream, so the shape name in `:exception-type` / `:error-code` is the
+ * only evidence of what actually failed upstream. Values come from the
+ * bedrock-runtime service model (the same source the AWS SDKs deserialize
+ * against): without them every in-stream failure would be stamped 400, which
+ * the retry classifier reads as a deterministic client rejection and refuses
+ * to replay — making a transient `internalServerException` (500) terminal.
+ * Shapes absent from the map keep 400 so an unrecognized rejection is never
+ * retried by accident.
+ */
+const BEDROCK_STREAM_EXCEPTION_STATUS: Record<string, number> = {
+	accessdeniedexception: 403,
+	conflictexception: 400,
+	internalserverexception: 500,
+	modelerrorexception: 424,
+	modelnotreadyexception: 429,
+	modelstreamerrorexception: 424,
+	modeltimeoutexception: 408,
+	resourcenotfoundexception: 404,
+	servicequotaexceededexception: 400,
+	serviceunavailableexception: 503,
+	throttlingexception: 429,
+	validationexception: 400,
+};
+
+/**
+ * Resolve the service-model status for an in-stream exception/error code.
+ * Frame headers carry the bare shape name in either camelCase
+ * (`internalServerException`) or PascalCase (`InternalServerException`); both
+ * normalize to the same map key. Unknown shapes default to 400.
+ */
+export function bedrockStreamExceptionStatus(code: string): number {
+	return BEDROCK_STREAM_EXCEPTION_STATUS[code.trim().toLowerCase()] ?? 400;
+}
+
 export type BedrockThinkingDisplay = "summarized" | "omitted";
 
 /** Bedrock guardrail trace verbosity, mirrors the Converse `guardrailConfig.trace` values. */
@@ -260,7 +297,7 @@ interface WireMessage {
 }
 
 interface WireToolSpec {
-	toolSpec: { name: string; description: string; inputSchema: { json: unknown } };
+	toolSpec: { name: string; description?: string; inputSchema: { json: unknown } };
 }
 interface WireToolChoice {
 	auto?: Record<string, never>;
@@ -605,12 +642,16 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 					const payload = safeParsePayload(message.payload) as { message?: string } | undefined;
 					const errorMessage = payload?.message || new TextDecoder().decode(message.payload);
 					const text = `${exceptionType}: ${errorMessage}`;
-					throw new AIError.BedrockApiError(text, 400, { code: exceptionType });
+					throw new AIError.BedrockApiError(text, bedrockStreamExceptionStatus(exceptionType), {
+						code: exceptionType,
+					});
 				}
 				if (messageType === "error") {
 					const code = message.headers[":error-code"] || "UnknownError";
 					const errorMessage = message.headers[":error-message"] || new TextDecoder().decode(message.payload);
-					throw new AIError.BedrockApiError(`${code}: ${errorMessage}`, 400, { code });
+					throw new AIError.BedrockApiError(`${code}: ${errorMessage}`, bedrockStreamExceptionStatus(code), {
+						code,
+					});
 				}
 				if (messageType !== "event") continue;
 
@@ -947,10 +988,17 @@ function buildToolResultBlock(
 	hoistedImages: ImageBlockWire[],
 ): ToolResultBlockWire {
 	const content: Array<TextBlockWire | ImageBlockWire> = [];
+	// Bedrock's Anthropic Claude models reject an error toolResult that carries a
+	// non-text block ("all content must be type `text` if `is_error` is true"),
+	// so images inside an error result must always be hoisted out regardless of
+	// the model's requiresToolResultImageHoisting flag (no `class "anthropic"`
+	// rule sets it). Mirrors anthropic.ts buildToolResultBlock. Re-serializing a
+	// previously-persisted poisoned result on a later turn repairs it in place.
+	const hoistImages = message.isError || model.requiresToolResultImageHoisting;
 	for (const block of message.content) {
 		if (block.type === "image") {
 			const image: ImageBlockWire = { image: createImageBlock(block.mimeType, block.data) };
-			if (model.requiresToolResultImageHoisting) {
+			if (hoistImages) {
 				content.push({ text: "(see attached image)" });
 				hoistedImages.push(image);
 			} else {
@@ -1114,7 +1162,9 @@ function convertToolSpec(tool: Tool): WireToolSpec {
 	return {
 		toolSpec: {
 			name: tool.name,
-			description: tool.description || "",
+			// Descriptions may be pruned into the system prompt. Bedrock permits
+			// omission, but rejects an explicitly empty description (minLength: 1).
+			description: tool.description || undefined,
 			inputSchema: { json: toolWireSchema(tool) },
 		},
 	};

package/src/providers/anthropic.ts

@@ -110,9 +110,10 @@ import {
 	CLAUDE_CODE_MAX_OUTPUT_TOKENS,
 	claudeCodeSdkVersion,
 	claudeCodeSystemInstruction,
-	claudeCodeVersion,
+	adoptRequiredClaudeCodeVersion,
 	claudeToolPrefix,
-	claudeCodeUserAgent,
+	getClaudeCodeUserAgent,
+	getClaudeCodeVersion,
 } from "./claude-code-fingerprint";
 import {
 	buildCopilotDynamicHeaders,
@@ -376,7 +377,7 @@ export function buildAnthropicHeaders(options: AnthropicHeaderOptions): Record<s
 	}
 
 	if (oauthToken) {
-		const userAgent = isClaudeCodeClientUserAgent(incomingUserAgent) ? incomingUserAgent : claudeCodeUserAgent;
+		const userAgent = isClaudeCodeClientUserAgent(incomingUserAgent) ? incomingUserAgent : getClaudeCodeUserAgent();
 		const headers = {
 			...modelHeaders,
 			Accept: acceptHeader,
@@ -665,14 +666,11 @@ function createClaudeBillingHeader(firstUserMessageText: string): string {
 	// Matches CC's computeFingerprint in utils/fingerprint.ts.
 	// Uses chars from the first user message (not the system prompt).
 	const k = [4, 7, 20].map(i => firstUserMessageText[i] ?? "0").join("");
-	const versionSuffix = nodeCrypto
-		.createHash("sha256")
-		.update(`59cf53e54c78${k}${claudeCodeVersion}`)
-		.digest("hex")
-		.slice(0, 3);
+	const version = getClaudeCodeVersion();
+	const versionSuffix = nodeCrypto.createHash("sha256").update(`59cf53e54c78${k}${version}`).digest("hex").slice(0, 3);
 	// cch=00000: placeholder replaced with the real attestation hash by wrapFetchForCch
 	// before the request hits the wire (see below).
-	return `${CLAUDE_BILLING_HEADER_PREFIX} cc_version=${claudeCodeVersion}.${versionSuffix}; cc_entrypoint=cli; ${CCH_PLACEHOLDER_STR};`;
+	return `${CLAUDE_BILLING_HEADER_PREFIX} cc_version=${version}.${versionSuffix}; cc_entrypoint=cli; ${CCH_PLACEHOLDER_STR};`;
 }
 
 // cch attestation: XXHash64(body_with_placeholder, seed) low-20-bits, 5 hex chars.
@@ -2085,6 +2083,8 @@ const streamAnthropicOnce = (
 			const zeroOutputCacheRefresh = options?.anthropicCacheRefreshRequest === true;
 			let client: AnthropicMessagesClientLike;
 			let isOAuthToken: boolean;
+			// Retained so a Claude Code version bump can rebuild the client's fingerprint headers.
+			let clientArgs: AnthropicClientOptionsArgs | undefined;
 
 			if (options?.client) {
 				client = options.client;
@@ -2190,7 +2190,7 @@ const streamAnthropicOnce = (
 					}
 				}
 
-				const created = createClient(model, {
+				clientArgs = {
 					model,
 					apiKey,
 					extraBetas,
@@ -2211,7 +2211,8 @@ const streamAnthropicOnce = (
 						extractClaudeMetadataSessionId(options?.metadata?.user_id) ??
 						options?.promptCacheKey,
 					disableStrictTools,
-				});
+				};
+				const created = createClient(model, clientArgs);
 				client = created.client;
 				isOAuthToken = created.isOAuthToken;
 			}
@@ -2260,6 +2261,15 @@ const streamAnthropicOnce = (
 
 			if (zeroOutputCacheRefresh) {
 				const refreshParams: MessageCreateParams = { ...params, max_tokens: 0, stream: false };
+				// Anthropic rejects `tool_choice: {type:"tool"|"any"}` with `max_tokens: 0`
+				// ("tool_choice ... cannot be used when max_tokens is 0", #12597). A refresh
+				// replays the captured turn's payload, which can carry a forced selector
+				// (e.g. a forced yield). A zero-output keep-alive produces no tokens, so the
+				// forced choice is meaningless here — drop it so the request is accepted.
+				const refreshChoiceType = refreshParams.tool_choice?.type;
+				if (refreshChoiceType === "tool" || refreshChoiceType === "any") {
+					delete refreshParams.tool_choice;
+				}
 				rawRequestDump = {
 					provider: model.provider,
 					api: output.api,
@@ -3064,6 +3074,30 @@ const streamAnthropicOnce = (
 					}
 					const streamFailureMessage =
 						streamFailure instanceof Error ? streamFailure.message : String(streamFailure);
+					if (
+						isOAuthToken &&
+						clientArgs &&
+						firstTokenTime === undefined &&
+						adoptRequiredClaudeCodeVersion(streamFailure)
+					) {
+						logger.warn("anthropic: Claude Code version rejected as too old, retrying with required version", {
+							model: model.id,
+							version: getClaudeCodeVersion(),
+						});
+						client = createClient(model, { ...clientArgs, disableStrictTools }).client;
+						params = await prepareParams();
+						providerRetryAttempt = 0;
+						output.content.length = 0;
+						output.model = model.id;
+						output.responseId = undefined;
+						output.upstreamModel = undefined;
+						output.errorMessage = undefined;
+						output.providerPayload = undefined;
+						output.usage = createEmptyUsage(copilotDynamicHeaders?.premiumRequests);
+						output.stopReason = "stop";
+						firstTokenTime = undefined;
+						continue;
+					}
 					if (
 						!prefixBindingRetryAttempted &&
 						options?.anthropicPrefixMismatchBehavior !== "error" &&

package/src/providers/aws-credentials.ts

@@ -407,8 +407,23 @@ interface SsoCachedToken {
 	expiresAt?: string;
 	startUrl?: string;
 	region?: string;
+	/** Present when the token was minted with the refresh_token grant enabled. */
+	refreshToken?: string;
+	clientId?: string;
+	clientSecret?: string;
+	/** Client registration expiry; refresh is impossible once this passes. */
+	registrationExpiresAt?: string;
 }
 
+/** A cache hit plus the filename it came from, so a refresh can be written back. */
+interface SsoCacheEntry {
+	token: SsoCachedToken;
+	file: string;
+}
+
+/** Refresh this long before `expiresAt` so a request in flight cannot age out. */
+const SSO_TOKEN_REFRESH_SKEW_MS = 60_000;
+
 async function readSsoCredentials(
 	profileCfg: Record<string, string>,
 	configIni: AwsIniFile | undefined,
@@ -431,19 +446,29 @@ async function readSsoCredentials(
 	}
 	if (!startUrl || !ssoRegion) return undefined;
 
-	const token = await loadSsoCachedToken(startUrl, sessionName);
-	if (!token?.accessToken) {
+	const cached = await loadSsoCachedToken(startUrl, sessionName);
+	if (!cached?.token.accessToken) {
 		throw new AIError.AwsCredentialsError(
 			`AWS SSO token for ${startUrl} not found in ~/.aws/sso/cache. Run 'aws sso login' first.`,
 			"sso-token-missing",
 		);
 	}
-	const expiresAt = token.expiresAt ? Date.parse(token.expiresAt) : Number.POSITIVE_INFINITY;
-	if (Number.isFinite(expiresAt) && expiresAt <= Date.now()) {
-		throw new AIError.AwsCredentialsError(
-			`AWS SSO token for ${startUrl} has expired. Run 'aws sso login' to refresh.`,
-			"sso-token-expired",
-		);
+	let accessToken = cached.token.accessToken;
+	const expiresAt = cached.token.expiresAt ? Date.parse(cached.token.expiresAt) : Number.POSITIVE_INFINITY;
+	const expired = Number.isFinite(expiresAt) && expiresAt <= Date.now();
+	// Access tokens are short-lived (often 1 h) but ship with a refresh token whose
+	// client registration lasts weeks. The AWS CLI refreshes transparently, so a
+	// profile that works under `aws` must not fail here; only a genuinely
+	// unrefreshable token warrants sending the user back to `aws sso login`.
+	if (Number.isFinite(expiresAt) && expiresAt - SSO_TOKEN_REFRESH_SKEW_MS <= Date.now()) {
+		const refreshed = await refreshSsoToken(cached.token, cached.file, ssoRegion, signal, fetchImpl);
+		if (refreshed?.accessToken) accessToken = refreshed.accessToken;
+		else if (expired) {
+			throw new AIError.AwsCredentialsError(
+				`AWS SSO token for ${startUrl} has expired. Run 'aws sso login' to refresh.`,
+				"sso-token-expired",
+			);
+		}
 	}
 
 	const url =
@@ -452,7 +477,7 @@ async function readSsoCredentials(
 		`&role_name=${encodeURIComponent(profileCfg.sso_role_name)}`;
 	const response = await fetchImpl(url, {
 		method: "GET",
-		headers: { "x-amz-sso_bearer_token": token.accessToken },
+		headers: { "x-amz-sso_bearer_token": accessToken },
 		signal,
 	});
 	if (!response.ok) {
@@ -487,7 +512,7 @@ async function readSsoCredentials(
 async function loadSsoCachedToken(
 	startUrl: string,
 	sessionName: string | undefined,
-): Promise<SsoCachedToken | undefined> {
+): Promise<SsoCacheEntry | undefined> {
 	const cacheDir = path.join(os.homedir(), ".aws", "sso", "cache");
 	let entries: string[];
 	try {
@@ -510,7 +535,7 @@ async function loadSsoCachedToken(
 			const text = await fs.promises.readFile(path.join(cacheDir, file), "utf8");
 			const parsed = JSON.parse(text) as SsoCachedToken;
 			if (parsed.startUrl === startUrl || (sessionName && file === `${hash}.json`)) {
-				return parsed;
+				return { token: parsed, file };
 			}
 		} catch (err) {
 			logger.debug("aws-credentials: failed to read SSO cache", { file, err: String(err) });
@@ -519,6 +544,94 @@ async function loadSsoCachedToken(
 	return undefined;
 }
 
+/**
+ * Exchange the cached refresh token for a fresh access token via SSO OIDC
+ * `CreateToken`, which is what the AWS CLI does transparently on every command.
+ *
+ * Returns `undefined` when refresh is impossible (no refresh grant material, or
+ * the client registration itself has expired) or when the exchange fails, so a
+ * broken refresh surfaces the existing "run aws sso login" remedy rather than an
+ * opaque network error.
+ */
+async function refreshSsoToken(
+	token: SsoCachedToken,
+	file: string,
+	ssoRegion: string,
+	signal: AbortSignal | undefined,
+	fetchImpl: FetchImpl,
+): Promise<SsoCachedToken | undefined> {
+	if (!token.refreshToken || !token.clientId || !token.clientSecret) return undefined;
+	const registrationExpiresAt = token.registrationExpiresAt ? Date.parse(token.registrationExpiresAt) : Number.NaN;
+	if (Number.isFinite(registrationExpiresAt) && registrationExpiresAt <= Date.now()) {
+		logger.debug("aws-credentials: SSO client registration expired; cannot refresh");
+		return undefined;
+	}
+
+	let response: Response;
+	try {
+		response = await fetchImpl(`https://oidc.${ssoRegion}.amazonaws.com/token`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				clientId: token.clientId,
+				clientSecret: token.clientSecret,
+				grantType: "refresh_token",
+				refreshToken: token.refreshToken,
+			}),
+			signal,
+		});
+	} catch (err) {
+		logger.debug("aws-credentials: SSO token refresh request failed", { err: String(err) });
+		return undefined;
+	}
+	if (!response.ok) {
+		const body = await response.text().catch(() => "");
+		logger.debug("aws-credentials: SSO token refresh rejected", {
+			status: response.status,
+			body: body.slice(0, 200),
+		});
+		return undefined;
+	}
+	const json = (await response.json().catch(() => undefined)) as
+		| { accessToken?: string; expiresIn?: number; refreshToken?: string }
+		| undefined;
+	if (!json?.accessToken) {
+		logger.debug("aws-credentials: SSO token refresh returned no accessToken");
+		return undefined;
+	}
+
+	const updated: SsoCachedToken = {
+		...token,
+		accessToken: json.accessToken,
+		// `expiresIn` is seconds from now; the cache records an absolute instant.
+		// Trim milliseconds to match the format the AWS CLI writes.
+		expiresAt: new Date(Date.now() + (json.expiresIn ?? 0) * 1000).toISOString().replace(/\.\d{3}Z$/, "Z"),
+		// The service may rotate the refresh token; persisting the new one keeps
+		// the following refresh working.
+		refreshToken: json.refreshToken ?? token.refreshToken,
+	};
+	await writeSsoCachedToken(file, updated);
+	return updated;
+}
+
+/**
+ * Persist a refreshed token so the AWS CLI, other SDKs, and the next OMP process
+ * all start from a live token. Written via temp file + rename so a concurrent
+ * reader never observes a half-written cache entry; a failure here is logged and
+ * ignored, since the in-memory token is still usable for this run.
+ */
+async function writeSsoCachedToken(file: string, token: SsoCachedToken): Promise<void> {
+	const target = path.join(os.homedir(), ".aws", "sso", "cache", file);
+	const tmp = `${target}.${process.pid}.tmp`;
+	try {
+		await fs.promises.writeFile(tmp, JSON.stringify(token), { mode: 0o600 });
+		await fs.promises.rename(tmp, target);
+	} catch (err) {
+		logger.debug("aws-credentials: failed to persist refreshed SSO token", { file, err: String(err) });
+		await fs.promises.rm(tmp, { force: true }).catch(() => {});
+	}
+}
+
 async function sha1Hex(input: string): Promise<string> {
 	const digest = await globalThis.crypto.subtle.digest("SHA-1", new TextEncoder().encode(input));
 	const bytes = new Uint8Array(digest);

package/src/providers/claude-code-fingerprint.ts

@@ -8,12 +8,64 @@
  * provider module.
  */
 
-/** Current Claude Code CLI version represented on the Anthropic wire. */
-export const claudeCodeVersion = "2.1.257";
+/**
+ * Pinned Claude Code CLI version: the offline fallback for {@link getClaudeCodeVersion}.
+ * Bumped to the latest npm release by `bun run check-spoofed-versions --update`.
+ */
+export const DEFAULT_CLAUDE_CODE_VERSION = "2.1.280";
 /** `@anthropic-ai/sdk` version bundled by the current Claude Code release. */
 export const claudeCodeSdkVersion = "0.112.1";
+
+const SEMVER_PATTERN = /^(\d+)\.(\d+)\.(\d+)$/;
+const VERSION_TOO_OLD_CODE = "claude_code_version_too_old";
+const REQUIRED_VERSION_PATTERN = /version (\d+\.\d+\.\d+) or newer is required/i;
+
+let adoptedClaudeCodeVersion: string | null = null;
+
+/**
+ * Claude Code CLI version represented on the Anthropic wire (User-Agent, billing
+ * header): `PI_AI_CLAUDE_CODE_VERSION` → version adopted from a server rejection
+ * (see {@link adoptRequiredClaudeCodeVersion}) → {@link DEFAULT_CLAUDE_CODE_VERSION}.
+ */
+export function getClaudeCodeVersion(): string {
+	return process.env.PI_AI_CLAUDE_CODE_VERSION || adoptedClaudeCodeVersion || DEFAULT_CLAUDE_CODE_VERSION;
+}
+
 /** User-Agent emitted by Claude Code's CLI inference entrypoint. */
-export const claudeCodeUserAgent = `claude-cli/${claudeCodeVersion} (external, cli)`;
+export function getClaudeCodeUserAgent(): string {
+	return `claude-cli/${getClaudeCodeVersion()} (external, cli)`;
+}
+
+function compareSemver(a: string, b: string): number {
+	const pa = SEMVER_PATTERN.exec(a);
+	const pb = SEMVER_PATTERN.exec(b);
+	if (!pa || !pb) return 0;
+	for (let i = 1; i <= 3; i++) {
+		const diff = Number(pa[i]) - Number(pb[i]);
+		if (diff !== 0) return diff;
+	}
+	return 0;
+}
+
+/**
+ * Adopts the minimum version named by an Anthropic `claude_code_version_too_old`
+ * rejection for the rest of the process, so the pinned fallback going stale costs
+ * one rejected request instead of a hard failure.
+ *
+ * Returns true only when the wire version actually increased — callers retry on
+ * true, so a repeated rejection at the same version cannot loop. Always false
+ * while `PI_AI_CLAUDE_CODE_VERSION` pins the version explicitly.
+ */
+export function adoptRequiredClaudeCodeVersion(error: unknown): boolean {
+	if (process.env.PI_AI_CLAUDE_CODE_VERSION) return false;
+	const message = error instanceof Error ? error.message : String(error);
+	if (!message.includes(VERSION_TOO_OLD_CODE)) return false;
+	const required = REQUIRED_VERSION_PATTERN.exec(message)?.[1];
+	if (!required || compareSemver(required, getClaudeCodeVersion()) <= 0) return false;
+	adoptedClaudeCodeVersion = required;
+	return true;
+}
+
 /** Prefix used to isolate custom Anthropic OAuth tools from built-in tools. */
 export const claudeToolPrefix: string = "_";
 /** Identity block prepended by Claude Code's CLI runtime. */

package/src/providers/gitlab-duo.ts

@@ -123,7 +123,17 @@ export function streamGitLabDuo(
 				...options.headers,
 			};
 
+			// This wrapper dispatches directly to the routed provider and bypasses
+			// mapOptionsForApi(), so preserve the shared reasoning contracts here as
+			// well. The anthropic-messages route derives thinking on/off from the
+			// effort itself, so fold the explicit off into a cleared effort — capped
+			// side turns rely on this to keep Anthropic from raising max_tokens for a
+			// thinking budget. The OpenAI routes take the flags themselves, mirroring
+			// mapOptionsForApi(), and keep the requested effort for their own
+			// off/fallback handling.
 			const reasoningEffort = options.reasoning;
+			const anthropicReasoningEffort =
+				options.disableReasoning || options.forceReasoningOff ? undefined : options.reasoning;
 
 			const inner =
 				route.api === "anthropic-messages"
@@ -158,11 +168,12 @@ export function streamGitLabDuo(
 								onResponse: options.onResponse,
 								onSseEvent: options.onSseEvent,
 								fetch: options.fetch,
-								thinkingEnabled: Boolean(reasoningEffort) && model.reasoning,
-								thinkingBudgetTokens: reasoningEffort
-									? (options.thinkingBudgets?.[reasoningEffort] ?? ANTHROPIC_THINKING[reasoningEffort])
+								thinkingEnabled: Boolean(anthropicReasoningEffort) && model.reasoning,
+								thinkingBudgetTokens: anthropicReasoningEffort
+									? (options.thinkingBudgets?.[anthropicReasoningEffort] ??
+										ANTHROPIC_THINKING[anthropicReasoningEffort])
 									: undefined,
-								reasoning: reasoningEffort,
+								reasoning: anthropicReasoningEffort,
 								toolChoice: mapAnthropicToolChoice(options.toolChoice),
 							},
 						)
@@ -199,6 +210,8 @@ export function streamGitLabDuo(
 									onSseEvent: options.onSseEvent,
 									fetch: options.fetch,
 									reasoning: reasoningEffort,
+									disableReasoning: options.disableReasoning,
+									forceReasoningOff: options.forceReasoningOff,
 									toolChoice: options.toolChoice,
 								} satisfies OpenAIResponsesOptions,
 							)
@@ -233,6 +246,9 @@ export function streamGitLabDuo(
 									onSseEvent: options.onSseEvent,
 									fetch: options.fetch,
 									reasoning: reasoningEffort,
+									// OpenAICompletionsOptions carries no forceReasoningOff; fold it
+									// like the azure-openai-responses mapping does.
+									disableReasoning: options.disableReasoning || options.forceReasoningOff,
 									toolChoice: options.toolChoice,
 								} satisfies OpenAICompletionsOptions,
 							);

package/src/providers/google-gemini-cli.ts

@@ -420,9 +420,7 @@ interface CloudCodeAssistRequest {
 			temperature?: number;
 			topP?: number;
 			topK?: number;
-			minP?: number;
 			presencePenalty?: number;
-			repetitionPenalty?: number;
 			thinkingConfig?: ThinkingConfig;
 		};
 		tools?: { functionDeclarations: Record<string, unknown>[] }[] | undefined;
@@ -1275,15 +1273,9 @@ export function buildRequest(
 	if (options.topK !== undefined) {
 		generationConfig.topK = options.topK;
 	}
-	if (options.minP !== undefined) {
-		generationConfig.minP = options.minP;
-	}
 	if (options.presencePenalty !== undefined) {
 		generationConfig.presencePenalty = options.presencePenalty;
 	}
-	if (options.repetitionPenalty !== undefined) {
-		generationConfig.repetitionPenalty = options.repetitionPenalty;
-	}
 
 	// Thinking config
 	if (options.thinking?.enabled && model.reasoning) {

package/src/providers/google-shared.ts

@@ -780,18 +780,6 @@ export async function consumeGoogleStream<T extends GoogleApiType>(args: {
 	}
 }
 
-/**
- * Generation/sampling fields that map directly onto Gemini's `GenerateContentConfig`.
- * Excludes any provider-specific extensions (`topP`/`topK`/etc are all forwarded as-is).
- */
-interface GoogleGenerationConfig extends GenerateContentConfig {
-	topP?: number;
-	topK?: number;
-	minP?: number;
-	presencePenalty?: number;
-	repetitionPenalty?: number;
-}
-
 /**
  * Build the `GenerateContentParameters` payload for the public Gemini API and Vertex AI.
  * Both surfaces accept the same `GenerateContentConfig` shape — every numeric/string knob,
@@ -809,14 +797,12 @@ export function buildGoogleGenerateContentParams<T extends "google-generative-ai
 	const systemPrompts = normalizeSystemPrompts(context.systemPrompt);
 	const contents = convertMessages(model, context);
 
-	const generationConfig: GoogleGenerationConfig = {};
+	const generationConfig: GenerateContentConfig = {};
 	if (options.temperature !== undefined) generationConfig.temperature = options.temperature;
 	if (options.maxTokens !== undefined) generationConfig.maxOutputTokens = options.maxTokens;
 	if (options.topP !== undefined) generationConfig.topP = options.topP;
 	if (options.topK !== undefined) generationConfig.topK = options.topK;
-	if (options.minP !== undefined) generationConfig.minP = options.minP;
 	if (options.presencePenalty !== undefined) generationConfig.presencePenalty = options.presencePenalty;
-	if (options.repetitionPenalty !== undefined) generationConfig.repetitionPenalty = options.repetitionPenalty;
 
 	const config: GenerateContentConfig = {
 		...(Object.keys(generationConfig).length > 0 && generationConfig),
@@ -1111,9 +1097,6 @@ function paramsToWireBody(params: GenerateContentParameters): Record<string, unk
 	if (config.responseJsonSchema !== undefined) gen.responseJsonSchema = config.responseJsonSchema;
 	if (config.responseModalities !== undefined) gen.responseModalities = config.responseModalities;
 	if (config.thinkingConfig !== undefined) gen.thinkingConfig = config.thinkingConfig;
-	const generationConfig = config as unknown as { minP?: number; repetitionPenalty?: number };
-	if (generationConfig.minP !== undefined) gen.minP = generationConfig.minP;
-	if (generationConfig.repetitionPenalty !== undefined) gen.repetitionPenalty = generationConfig.repetitionPenalty;
 	if (Object.keys(gen).length > 0) body.generationConfig = gen;
 	return body;
 }

package/src/providers/openai-chat-server-schema.ts

@@ -210,7 +210,7 @@ export const openaiChatRequestSchema = type({
 	"frequency_penalty?": "number",
 	"logit_bias?": type({ "[string]": "number" }),
 	"user?": "string",
-	"reasoning_effort?": "'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max'",
+	"reasoning_effort?": "'none' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max'",
 	"parallel_tool_calls?": "boolean",
 	"service_tier?": "'auto' | 'default' | 'flex' | 'scale' | 'priority'",
 	"metadata?": type({ "[string]": "unknown" }),

package/src/providers/openai-chat-server.ts

@@ -200,7 +200,9 @@ export function parseRequest(body: unknown, headers?: Headers): ParsedRequest {
 	if (data.user !== undefined) options.user = data.user;
 	if (data.response_format !== undefined) options.responseFormat = data.response_format;
 	if (data.parallel_tool_calls !== undefined) options.parallelToolCalls = data.parallel_tool_calls;
-	if (data.reasoning_effort !== undefined && isReasoningEffort(data.reasoning_effort)) {
+	if (data.reasoning_effort === "none") {
+		options.forceReasoningOff = true;
+	} else if (data.reasoning_effort !== undefined && isReasoningEffort(data.reasoning_effort)) {
 		options.reasoning = data.reasoning_effort;
 	}
 	if (data.service_tier !== undefined && isServiceTier(data.service_tier)) {