@oh-my-pi/pi-ai 18.3.0 → 18.3.2

package/src/providers/transform-messages.ts

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import { renderDemotedThinking } from "../dialect/demotion";
 import type {
 	Api,
@@ -437,14 +438,23 @@ function hasPlausibleCredentialEntropy(token: string): boolean {
 }
 
 /**
- * Whether outbound credential-pattern redaction is active. Off by default;
- * hosts opt in explicitly (the coding agent wires this to the
- * `secrets.enabled` setting).
+ * Whether outbound credential-pattern redaction is active outside any
+ * {@link withCredentialRedaction} scope. Off by default; hosts opt in
+ * explicitly (the coding agent wires this to the `secrets.enabled` setting).
  */
 let credentialRedactionEnabled = false;
 
+/** Per-request override of {@link credentialRedactionEnabled}; see {@link withCredentialRedaction}. */
+const credentialRedactionScope = new AsyncLocalStorage<boolean>();
+
+/** Redaction policy for the request being built: its scope's, else the process-wide switch. */
+function isCredentialRedactionActive(): boolean {
+	return credentialRedactionScope.getStore() ?? credentialRedactionEnabled;
+}
+
 /**
- * Toggle outbound credential-pattern redaction. When disabled (the default),
+ * Toggle process-wide outbound credential-pattern redaction (requests outside
+ * any {@link withCredentialRedaction} scope). When disabled (the default),
  * {@link redactSensitiveCredentials} and {@link redactSensitiveInObject} are
  * pass-throughs and outbound messages/system prompts leave the process
  * unmodified.
@@ -453,8 +463,18 @@ export function configureCredentialRedaction(enabled: boolean): void {
 	credentialRedactionEnabled = enabled;
 }
 
+/**
+ * Runs `fn` with outbound credential-pattern redaction forced on or off for
+ * every request it starts (including the async work those requests spawn),
+ * overriding {@link configureCredentialRedaction}. Lets concurrent sessions in
+ * one process each apply their own policy.
+ */
+export function withCredentialRedaction<T>(enabled: boolean, fn: () => T): T {
+	return credentialRedactionScope.run(enabled, fn);
+}
+
 export function redactSensitiveCredentials(text: string): string {
-	if (!credentialRedactionEnabled) return text;
+	if (!isCredentialRedactionActive()) return text;
 	return text.replace(SENSITIVE_TOKEN_RE, match => {
 		if (!hasPlausibleCredentialEntropy(match)) return match;
 		const lower = match.toLowerCase();
@@ -475,7 +495,7 @@ export function redactSensitiveCredentials(text: string): string {
 }
 
 export function redactSensitiveInObject(val: unknown): { result: unknown; changed: boolean } {
-	if (!credentialRedactionEnabled) return { result: val, changed: false };
+	if (!isCredentialRedactionActive()) return { result: val, changed: false };
 	if (typeof val === "string") {
 		const redacted = redactSensitiveCredentials(val);
 		return { result: redacted, changed: redacted !== val };
@@ -503,7 +523,7 @@ export function redactSensitiveInObject(val: unknown): { result: unknown; change
 }
 
 function redactSensitiveCredentialsInMessages(messages: Message[]): Message[] {
-	if (!credentialRedactionEnabled) return messages;
+	if (!isCredentialRedactionActive()) return messages;
 	return messages.map((msg): Message => {
 		if (msg.role === "user" || msg.role === "developer") {
 			const userMsg = msg as UserMessage | DeveloperMessage;

package/src/stream.ts

@@ -2083,6 +2083,7 @@ function mapOptionsForApi<TApi extends Api>(
 		streamIdleTimeoutMs: options?.streamIdleTimeoutMs,
 		codexSseMaxAttempts: options?.codexSseMaxAttempts,
 		providerSessionState: options?.providerSessionState,
+		liveSteering: options?.liveSteering,
 		maxInFlightRequests: options?.maxInFlightRequests,
 		toolNamespacesInfo: options?.toolNamespacesInfo,
 		onPayload: options?.onPayload,
@@ -2095,6 +2096,7 @@ function mapOptionsForApi<TApi extends Api>(
 		anthropicCacheRefreshRequest: options?.anthropicCacheRefreshRequest,
 		anthropicPrefixMismatchBehavior: options?.anthropicPrefixMismatchBehavior,
 		anthropicCompaction: options?.anthropicCompaction,
+		anthropicSlowMode: options?.anthropicSlowMode,
 		userProfileId: options?.userProfileId,
 		...simpleProviderOptions,
 	};
@@ -2136,11 +2138,21 @@ function mapOptionsForApi<TApi extends Api>(
 					? mapEffortToAnthropicAdaptiveEffort(model, reasoning)
 					: undefined;
 
+			// A caller's maxTokens is the output it asked for, but thinking spends the
+			// same max_tokens: adaptive thinking can use all of it and leave no answer.
+			// Give thinking its budget on top, as the budget-only path below does. An
+			// uncapped request keeps the provider default.
+			const maxTokensWithThinking =
+				base.maxTokens === undefined
+					? undefined
+					: maxTokensWithThinkingBudget(base.maxTokens, model.maxTokens, thinkingBudget);
+
 			// For Opus 4.6+ and Sonnet 4.6+: use adaptive thinking with effort level
 			// For older models: use budget-based thinking
 			if (thinkingMode === "anthropic-adaptive") {
 				return castApi<"anthropic-messages">({
 					...base,
+					maxTokens: maxTokensWithThinking,
 					requestModelId: resolveWireModelId(model, reasoning),
 					thinkingEnabled: true,
 					effort,
@@ -2153,6 +2165,7 @@ function mapOptionsForApi<TApi extends Api>(
 			if (ANTHROPIC_USE_INTERLEAVED_THINKING) {
 				return castApi<"anthropic-messages">({
 					...base,
+					maxTokens: maxTokensWithThinking,
 					requestModelId: resolveWireModelId(model, reasoning),
 					thinkingEnabled: true,
 					thinkingBudgetTokens: thinkingBudget,
@@ -2212,8 +2225,25 @@ function mapOptionsForApi<TApi extends Api>(
 				guardrailTrace: model.guardrailTrace ?? options?.guardrailTrace,
 				requestMetadata: options?.requestMetadata,
 			};
-			// Effort modes send effort directly, no budget_tokens — skip budget inflation.
-			if (model.thinking?.mode === "effort" || model.thinking?.mode === "anthropic-adaptive") {
+			// Adaptive Claude shares max_tokens between thinking and the answer, like
+			// the anthropic-messages adaptive path: a caller's cap is the output it
+			// wants, so add the effort's budget on top. Uncapped requests keep the
+			// provider default.
+			if (model.thinking?.mode === "anthropic-adaptive") {
+				const reasoning = bedrockBase.reasoning;
+				const budget = reasoning
+					? (options?.thinkingBudgets?.[reasoning] ?? BEDROCK_CLAUDE_THINKING[reasoning])
+					: 0;
+				if (!model.reasoning || bedrockBase.maxTokens === undefined || budget <= 0) {
+					return castApi<"bedrock-converse-stream">(bedrockBase);
+				}
+				return castApi<"bedrock-converse-stream">({
+					...bedrockBase,
+					maxTokens: maxTokensWithThinkingBudget(bedrockBase.maxTokens, model.maxTokens, budget),
+				});
+			}
+			// Effort mode sends effort directly, no budget_tokens — skip budget inflation.
+			if (model.thinking?.mode === "effort") {
 				return castApi<"bedrock-converse-stream">(bedrockBase);
 			}
 			const budgetInfo = resolveBedrockThinkingBudget(model as Model<"bedrock-converse-stream">, options);

package/src/types.ts

@@ -2,6 +2,7 @@ export * from "@oh-my-pi/pi-catalog/effort";
 export * from "@oh-my-pi/pi-catalog/types";
 
 import type { Type } from "@oh-my-pi/omptype";
+import type { AnthropicSlowModeHooks } from "./providers/anthropic-slow-mode";
 import type {
 	DeleteArgs,
 	DeleteResult,
@@ -529,6 +530,13 @@ export interface StreamOptions {
 	 * Providers can use this to persist transport/session state between turns.
 	 */
 	providerSessionState?: Map<string, ProviderSessionState>;
+	/**
+	 * Source of user steering a provider may deliver into the response it is
+	 * streaming (OpenAI Responses `response.steer` over the Codex WebSocket).
+	 * Providers without mid-response input ignore it; unclaimed steering stays
+	 * with the caller for its next request.
+	 */
+	liveSteering?: LiveSteering;
 	/** Canonical Codex compaction classification; ignored by other providers. */
 	codexCompaction?: CodexCompactionRequestContext;
 	/** Codex Code Mode tool exposure snapshot emitted as `tool_namespaces_info` turn metadata; ignored by other providers. */
@@ -624,6 +632,42 @@ export interface StreamOptions {
 
 	/** Cursor exec/MCP tool handlers (cursor-agent only). */
 	execHandlers?: CursorExecHandlers;
+	/**
+	 * Anthropic fallback credit redemption handle from a prior classifier refusal.
+	 * When present, the Anthropic provider replays the frozen request body and betas with
+	 * the new model and `fallback_credit_token` to redeem prompt cache credit.
+	 */
+	fallbackCreditRedemption?: AnthropicFallbackCreditHandle;
+	/**
+	 * Anthropic subscription usage-limit state machine (wrap-up allowance and
+	 * Claude Code's `/low-priority`). Consulted only for first-party OAuth
+	 * `anthropic` requests: stamps `anthropic-usage-limit: slow` while active,
+	 * observes limit headers, and decides capacity waits.
+	 */
+	anthropicSlowMode?: AnthropicSlowModeHooks;
+}
+
+/**
+ * Caller-owned queue of user steering that a provider pulls from while a
+ * response streams. See {@link StreamOptions.liveSteering}.
+ */
+export interface LiveSteering {
+	/** Resolves once steering may be claimable, or when `signal` aborts. Never consumes input. */
+	wait(signal: AbortSignal): Promise<void>;
+	/** Takes the queued steering as provider messages; `undefined` when none is deliverable now. */
+	claim(signal: AbortSignal): Promise<LiveSteerClaim | undefined>;
+}
+
+/**
+ * Steering taken from a {@link LiveSteering} source. The provider settles it
+ * exactly once; later calls are ignored.
+ */
+export interface LiveSteerClaim {
+	readonly messages: readonly UserMessage[];
+	/** The server owns the input: the caller records it right after the current response. */
+	accept(): void;
+	/** Not delivered: the caller sends the input with its next request. */
+	reject(): void;
 }
 
 // Unified options with reasoning passed to streamSimple() and completeSimple()
@@ -988,6 +1032,8 @@ export interface UserMessage {
 	synthetic?: boolean;
 	/** True when injected mid-turn as a steer; consumed by the agent's pre-LLM transform to wrap it for emphasis. Never rendered. */
 	steering?: boolean;
+	/** True when the provider delivered this steer into the response it was streaming (`response.steer`). Display-only; never sent. */
+	liveSteered?: boolean;
 	/** Timestamp of a client-side history rewrite represented by this message. */
 	historyRewriteAt?: number;
 	/** Who initiated this message for billing/attribution semantics. */
@@ -1119,6 +1165,8 @@ export interface AssistantMessage {
 	requestControls?: AnthropicRequestControls;
 	/** Provider-specific opaque payload used to reconstruct transport-native history. */
 	providerPayload?: ProviderPayload;
+	/** In-memory fallback credit handle attached when a refusal response carries a fallback credit token. */
+	fallbackCreditHandle?: AnthropicFallbackCreditHandle;
 	timestamp: number; // Unix timestamp in milliseconds
 	duration?: number; // Request duration in milliseconds
 	ttft?: number; // Time to first token in milliseconds
@@ -1457,3 +1505,14 @@ export type AssistantMessageEvent =
 			reason: Extract<StopReason, "aborted" | "error">;
 			error: AssistantMessage;
 	  };
+
+export interface AnthropicFallbackCreditHandle {
+	token: string;
+	prefillClaim?: boolean | null;
+	params: unknown;
+	betas?: readonly string[];
+	betaHeader?: string;
+	expiresAt: number;
+	/** The refused response's content, in `AssistantMessage` block form. */
+	refusedContent?: AssistantMessage["content"];
+}

package/src/usage/registry.ts

@@ -17,7 +17,7 @@ import { codexRankingStrategy, openaiCodexUsageProvider } from "./openai-codex";
 import { opencodeGoRankingStrategy, opencodeGoUsageProvider } from "./opencode-go";
 import { syntheticUsageProvider } from "./synthetic";
 import { umansUsageProvider } from "./umans";
-import { xaiOauthUsageProvider } from "./xai-oauth";
+import { xaiOauthRankingStrategy, xaiOauthUsageProvider } from "./xai-oauth";
 import { zaiRankingStrategy, zaiUsageProvider } from "./zai";
 
 /** Resolves the usage-based ranking strategy for a provider. */
@@ -64,6 +64,7 @@ const DEFAULT_RANKING_STRATEGIES = new Map<Provider, CredentialRankingStrategy>(
 	["kimi-code", kimiRankingStrategy],
 	["zai", zaiRankingStrategy],
 	["opencode-go", opencodeGoRankingStrategy],
+	["xai-oauth", xaiOauthRankingStrategy],
 ]);
 
 /** Built-in ranking strategy for `provider`. */

package/src/usage/xai-oauth.ts

@@ -10,6 +10,7 @@
  */
 
 import { toNumber } from "@oh-my-pi/pi-catalog/utils";
+import { isUsageLimitExhausted } from "../auth/usage-report";
 import {
 	buildXAICliBillingUrl,
 	extractXAIAccessTokenSubject,
@@ -17,6 +18,7 @@ import {
 	getXAICliBillingHeaders,
 } from "../registry/oauth/xai-oauth";
 import type {
+	CredentialRankingStrategy,
 	UsageAmount,
 	UsageFetchContext,
 	UsageFetchParams,
@@ -26,7 +28,7 @@ import type {
 	UsageWindow,
 } from "../usage";
 import { isRecord } from "../utils";
-import { DAY_MS, parseIsoTimestamp, usageStatus, WEEK_MS } from "./shared";
+import { DAY_MS, HOUR_MS, parseIsoTimestamp, usageStatus, WEEK_MS } from "./shared";
 
 const PROVIDER_ID = "xai-oauth";
 const BILLING_SOURCE = "cli-chat-proxy.grok.com/v1/billing";
@@ -440,3 +442,31 @@ export const xaiOauthUsageProvider: UsageProvider = {
 		};
 	},
 };
+
+/**
+ * Ranks SuperGrok accounts by weekly credits (or unified monthly included quota).
+ * xAI reports no short window, so the meter maps to `secondary`, which drives drain ranking.
+ */
+export const xaiOauthRankingStrategy: CredentialRankingStrategy = {
+	scopeLimits(report) {
+		// Spent credits/included quota keeps serving on the on-demand cap; only hard-block
+		// the credential once no on-demand headroom remains.
+		const onDemand = report.limits.find(limit => limit.id === `${PROVIDER_ID}:on-demand`);
+		if (onDemand && !isUsageLimitExhausted(onDemand)) return [];
+		return report.limits.filter(
+			limit => limit.id === `${PROVIDER_ID}:credits:1w` || limit.id === `${PROVIDER_ID}:included:1mo`,
+		);
+	},
+	findWindowLimits(report) {
+		const credits = report.limits.find(limit => limit.id === `${PROVIDER_ID}:credits:1w`);
+		const included = report.limits.find(limit => limit.id === `${PROVIDER_ID}:included:1mo`);
+		return {
+			secondary: credits ?? included,
+		};
+	},
+	windowDefaults: {
+		// Inert: findWindowLimits never reports a primary window.
+		primaryMs: 5 * HOUR_MS,
+		secondaryMs: WEEK_MS,
+	},
+};

package/src/utils/http-inspector.ts

@@ -59,6 +59,25 @@ export function shouldDumpRejectedRequest(error: unknown): boolean {
 	return status === 400 || status === 413;
 }
 
+const RAW_HTTP_REQUEST_LINE = "raw-http-request=";
+const RAW_HTTP_REQUEST_SAVE_FAILED_LINE = "raw-http-request-save-failed=";
+
+/**
+ * Remove the local request-dump lines {@link appendRawHttpRequestDumpFor400} appends,
+ * leaving only the provider-facing error text. Hosts that relay provider errors
+ * (RPC `prompt_result`) must not leak OMP-local file paths.
+ */
+export function stripRawHttpRequestDiagnostics(message: string): string {
+	const lines = message.split("\n");
+	let end = lines.length;
+	while (
+		end > 0 &&
+		(lines[end - 1].startsWith(RAW_HTTP_REQUEST_LINE) || lines[end - 1].startsWith(RAW_HTTP_REQUEST_SAVE_FAILED_LINE))
+	)
+		end--;
+	return end === lines.length ? message : lines.slice(0, end).join("\n");
+}
+
 export async function appendRawHttpRequestDumpFor400(
 	message: string,
 	error: unknown,
@@ -75,10 +94,10 @@ export async function appendRawHttpRequestDumpFor400(
 
 	try {
 		await Bun.write(filePath, `${JSON.stringify(payload, null, 2)}\n`);
-		return `${message}\nraw-http-request=${filePath}`;
+		return `${message}\n${RAW_HTTP_REQUEST_LINE}${filePath}`;
 	} catch (writeError) {
 		const writeMessage = writeError instanceof Error ? writeError.message : String(writeError);
-		return `${message}\nraw-http-request-save-failed=${writeMessage}`;
+		return `${message}\n${RAW_HTTP_REQUEST_SAVE_FAILED_LINE}${writeMessage}`;
 	}
 }
 

package/src/utils/openrouter-headers.ts

@@ -1,10 +1,10 @@
-import { USER_AGENT } from "@oh-my-pi/pi-utils";
+import { APP_NAME, APP_URL, USER_AGENT } from "@oh-my-pi/pi-utils";
 
 export function getOpenRouterHeaders(): Record<string, string> {
 	return {
 		"User-Agent": USER_AGENT,
-		"HTTP-Referer": "https://omp.sh/",
-		"X-OpenRouter-Title": "omp",
+		"HTTP-Referer": APP_URL,
+		"X-OpenRouter-Title": APP_NAME,
 		"X-OpenRouter-Categories": "cli-agent",
 		"X-OpenRouter-Cache": "true",
 		"X-OpenRouter-Cache-TTL": "3600",