@oh-my-pi/pi-ai 18.4.10 → 18.4.11

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [18.4.11] - 2026-10-02
+
+### Fixed
+
+- Fixed Cursor cached prompt token accounting to prevent duplicate input-token and cost reporting on cached turns.
+- Fixed auth-broker credential handling so late token-refresh responses cannot restore logged-out credentials or overwrite a newer login.
+
 ## [18.4.10] - 2026-10-02
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.4.10",
+	"version": "18.4.11",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,11 +155,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.4.10",
-		"@oh-my-pi/pi-catalog": "18.4.10",
-		"@oh-my-pi/pi-natives": "18.4.10",
-		"@oh-my-pi/pi-utils": "18.4.10",
-		"@oh-my-pi/pi-wire": "18.4.10"
+		"@oh-my-pi/omptype": "18.4.11",
+		"@oh-my-pi/pi-catalog": "18.4.11",
+		"@oh-my-pi/pi-natives": "18.4.11",
+		"@oh-my-pi/pi-utils": "18.4.11",
+		"@oh-my-pi/pi-wire": "18.4.11"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/auth-broker/remote-store.ts

@@ -17,6 +17,7 @@ import {
 	type OAuthCredential,
 	type OAuthRefreshReason,
 	REMOTE_REFRESH_SENTINEL,
+	type RemoteOAuthCredential,
 	type StoredAuthCredential,
 	type StoredCredentialBlock,
 } from "../auth/types";
@@ -849,15 +850,7 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 
 	async markCredentialSuspect(credentialId: number, opts: { signal?: AbortSignal } = {}): Promise<void> {
 		this.#noteActivity();
-		const { entry } = await this.#client.refreshCredential(credentialId, opts.signal, "auth-recovery");
-		if (entry.credential.type !== "oauth") {
-			throw new AIError.AuthBrokerError(`Broker returned non-OAuth credential for id=${credentialId}`);
-		}
-		if (!this.#applyCredentialEntry(entry)) {
-			throw new AIError.AuthBrokerError(
-				`Broker refreshed credential id=${credentialId} outside the configured account pool`,
-			);
-		}
+		await this.#refreshThroughBroker(credentialId, opts.signal, "auth-recovery");
 		this.#maybeRefreshSnapshot("suspect credential refresh");
 	}
 
@@ -1168,21 +1161,12 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		reason?: OAuthRefreshReason,
 	): Promise<OAuthCredentials> {
 		this.#noteActivity();
-		const { entry } = await this.#client.refreshCredential(credentialId, signal, reason);
-		if (entry.credential.type !== "oauth") {
-			throw new AIError.AuthBrokerError(`Broker returned non-OAuth credential for id=${credentialId}`);
-		}
-		if (!this.#applyCredentialEntry(entry)) {
-			throw new AIError.AuthBrokerError(
-				`Broker refreshed credential id=${credentialId} outside the configured account pool`,
-			);
-		}
+		const refreshed = await this.#refreshThroughBroker(credentialId, signal, reason);
 		if (!this.#streamingActive) {
 			await this.refreshSnapshot().catch(error => {
 				logger.debug("auth-broker snapshot refresh after credential refresh failed", { error: String(error) });
 			});
 		}
-		const refreshed = entry.credential;
 		return {
 			access: refreshed.access,
 			refresh: REMOTE_REFRESH_SENTINEL,
@@ -1194,6 +1178,38 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		};
 	}
 
+	/**
+	 * Refresh one credential through the broker and apply the reply. If this
+	 * client's copy changed to something else while the request was in flight,
+	 * the reply may be stale, so the broker's current row wins: a logout stays
+	 * logged out and a newer login is kept.
+	 */
+	async #refreshThroughBroker(
+		credentialId: number,
+		signal?: AbortSignal,
+		reason?: OAuthRefreshReason,
+	): Promise<RemoteOAuthCredential> {
+		const local = () => this.#snapshot.credentials.find(candidate => candidate.id === credentialId);
+		const before = JSON.stringify(local()?.credential);
+		let { entry } = await this.#client.refreshCredential(credentialId, signal, reason);
+		const current = JSON.stringify(local()?.credential);
+		if (current !== before && current !== JSON.stringify(entry.credential)) {
+			await this.refreshSnapshot();
+			const latest = local();
+			if (!latest) throw new AIError.AuthBrokerError(`Credential id=${credentialId} was removed during refresh`);
+			entry = latest;
+		}
+		if (entry.credential.type !== "oauth") {
+			throw new AIError.AuthBrokerError(`Broker returned non-OAuth credential for id=${credentialId}`);
+		}
+		if (!this.#applyCredentialEntry(entry)) {
+			throw new AIError.AuthBrokerError(
+				`Broker refreshed credential id=${credentialId} outside the configured account pool`,
+			);
+		}
+		return entry.credential;
+	}
+
 	/**
 	 * Store-level hook consumed by `AuthStorage.usage.reports()` — proxies
 	 * to the broker's `/v1/usage` endpoint. Shared per-credential caches and

package/src/providers/cursor.ts

@@ -5341,7 +5341,9 @@ export function processInteractionUpdate(
  * summed 22 against a final 36 — and never report input, cache, or reasoning
  * tokens, so every bucket the final frame reports replaces the streamed
  * estimate. Unreported counters decode as `undefined`; a frame that reports
- * nothing at all leaves the streamed totals untouched.
+ * nothing at all leaves the streamed totals untouched. `inputTokens` counts the
+ * whole prompt, cache hits and writes included, so fresh input is what remains
+ * after both are taken out.
  */
 function applyTurnEndedUsage(usage: Usage, update: TurnEndedUpdate): void {
 	const input = Number(update.inputTokens ?? 0n);
@@ -5350,7 +5352,7 @@ function applyTurnEndedUsage(usage: Usage, update: TurnEndedUpdate): void {
 	const cacheWrite = Number(update.cacheWriteTokens ?? 0n);
 	const reasoning = Number(update.reasoningTokens ?? 0n);
 	if (input <= 0 && output <= 0 && cacheRead <= 0 && cacheWrite <= 0) return;
-	if (input > 0) usage.input = input;
+	if (input > 0) usage.input = Math.max(input - cacheRead - cacheWrite, 0);
 	if (output > 0) usage.output = output;
 	if (cacheRead > 0) usage.cacheRead = cacheRead;
 	if (cacheWrite > 0) usage.cacheWrite = cacheWrite;