@oh-my-pi/pi-ai 18.4.8 → 18.4.9

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [18.4.9] - 2026-10-01
+
+### Fixed
+
+- Fixed rejected HTTP 400 requests from consuming unbounded disk space by automatically cleaning up old request logs and enforcing a size limit.
+- Fixed unnecessary credential and session updates that could trigger needless authentication reloads in other running processes.
+- Fixed context-overflow recovery for Strata requests that exceed the model context limit but return no usage information.
+
 ## [18.4.6] - 2026-10-01
 
 ### Fixed
@@ -2287,33 +2295,4 @@
 - Fixed tool schema conversion for non-Cloud Code Assist Google Gemini models by normalizing parameters with `normalizeSchemaForGoogle` to prevent un-normalized schema properties (such as `additionalProperties: false` or type arrays) from causing Gemini API errors.
 - Fixed OpenAI-family request builders dropping forced named `tool_choice` directives when the named tool is absent from the serialized `tools` array, preventing spec-strict providers from rejecting self-inconsistent requests. ([#1701](https://github.com/can1357/oh-my-pi/issues/1701))
 
-## [15.12.4] - 2026-06-13
-
-### Added
-
-- Added `GITLAB_CLIENT_ID` and `GITLAB_REDIRECT_URI` env-var overrides for the GitLab Duo OAuth login flow so users running with their own GitLab OAuth application can replace the bundled credentials when GitLab rejects the bundled `client_id`'s redirect URI. Setting `GITLAB_REDIRECT_URI` also disables the random-port fallback (strict OAuth providers reject mismatched URIs anyway). ([#2424](https://github.com/can1357/oh-my-pi/issues/2424))
-- Added `AuthStorage.listStoredCredentials()` and `AuthStorage.removeCredential()` for per-account credential management.
-
-### Changed
-
-- Replaced the OpenAI SDK client usage in `openai-completions`, `openai-responses`, `azure-openai-responses`, and `openai-codex-responses` with the new internal `postOpenAIStream` OpenAI-wire JSON/SSE transport
-
-### Fixed
-
-- Fixed streaming providers to cancel upstream model requests when the client closes the response body, so interrupted SSE sessions stop instead of continuing in the background
-- Fixed: provider request builders treat unknown `model.maxTokens` (`null`) as "no model cap" instead of coercing to `0` via `Math.min`; Anthropic falls back to the 64k Claude-Code cap for its required `max_tokens`.
-- Fixed transient stream failures on OpenAI-compatible providers by retrying HTTP 408/429/5xx responses and transient network errors with Retry-After/quota-hint aware backoff
-- Fixed SSE stream handling for OpenAI-compatible responses by parsing wire-level JSON frames directly and honoring `[DONE]` termination
-- Fixed stream error handling for OpenAI-compatible providers by preserving structured HTTP status/headers and response body details from failed requests for retry and strict-tool fallback logic
-- Fixed OpenAI-compat streams ending with a bare `finish_reason: "error"` (gateways like OpenRouter reporting upstream failures, e.g. Gemini `MALFORMED_FUNCTION_CALL`) surfacing as a non-retryable `Provider finish_reason: error`. The reason is now mapped to `Provider returned error finish_reason`, which the session retry classifier recognizes as transient, so the turn auto-retries instead of stopping with a pinned error banner.
-- Fixed `SqliteAuthCredentialStore.open()` crashing with `SQLITE_BUSY_RECOVERY` (errno 261) when several `omp --session` panes restore concurrently after an unclean shutdown: `PRAGMA busy_timeout = 5000` now runs as a standalone statement BEFORE `PRAGMA journal_mode=WAL` (the first lock-taking statement during WAL recovery), and `open()` retries the BUSY family — `SQLITE_BUSY`, `SQLITE_BUSY_RECOVERY`, `SQLITE_BUSY_SNAPSHOT`, `SQLITE_BUSY_TIMEOUT` — with bounded exponential backoff. The exhausted-retry error message includes the DB path. Exported `isSqliteBusyError(err)` for callers that need the same classifier ([#2421](https://github.com/can1357/oh-my-pi/issues/2421)).
-- Fixed MiniMax-M3 OpenAI-compatible streams rendering reasoning twice when the same chunk carried both `<think>…</think>` content and structured `reasoning_content`; structured reasoning now wins and cumulative MiniMax reasoning snapshots are collapsed to deltas. ([#2433](https://github.com/can1357/oh-my-pi/issues/2433))
-- Fixed Gemini turns silently halting the agent when the model returned `finishReason: STOP` with only an empty (or whitespace-only) text part and no tool call — the well-known "empty response" failure. All Google surfaces (public Generative Language `streamGoogle`, Vertex `streamGoogleVertex`, and Cloud Code Assist `google-gemini-cli`/`google-antigravity`) now classify such a turn as empty via the shared `hasMeaningfulGoogleContent` check and retry it up to `MAX_EMPTY_STREAM_RETRIES` times before surfacing an error. The Cloud Code Assist path previously had an empty-stream retry that never fired for this case (its `hasContent` flag counted an empty-string text part as content), and the public/Vertex path had no retry at all; the retry now emits a single `start` event so no duplicate partial message leaks downstream.
-
-## [15.12.1] - 2026-06-12
-
-### Added
-
-- Added the optional `ToolResultMessage.useless` flag: tools can declare a finished result contextually useless (zero matches, elapsed wait) so compaction passes may elide it once consumed. Never serialized to provider wire formats and never set together with `isError`.
-
-Older entries are archived in [packages\ai\CHANGELOG.md@cd762117522c](https://github.com/can1357/oh-my-pi/blob/cd762117522cc4122cd45b8d2d14de5f7be5133b/packages\ai\CHANGELOG.md).
+Older entries are archived in [packages/ai/CHANGELOG.md@edb740cbad49](https://github.com/can1357/oh-my-pi/blob/edb740cbad499dbc96f8b5b46ebf78f70d6af4d0/packages/ai/CHANGELOG.md).

package/dist/types/auth/affinity.d.ts

@@ -26,6 +26,11 @@ export declare class SessionAffinity implements SessionsApi {
      * `lastUsedAtMs` backdates the sticky (session-file pin restores on resume);
      * it defaults to now for live selections. Automatic re-recording of the same
      * durable row preserves an explicit user pin.
+     *
+     * The in-memory sticky is always exact. The persisted row is rewritten only
+     * when the credential, its type, or explicitness changes, or when the stored
+     * last-use drifts by {@link SESSION_STICKY_PERSIST_INTERVAL_MS} — per-request
+     * rewrites were pure database churn.
      */
     record(provider: string, sessionId: string | undefined, type: AuthCredential["type"], index: number, lastUsedAtMs?: number, explicit?: boolean): void;
     /** Retrieves the last credential used by a session. */

package/dist/types/auth/pool.d.ts

@@ -116,7 +116,9 @@ export declare class CredentialPool implements CredentialsApi {
     /**
      * Persist a refreshed credential by id only while the row still matches this
      * process's snapshot. A peer rotation wins the CAS and is reloaded instead of
-     * being overwritten after this process releases its refresh lease.
+     * being overwritten after this process releases its refresh lease. An
+     * unchanged credential still runs the CAS check (stores skip rewriting
+     * identical bytes), so peer rotations are detected without churning the row.
      *
      * Returns the row's current index, or -1 when it was disabled or removed.
      */

package/dist/types/auth/sqlite-credential-store.d.ts

@@ -36,6 +36,11 @@ export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
     listDisabledCredentials(provider?: string): Promise<DisabledCredentialSummary[]>;
     replaceAuthCredentials(provider: string, credentials: AuthCredential[]): Promise<StoredAuthCredential[]>;
     upsertAuthCredential(provider: string, credential: AuthCredential): Promise<StoredAuthCredential[]>;
+    /**
+     * Rewrites a row only when its persisted bytes change: an identical write would
+     * still bump `updated_at` and `auth_change_revision`, making every peer process
+     * reload credentials for nothing.
+     */
     updateAuthCredential(id: number, credential: AuthCredential): void;
     tryUpdateAuthCredentialIfMatches(id: number, expectedData: string, credential: AuthCredential, lease?: CredentialRefreshLeaseFence): boolean;
     deleteAuthCredential(id: number, disabledCause: string): Promise<boolean>;

package/dist/types/auth/types.d.ts

@@ -515,6 +515,8 @@ export interface OAuthAccountSummary {
     orgName?: string;
     /** True when this account is the session-sticky OAuth credential requested by `listOAuthAccounts`. */
     active: boolean;
+    /** Last use recorded on the session sticky; set only on the `active` account. */
+    lastUsedAtMs?: number;
 }
 /** Scope a matching-key invalidation to a session or signal. */
 export interface InvalidateCredentialMatchingOptions {

package/dist/types/utils/http-inspector.d.ts

@@ -39,6 +39,20 @@ export declare function shouldDumpRejectedRequest(error: unknown): boolean;
  */
 export declare function stripRawHttpRequestDiagnostics(message: string): string;
 export declare function appendRawHttpRequestDumpFor400(message: string, error: unknown, dump: RawHttpRequestDump | undefined): Promise<string>;
+export interface HttpRequestDumpRetention {
+    /** Dump file name never deleted (the one just written and referenced by the error). */
+    keep?: string;
+    /** Dumps last modified longer ago than this are deleted (default 7 days). */
+    maxAgeMs?: number;
+    /** Oldest remaining dumps are deleted until the directory totals at most this (default 64 MiB). */
+    maxTotalBytes?: number;
+    now?: number;
+}
+/**
+ * Bound the rejected-request dump directory: delete `*.json` dumps older than
+ * the age limit, then the oldest survivors until the total fits the size cap.
+ */
+export declare function pruneHttpRequestDumps(dir: string, retention?: HttpRequestDumpRetention): Promise<void>;
 export declare function finalizeErrorMessage(error: unknown, rawRequestDump: RawHttpRequestDump | undefined, capturedErrorResponse?: CapturedHttpErrorResponse): Promise<string>;
 /**
  * Rewrite error message for GitHub Copilot request failures.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.4.8",
+	"version": "18.4.9",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,11 +155,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.4.8",
-		"@oh-my-pi/pi-catalog": "18.4.8",
-		"@oh-my-pi/pi-natives": "18.4.8",
-		"@oh-my-pi/pi-utils": "18.4.8",
-		"@oh-my-pi/pi-wire": "18.4.8"
+		"@oh-my-pi/omptype": "18.4.9",
+		"@oh-my-pi/pi-catalog": "18.4.9",
+		"@oh-my-pi/pi-natives": "18.4.9",
+		"@oh-my-pi/pi-utils": "18.4.9",
+		"@oh-my-pi/pi-wire": "18.4.9"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/auth/affinity.ts

@@ -7,6 +7,21 @@ import type { KeyOverrides } from "./cascade";
 
 /** Prefix for persisted session-to-credential affinity. */
 export const SESSION_STICKY_CACHE_PREFIX = "session:sticky:";
+/** Persisted sticky rows live this long past their last use. */
+const SESSION_STICKY_TTL_SEC = 30 * 24 * 60 * 60;
+/**
+ * Same-credential re-records rewrite the persisted row at most this often. The
+ * in-memory sticky stays exact; only the copy other processes resume from lags.
+ */
+const SESSION_STICKY_PERSIST_INTERVAL_MS = 60_000;
+
+/** What this process last wrote (or read) for one persisted sticky row. */
+type PersistedSticky = {
+	type: AuthCredential["type"];
+	credentialId: number;
+	explicit: boolean;
+	lastUsedAtMs: number;
+};
 
 /** A session's pinned credential (resolved index + durable row id). */
 export type SessionCredential = {
@@ -22,6 +37,8 @@ export type SessionCredential = {
 export class SessionAffinity implements SessionsApi {
 	/** Tracks the last used credential per provider for a session (used for rate-limit switching). */
 	#sessionLastCredential: Map<string, Map<string, SessionCredential>> = new Map();
+	/** Persisted sticky rows keyed by cache key, so unchanged re-records skip the write. */
+	#persistedSticky: Map<string, PersistedSticky> = new Map();
 	#store: AuthCredentialStore;
 	#pool: CredentialPool;
 	#overrides: KeyOverrides;
@@ -35,8 +52,12 @@ export class SessionAffinity implements SessionsApi {
 	/** Drop every pin for a provider, both in memory and in the persisted cache. */
 	clearProvider(provider: string): void {
 		this.#sessionLastCredential.delete(provider);
+		const prefix = `${SESSION_STICKY_CACHE_PREFIX}${provider}:`;
+		for (const cacheKey of this.#persistedSticky.keys()) {
+			if (cacheKey.startsWith(prefix)) this.#persistedSticky.delete(cacheKey);
+		}
 		try {
-			this.#store.deleteCachePrefix?.(`${SESSION_STICKY_CACHE_PREFIX}${provider}:`);
+			this.#store.deleteCachePrefix?.(prefix);
 		} catch (err) {
 			logger.debug("Failed to clear provider session sticky credentials from persistent store cache", { err });
 		}
@@ -52,6 +73,11 @@ export class SessionAffinity implements SessionsApi {
 	 * `lastUsedAtMs` backdates the sticky (session-file pin restores on resume);
 	 * it defaults to now for live selections. Automatic re-recording of the same
 	 * durable row preserves an explicit user pin.
+	 *
+	 * The in-memory sticky is always exact. The persisted row is rewritten only
+	 * when the credential, its type, or explicitness changes, or when the stored
+	 * last-use drifts by {@link SESSION_STICKY_PERSIST_INTERVAL_MS} — per-request
+	 * rewrites were pure database churn.
 	 */
 	record(
 		provider: string,
@@ -80,14 +106,29 @@ export class SessionAffinity implements SessionsApi {
 		sessionMap.set(sessionId, sessionCredential);
 		this.#sessionLastCredential.set(provider, sessionMap);
 
+		if (credentialId === undefined) return;
+		const cacheKey = `${SESSION_STICKY_CACHE_PREFIX}${provider}:${sessionId}`;
+		const expiresAtSec = Math.floor(nowMs / 1000) + SESSION_STICKY_TTL_SEC;
+		const persisted = this.#persistedSticky.get(cacheKey);
+		if (
+			persisted &&
+			persisted.type === type &&
+			persisted.credentialId === credentialId &&
+			persisted.explicit === isExplicit &&
+			Math.abs(nowMs - persisted.lastUsedAtMs) < SESSION_STICKY_PERSIST_INTERVAL_MS
+		) {
+			return;
+		}
 		try {
-			if (credentialId !== undefined) {
-				const cacheKey = `${SESSION_STICKY_CACHE_PREFIX}${provider}:${sessionId}`;
-				// Expires in 30 days
-				const expiresAtSec = Math.floor(nowMs / 1000) + 30 * 24 * 60 * 60;
-				this.#store.setCache(cacheKey, JSON.stringify(sessionCredential), expiresAtSec);
-			}
+			this.#store.setCache(cacheKey, JSON.stringify(sessionCredential), expiresAtSec);
+			this.#persistedSticky.set(cacheKey, {
+				type,
+				credentialId,
+				explicit: isExplicit,
+				lastUsedAtMs: nowMs,
+			});
 		} catch (err) {
+			this.#persistedSticky.delete(cacheKey);
 			logger.debug("Failed to write session sticky credential to persistent store cache", { err });
 		}
 	}
@@ -122,12 +163,14 @@ export class SessionAffinity implements SessionsApi {
 					const stored = this.#pool.entries(provider);
 					const actualIndex = stored.findIndex(entry => entry.id === val.credentialId);
 					if (actualIndex === -1 || stored[actualIndex]?.credential.type !== val.type) {
+						this.#persistedSticky.delete(cacheKey);
 						this.#store.setCache(cacheKey, "", 0);
 						return undefined;
 					}
 					val.index = actualIndex;
 				} else {
 					// Fallback: drop unsafe index-only cache rows to prevent wrong-account routing
+					this.#persistedSticky.delete(cacheKey);
 					this.#store.setCache(cacheKey, "", 0);
 					return undefined;
 				}
@@ -143,6 +186,14 @@ export class SessionAffinity implements SessionsApi {
 					lastUsedAtMs: val.lastUsedAtMs,
 					...(val.explicit === true ? { explicit: true } : {}),
 				};
+				if (typeof val.lastUsedAtMs === "number") {
+					this.#persistedSticky.set(cacheKey, {
+						type: val.type,
+						credentialId: val.credentialId,
+						explicit: val.explicit === true,
+						lastUsedAtMs: val.lastUsedAtMs,
+					});
+				}
 				sessionMap.set(sessionId, sessionVal);
 				return sessionVal;
 			}
@@ -162,8 +213,9 @@ export class SessionAffinity implements SessionsApi {
 				this.#sessionLastCredential.delete(provider);
 			}
 		}
+		const cacheKey = `${SESSION_STICKY_CACHE_PREFIX}${provider}:${sessionId}`;
+		this.#persistedSticky.delete(cacheKey);
 		try {
-			const cacheKey = `${SESSION_STICKY_CACHE_PREFIX}${provider}:${sessionId}`;
 			this.#store.setCache(cacheKey, "", 0);
 		} catch (err) {
 			logger.debug("Failed to clear session sticky credential from persistent store cache", { err });

package/src/auth/oauth.ts

@@ -244,17 +244,22 @@ export class OAuthAccounts implements OAuthApi {
 			sessionCredential?.type === "oauth"
 				? this.#deps.pool.entries(provider)[sessionCredential.index]?.id
 				: undefined;
-		return this.#getStoredOAuthSelections(provider).map((selection, position) => ({
-			position,
-			credentialId: selection.credentialId,
-			accountId: selection.credential.accountId,
-			email: selection.credential.email,
-			projectId: selection.credential.projectId,
-			enterpriseUrl: selection.credential.enterpriseUrl,
-			orgId: selection.credential.orgId,
-			orgName: selection.credential.orgName,
-			active: selection.credentialId === activeCredentialId,
-		}));
+		const activeLastUsedAtMs = activeCredentialId !== undefined ? sessionCredential?.lastUsedAtMs : undefined;
+		return this.#getStoredOAuthSelections(provider).map((selection, position) => {
+			const active = selection.credentialId === activeCredentialId;
+			return {
+				position,
+				credentialId: selection.credentialId,
+				accountId: selection.credential.accountId,
+				email: selection.credential.email,
+				projectId: selection.credential.projectId,
+				enterpriseUrl: selection.credential.enterpriseUrl,
+				orgId: selection.credential.orgId,
+				orgName: selection.credential.orgName,
+				active,
+				...(active && activeLastUsedAtMs !== undefined ? { lastUsedAtMs: activeLastUsedAtMs } : {}),
+			};
+		});
 	}
 
 	/**

package/src/auth/pool.ts

@@ -467,7 +467,9 @@ export class CredentialPool implements CredentialsApi {
 	/**
 	 * Persist a refreshed credential by id only while the row still matches this
 	 * process's snapshot. A peer rotation wins the CAS and is reloaded instead of
-	 * being overwritten after this process releases its refresh lease.
+	 * being overwritten after this process releases its refresh lease. An
+	 * unchanged credential still runs the CAS check (stores skip rewriting
+	 * identical bytes), so peer rotations are detected without churning the row.
 	 *
 	 * Returns the row's current index, or -1 when it was disabled or removed.
 	 */
@@ -489,7 +491,9 @@ export class CredentialPool implements CredentialsApi {
 			return latest.findIndex(row => row.id === id);
 		}
 		if (!expected || !this.#store.tryUpdateAuthCredentialIfMatches) {
-			this.#store.updateAuthCredential(id, credential);
+			if (serializeCredential(provider, credential)?.data !== expected?.data) {
+				this.#store.updateAuthCredential(id, credential);
+			}
 		}
 		const updated = [...entries];
 		updated[index] = { id, credential };

package/src/auth/sqlite-credential-store.ts

@@ -88,6 +88,23 @@ type SerializedCredentialRecord = {
 	identityKey: string | null;
 };
 
+/** Persisted columns compared to skip rewriting a credential row with identical bytes. */
+type CredentialStateRow = {
+	provider: string;
+	credential_type: string;
+	data: string;
+	identity_key: string | null;
+	disabled_cause: string | null;
+};
+
+function storesSerializedCredential(row: CredentialStateRow, serialized: SerializedCredentialRecord): boolean {
+	return (
+		row.data === serialized.data &&
+		row.credential_type === serialized.credentialType &&
+		(row.identity_key ?? null) === serialized.identityKey
+	);
+}
+
 const AUTH_SCHEMA_VERSION = 8;
 const SQLITE_NOW_EPOCH = "CAST(strftime('%s','now') AS INTEGER)";
 const LEGACY_CODEX_BLOCK_PROVIDER_KEY = "openai-codex:oauth";
@@ -378,6 +395,8 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 	#getCredentialRefreshLeaseStmt: Statement;
 	#renewCredentialRefreshLeaseStmt: Statement;
 	#releaseCredentialRefreshLeaseStmt: Statement;
+	#getCredentialStateStmt: Statement;
+	#holdsCredentialRefreshLeaseStmt: Statement;
 	#credentialBlockReconcileAfter: Map<string, number> = new Map();
 	#insertUsageHistoryStmt: Statement;
 	#lastUsageHistoryStmt: Statement;
@@ -495,6 +514,12 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		this.#releaseCredentialRefreshLeaseStmt = this.#db.prepare(
 			"DELETE FROM auth_credential_refresh_leases WHERE credential_id = ? AND owner = ?",
 		);
+		this.#getCredentialStateStmt = this.#db.prepare(
+			"SELECT provider, credential_type, data, identity_key, disabled_cause FROM auth_credentials WHERE id = ?",
+		);
+		this.#holdsCredentialRefreshLeaseStmt = this.#db.prepare(
+			"SELECT 1 FROM auth_credential_refresh_leases WHERE credential_id = ? AND owner = ? AND expires_at_ms > ?",
+		);
 		this.#insertUsageHistoryStmt = this.#db.prepare(
 			"INSERT INTO usage_history (recorded_at, provider, account_key, email, account_id, limit_id, label, window_label, used_fraction, status, resets_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
 		);
@@ -1414,18 +1439,18 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		}
 	}
 
+	/**
+	 * Rewrites a row only when its persisted bytes change: an identical write would
+	 * still bump `updated_at` and `auth_change_revision`, making every peer process
+	 * reload credentials for nothing.
+	 */
 	updateAuthCredential(id: number, credential: AuthCredential): void {
 		try {
-			const providerStmt = this.#db.prepare("SELECT provider FROM auth_credentials WHERE id = ?");
-			let providerRow: { provider?: string } | undefined;
-			try {
-				providerRow = providerStmt.get(id) as { provider?: string } | undefined;
-			} finally {
-				providerStmt.finalize();
-			}
-			const provider = providerRow?.provider ?? "";
+			const row = this.#getCredentialStateStmt.get(id) as CredentialStateRow | null;
+			const provider = row?.provider ?? "";
 			const serialized = serializeCredential(provider, credential);
 			if (!serialized) return;
+			if (row && storesSerializedCredential(row, serialized)) return;
 			this.#updateStmt.run(serialized.credentialType, serialized.data, serialized.identityKey, id);
 			if (provider) {
 				this.#purgeSupersededDisabledRows(provider, this.listAuthCredentials(provider));
@@ -1441,16 +1466,20 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		credential: AuthCredential,
 		lease?: CredentialRefreshLeaseFence,
 	): boolean {
-		const providerStmt = this.#db.prepare("SELECT provider FROM auth_credentials WHERE id = ?");
-		let providerRow: { provider?: string } | undefined;
-		try {
-			providerRow = providerStmt.get(id) as { provider?: string } | undefined;
-		} finally {
-			providerStmt.finalize();
-		}
-		const provider = providerRow?.provider ?? "";
+		const row = this.#getCredentialStateStmt.get(id) as CredentialStateRow | null;
+		const provider = row?.provider ?? "";
 		const serialized = serializeCredential(provider, credential);
 		if (!serialized) return false;
+		if (
+			row &&
+			row.disabled_cause === null &&
+			serialized.data === expectedData &&
+			storesSerializedCredential(row, serialized)
+		) {
+			// The row already holds exactly this credential: the CAS (and lease fence)
+			// matches, but rewriting identical bytes would only churn the revision.
+			return !lease || Boolean(this.#holdsCredentialRefreshLeaseStmt.get(id, lease.owner, lease.nowMs));
+		}
 		const result = lease
 			? (this.#updateIfMatchesWithLeaseStmt.run(
 					serialized.credentialType,
@@ -2038,6 +2067,8 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		this.#getCredentialRefreshLeaseStmt.finalize();
 		this.#renewCredentialRefreshLeaseStmt.finalize();
 		this.#releaseCredentialRefreshLeaseStmt.finalize();
+		this.#getCredentialStateStmt.finalize();
+		this.#holdsCredentialRefreshLeaseStmt.finalize();
 		this.#db.close();
 	}
 }

package/src/auth/types.ts

@@ -581,6 +581,8 @@ export interface OAuthAccountSummary {
 	orgName?: string;
 	/** True when this account is the session-sticky OAuth credential requested by `listOAuthAccounts`. */
 	active: boolean;
+	/** Last use recorded on the session sticky; set only on the `active` account. */
+	lastUsedAtMs?: number;
 }
 /** Scope a matching-key invalidation to a session or signal. */
 export interface InvalidateCredentialMatchingOptions {

package/src/error/flags.ts

@@ -85,6 +85,8 @@ const CONTEXT_OVERFLOW_EVIDENCE_PATTERNS = [
 	/reduce the length of the messages/i, // Groq
 	/maximum context length is \d+ tokens/i, // OpenRouter (all backends)
 	/exceeds the available context size/i, // llama.cpp server
+	/\bprompt\s*\(\s*\d+\s+tokens\s*\)\s*\+\s*max\s+tokens\s*\(\s*\d+\s*\)\s+exceeds\s+the\s+context\s*\(\s*\d+\s*\)/i, // Strata server
+	/\bprompt\s*\(\s*\d+\s+tokens\s*\)\s+leaves\s+no\s+room\s+to\s+answer\s+in\s+the\s+context\s*\(\s*\d+\s*\)/i, // Strata server
 	/requested tokens?.*exceed.*context (window|length|size)/i, // llama.cpp / OpenAI-compatible local servers
 	/context (window|length|size).*(exceeded|overflow|too small)/i, // Generic local server variants
 	/(prompt|input).*(too long|too large).*(context|n_ctx)/i, // llama.cpp phrasing variants

package/src/utils/http-inspector.ts

@@ -1,5 +1,6 @@
+import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { getLogsDir, isBunTestRuntime, isRecord } from "@oh-my-pi/pi-utils";
+import { getLogsDir, isBunTestRuntime, isEnoent, isRecord, logger } from "@oh-my-pi/pi-utils";
 import * as AIError from "../error/flags";
 import { formatErrorMessageWithRetryAfter } from "./retry-after.js";
 
@@ -90,10 +91,15 @@ export async function appendRawHttpRequestDumpFor400(
 
 	const payload = buildHttp400DumpPayload(dump, error, message);
 	const fileName = `${Date.now()}-${Bun.hash(JSON.stringify(payload)).toString(36)}.json`;
-	const filePath = path.join(getLogsDir(), "http-400-requests", fileName);
+	const dumpDir = path.join(getLogsDir(), HTTP_DUMP_DIR_NAME);
+	const filePath = path.join(dumpDir, fileName);
 
 	try {
 		await Bun.write(filePath, `${JSON.stringify(payload, null, 2)}\n`);
+		// Dumps are rare; bound the directory right after adding to it.
+		pruneHttpRequestDumps(dumpDir, { keep: fileName }).catch(err => {
+			logger.warn("Failed to prune HTTP request dumps", { dir: dumpDir, err });
+		});
 		return `${message}\n${RAW_HTTP_REQUEST_LINE}${filePath}`;
 	} catch (writeError) {
 		const writeMessage = writeError instanceof Error ? writeError.message : String(writeError);
@@ -101,6 +107,60 @@ export async function appendRawHttpRequestDumpFor400(
 	}
 }
 
+const HTTP_DUMP_DIR_NAME = "http-400-requests";
+const HTTP_DUMP_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+const HTTP_DUMP_MAX_TOTAL_BYTES = 64 * 1024 * 1024;
+
+export interface HttpRequestDumpRetention {
+	/** Dump file name never deleted (the one just written and referenced by the error). */
+	keep?: string;
+	/** Dumps last modified longer ago than this are deleted (default 7 days). */
+	maxAgeMs?: number;
+	/** Oldest remaining dumps are deleted until the directory totals at most this (default 64 MiB). */
+	maxTotalBytes?: number;
+	now?: number;
+}
+
+/**
+ * Bound the rejected-request dump directory: delete `*.json` dumps older than
+ * the age limit, then the oldest survivors until the total fits the size cap.
+ */
+export async function pruneHttpRequestDumps(dir: string, retention: HttpRequestDumpRetention = {}): Promise<void> {
+	const maxAgeMs = retention.maxAgeMs ?? HTTP_DUMP_MAX_AGE_MS;
+	const maxTotalBytes = retention.maxTotalBytes ?? HTTP_DUMP_MAX_TOTAL_BYTES;
+	const now = retention.now ?? Date.now();
+	let names: string[];
+	try {
+		names = await fs.readdir(dir);
+	} catch (err) {
+		if (isEnoent(err)) return;
+		throw err;
+	}
+	const dumps: Array<{ name: string; mtimeMs: number; size: number }> = [];
+	for (const name of names) {
+		if (!name.endsWith(".json")) continue;
+		try {
+			const stat = await fs.stat(path.join(dir, name));
+			if (stat.isFile()) dumps.push({ name, mtimeMs: stat.mtimeMs, size: stat.size });
+		} catch (err) {
+			if (!isEnoent(err)) throw err;
+		}
+	}
+	dumps.sort((a, b) => b.mtimeMs - a.mtimeMs || (a.name < b.name ? 1 : a.name > b.name ? -1 : 0));
+	let retainedBytes = 0;
+	for (const dump of dumps) {
+		if (dump.name === retention.keep) {
+			retainedBytes += dump.size;
+			continue;
+		}
+		if (now - dump.mtimeMs <= maxAgeMs && retainedBytes + dump.size <= maxTotalBytes) {
+			retainedBytes += dump.size;
+			continue;
+		}
+		await fs.rm(path.join(dir, dump.name), { force: true });
+	}
+}
+
 export async function finalizeErrorMessage(
 	error: unknown,
 	rawRequestDump: RawHttpRequestDump | undefined,

package/src/utils/proxy.ts

@@ -256,10 +256,14 @@ export function installGlobalProxyFetch(): void {
 		NO_PROXY: Bun.env.NO_PROXY || Bun.env.no_proxy,
 	};
 	if (!proxyUrl) {
-		logger.debug("global proxy fetch not installed", {
-			reason: "PI_PROXY unset",
-			env,
-		});
+		// Without any proxy variable there is nothing to diagnose; skip the
+		// per-process line. When some are set, record why none was installed.
+		if (Object.values(env).some(value => value !== undefined && value !== "")) {
+			logger.debug("global proxy fetch not installed", {
+				reason: "PI_PROXY unset",
+				env,
+			});
+		}
 		return;
 	}
 	globalProxyFetchInstalled = true;