@oh-my-pi/pi-ai 18.4.9 → 18.4.10

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [18.4.10] - 2026-10-02
+
+### Fixed
+
+- Factory Droid login now reports the account's organization error instead of accepting a credential that every request rejects ([#14032](https://github.com/can1357/oh-my-pi/issues/14032)).
+- Fixed Cursor turns being aborted with "Provider stream stalled while waiting for the next event" right after a long local tool finished; the provider now gets a full idle window once local tool work completes ([#13682](https://github.com/can1357/oh-my-pi/pull/13682) by [@eggpeat](https://github.com/eggpeat))
+- Tool calls whose final argument JSON is cut off or followed by trailing text are no longer executed from an auto-closed preview. OpenAI Completions, Anthropic, Bedrock, Responses, Codex, Devin, Ollama, Apple, Cursor, GitLab Duo, and the in-band JSON dialects now give such a call the existing parse-error arguments, so the tool is not run and the model receives the parse error and can resend the call ([#13868](https://github.com/can1357/oh-my-pi/pull/13868) by [@alphastorm](https://github.com/alphastorm))
+- Fixed Cursor "prepaid balance is used up" (`USAGE_PRICING_REQUIRED`) failures repeating on the same account instead of rotating to a sibling Cursor credential ([#14053](https://github.com/can1357/oh-my-pi/issues/14053))
+- Sessions no longer get stuck on `400 string_above_max_length` after a model writes its whole tool invocation into the tool name. Tool calls with blank names, names longer than 128 characters, or names containing whitespace or control characters are dropped from replayed history, together with their tool results. This also applies when OpenAI Responses replays its stored native history ([#13985](https://github.com/can1357/oh-my-pi/pull/13985) by [@Xytronix](https://github.com/Xytronix)).
+- Fixed Bedrock Converse requests failing with a "bound to a different conversation" 400 after the system prompt changed under signed thinking: the request is retried once without replayed reasoning ([#14019](https://github.com/can1357/oh-my-pi/pull/14019) by [@nick-maderight](https://github.com/nick-maderight))
+
 ## [18.4.9] - 2026-10-01
 
 ### Fixed

package/dist/types/providers/transform-messages.d.ts

@@ -1,4 +1,11 @@
 import type { Api, AssistantMessage, Message, Model } from "../types.js";
+/**
+ * Whether a tool-call name cannot belong to any declared tool: missing, empty,
+ * longer than OpenAI's 128-character replay limit, or containing whitespace or
+ * control characters (tool schemas never allow them; their presence means the
+ * name slot carries invocation text).
+ */
+export declare function isMalformedToolCallName(name: unknown): boolean;
 /**
  * Normalize tool call ID for cross-provider compatibility.
  * OpenAI Responses API generates IDs that are 450+ chars with special characters like `|`.

package/dist/types/utils/event-stream.d.ts

@@ -2,6 +2,12 @@ import type { AssistantMessage, AssistantMessageEvent } from "../types.js";
 /** Anything a stream watchdog can consult for in-flight consumer-side local work. */
 export interface LocalWorkSource {
     readonly hasPendingLocalWork: boolean;
+    /**
+     * Epoch ms at which tracked local work last drained to zero, or 0 if none
+     * has completed. The provider cannot answer until it receives the local
+     * result, so idle watchdogs measure provider silence from this instant.
+     */
+    readonly localWorkSettledAt: number;
 }
 export declare class EventStream<T, R = T> implements AsyncIterable<T> {
     #private;
@@ -35,6 +41,8 @@ export declare class EventStream<T, R = T> implements AsyncIterable<T> {
     result(): Promise<R>;
     /** True while local work tracked via {@link trackLocalWork} — on this stream or a forwarded delegate — is pending. */
     get hasPendingLocalWork(): boolean;
+    /** Latest {@link LocalWorkSource.localWorkSettledAt} across this stream and a forwarded delegate. */
+    get localWorkSettledAt(): number;
     /**
      * Count `source`'s pending local work as this stream's own. Used when this
      * stream forwards another's events (Cursor discovered-id retry) so the

package/dist/types/utils/idle-iterator.d.ts

@@ -1,3 +1,4 @@
+import type { LocalWorkSource } from "./event-stream.js";
 /**
  * Returns the idle timeout used for provider streaming transports.
  *
@@ -86,15 +87,17 @@ export interface IdleTimeoutIteratorOptions {
      */
     isProgressItem?: (item: unknown) => boolean;
     /**
-     * Reports consumer-side local work in flight for the stream: the provider
-     * transport is waiting on a server-requested local tool bridge (e.g. the
-     * Cursor exec channel) before anything can flow upstream again. While it
-     * returns true, an expired idle / first-item deadline slides forward
-     * instead of aborting — the silence is ours, not a provider stall. The
-     * watchdog re-arms with a full budget once the local work completes, so a
-     * provider that stalls afterwards is still caught.
+     * Consumer-side local work in flight for the stream: the provider transport
+     * is waiting on a server-requested local tool bridge (e.g. the Cursor exec
+     * channel) before anything can flow upstream again. While work is pending,
+     * an expired idle / first-item deadline slides forward instead of aborting —
+     * the silence is ours, not a provider stall. The provider cannot respond
+     * before it receives the local result, so both deadlines are measured from
+     * no earlier than `localWorkSettledAt`: a tool that finishes just before the
+     * deadline gets a full budget, and a provider that stalls afterwards is
+     * still caught.
      */
-    hasPendingLocalWork?: () => boolean;
+    localWork?: LocalWorkSource;
     /**
      * Cancel iteration as soon as this signal aborts. Required for caller-driven
      * cancellation (ESC) when the underlying transport does not surface signal

package/dist/types/utils/tool-call-arguments.d.ts

@@ -0,0 +1,9 @@
+import type { ToolCall } from "../types.js";
+/** Final arguments must not reuse the streaming parser's auto-closed preview. */
+export declare function parseToolCallArguments(json: string | undefined): ToolCall["arguments"];
+/** Longest raw argument text kept in the parse-error diagnostic. */
+export declare const INVALID_ARGUMENTS_RAW_LIMIT = 512;
+/** Bound raw argument text for a diagnostic. Text this function already bounded is returned unchanged. */
+export declare function boundRawToolArguments(raw: string): string;
+/** Preserve a bounded diagnostic, never any partially recovered executable keys. */
+export declare function invalidToolCallArguments(raw: string, error: unknown): ToolCall["arguments"];

package/dist/types/utils.d.ts

@@ -63,6 +63,22 @@ export declare function sanitizeOpenAIResponsesAssistantHistoryItemsForReplay(it
  * Drop hidden-only fallback assistant replay after a native Responses snapshot is rejected.
  */
 export declare function sanitizeOpenAIResponsesAssistantFallbackItemsForReplay(items: ResponseInput): ResponseInput;
+/**
+ * Drop each native tool call with a malformed name and only the matching
+ * `function_call_output` / `custom_tool_call_output` in the same window.
+ *
+ * `call_id` is not unique across a snapshot. Pair the same way
+ * `sanitizeMalformedToolCalls` does for transcript messages: a per-id FIFO of
+ * malformed-ness, keyed by function vs custom, cleared at user/developer and
+ * other non-result client boundaries so a missing result cannot eat the next
+ * window's output. Returns `items` itself when nothing is malformed.
+ */
+export declare function dropMalformedOpenAIResponsesToolCalls<T extends {
+    type?: unknown;
+    call_id?: unknown;
+    name?: unknown;
+    role?: unknown;
+}>(items: readonly T[]): T[];
 export declare function createOpenAIResponsesHistoryPayload(provider: string, items: Array<Record<string, unknown>>, incremental?: boolean): OpenAIResponsesHistoryPayload;
 export declare function getOpenAIResponsesHistoryPayload(providerPayload: ProviderPayload | undefined, currentProvider: string, fallbackProvider?: string): OpenAIResponsesHistoryPayload | undefined;
 export declare function getOpenAIResponsesHistoryItems(providerPayload: ProviderPayload | undefined, currentProvider: string, fallbackProvider?: string): Array<Record<string, unknown>> | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.4.9",
+	"version": "18.4.10",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,11 +155,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.4.9",
-		"@oh-my-pi/pi-catalog": "18.4.9",
-		"@oh-my-pi/pi-natives": "18.4.9",
-		"@oh-my-pi/pi-utils": "18.4.9",
-		"@oh-my-pi/pi-wire": "18.4.9"
+		"@oh-my-pi/omptype": "18.4.10",
+		"@oh-my-pi/pi-catalog": "18.4.10",
+		"@oh-my-pi/pi-natives": "18.4.10",
+		"@oh-my-pi/pi-utils": "18.4.10",
+		"@oh-my-pi/pi-wire": "18.4.10"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/dialect/deepseek.ts

@@ -1,5 +1,6 @@
 import { parseJsonWithRepair } from "@oh-my-pi/pi-utils";
 import type { Message, ToolCall } from "../types";
+import { parseToolCallArguments } from "../utils/tool-call-arguments";
 import { asRecord, mintToolCallId, partialSuffixOverlapAny } from "./coercion";
 import dialectPrompt from "./deepseek.md" with { type: "text" };
 import { assistantTranscriptParts, collectToolResultRun, messageContentText, stringifyJson } from "./rendering";
@@ -477,11 +478,7 @@ export class DeepSeekInbandScanner implements InbandScanner {
 	#parseArgs(rawArgs: string): Record<string, unknown> {
 		const trimmed = rawArgs.trim();
 		if (trimmed.length === 0) return {};
-		try {
-			return asRecord(parseJsonWithRepair<unknown>(trimmed));
-		} catch {
-			return {};
-		}
+		return asRecord(parseToolCallArguments(trimmed));
 	}
 
 	#skipWhitespace(): string {

package/src/dialect/harmony.ts

@@ -1,5 +1,5 @@
-import { parseJsonWithRepair } from "@oh-my-pi/pi-utils";
 import type { Message, ToolCall } from "../types";
+import { parseToolCallArguments } from "../utils/tool-call-arguments";
 import { asRecord, mintToolCallId, partialSuffixOverlapAny } from "./coercion";
 import dialectPrompt from "./harmony.md" with { type: "text" };
 import {
@@ -225,11 +225,7 @@ export class HarmonyInbandScanner implements InbandScanner {
 	#parseArgs(): Record<string, unknown> {
 		const raw = this.#toolArgs.trim();
 		if (raw.length === 0) return {};
-		try {
-			return asRecord(parseJsonWithRepair<unknown>(raw));
-		} catch {
-			return {};
-		}
+		return asRecord(parseToolCallArguments(raw));
 	}
 
 	#clearBody(resetRawBlock = true): void {

package/src/dialect/hermes.ts

@@ -1,5 +1,6 @@
 import { parseJsonWithRepair, parseStreamingJson } from "@oh-my-pi/pi-utils";
 import type { Message, ToolCall } from "../types";
+import { parseToolCallArguments } from "../utils/tool-call-arguments";
 import { asRecord, mintToolCallId, partialSuffixOverlapAny } from "./coercion";
 import dialectPrompt from "./hermes.md" with { type: "text" };
 import { renderChatMlTranscript, renderDelimitedThinking, renderToolResponseResults, stringifyJson } from "./rendering";
@@ -147,11 +148,7 @@ export class HermesInbandScanner implements InbandScanner {
 			if (typeof parsed.name !== "string" || parsed.name.length === 0) return undefined;
 			let args = parsed.arguments;
 			if (typeof args === "string") {
-				try {
-					args = parseJsonWithRepair<unknown>(args);
-				} catch {
-					args = {};
-				}
+				args = parseToolCallArguments(args);
 			}
 			return { name: parsed.name, arguments: asRecord(args) };
 		} catch {

package/src/dialect/kimi.ts

@@ -1,5 +1,5 @@
-import { parseJsonWithRepair } from "@oh-my-pi/pi-utils";
 import type { Message, ToolCall } from "../types";
+import { parseToolCallArguments } from "../utils/tool-call-arguments";
 import { asRecord, normalizeKimiFunctionName, partialSuffixOverlapAny } from "./coercion";
 import dialectPrompt from "./kimi.md" with { type: "text" };
 import { assistantTranscriptParts, collectToolResultRun, messageContentText, stringifyJson } from "./rendering";
@@ -212,11 +212,7 @@ export class KimiInbandScanner implements InbandScanner {
 
 	#parseArgs(rawArgs: string): Record<string, unknown> {
 		if (rawArgs.length === 0) return {};
-		try {
-			return asRecord(parseJsonWithRepair<unknown>(rawArgs));
-		} catch {
-			return {};
-		}
+		return asRecord(parseToolCallArguments(rawArgs));
 	}
 
 	#nextTokenIndex(): number {

package/src/dialect/owned-stream.ts

@@ -13,6 +13,7 @@ import {
 	setStreamingPartialJson,
 } from "../utils/block-symbols";
 import { AssistantMessageEventStream } from "../utils/event-stream";
+import { INVALID_ARGUMENTS_RAW_LIMIT, invalidToolCallArguments } from "../utils/tool-call-arguments";
 import { buildStringArgsResolver } from "./coercion";
 import { createInbandScanner } from "./factory";
 import type { Dialect, InbandScanEvent, InbandScanner, InbandTool } from "./types";
@@ -180,6 +181,9 @@ class InbandStreamProjector {
 	#fedLen = 0;
 	#stopped = false;
 	#responsePending = "";
+	// Bounded tail of the text actually fed to the scanner: the diagnostic for an
+	// unfinished envelope, which excludes anything cut off after a response token.
+	#scannerTail = "";
 	// Provider-native tool calls forwarded live (e.g. Gemini still returns
 	// `functionCall` parts under owned mode), keyed by the inner stream's
 	// `contentIndex`. `#toolChannel` records which channel produced the turn's
@@ -291,7 +295,7 @@ class InbandStreamProjector {
 		const responseIndex = firstTokenIndex(combined, this.#responseOpenTokens);
 		if (responseIndex !== -1) {
 			this.#responsePending = "";
-			this.#apply(this.#scanner.feed(combined.slice(0, responseIndex)));
+			this.#apply(this.#feedScanner(combined.slice(0, responseIndex)));
 			this.#stopped = true;
 			return true;
 		}
@@ -303,7 +307,7 @@ class InbandStreamProjector {
 
 		const emitLength = combined.length - this.#responseOverlapLength;
 		this.#responsePending = combined.slice(emitLength);
-		this.#apply(this.#scanner.feed(combined.slice(0, emitLength)));
+		this.#apply(this.#feedScanner(combined.slice(0, emitLength)));
 		return false;
 	}
 
@@ -339,10 +343,26 @@ class InbandStreamProjector {
 		for (const block of message.content) if (block.type === "text") fullText += block.text;
 		if (!this.#stopped && fullText.length > this.#fedLen) this.text(fullText.slice(this.#fedLen));
 		if (!this.#stopped && this.#responsePending.length > 0) {
-			this.#apply(this.#scanner.feed(this.#responsePending));
+			this.#apply(this.#feedScanner(this.#responsePending));
 			this.#responsePending = "";
 		}
 		this.#apply(this.#scanner.flush());
+		// Scanners discard incomplete envelopes, but their toolStart previews already
+		// live in the message. Refuse those calls instead of executing partial fields.
+		// The unfinished envelope ends the scanner-fed text, so the diagnostic keeps
+		// that tail rather than any prose before the call.
+		for (const entry of this.#toolBlocks.values()) {
+			entry.block.arguments = invalidToolCallArguments(this.#scannerTail, "Incomplete in-band tool call");
+			if (this.#emitEvents) {
+				this.#out.push({
+					type: "toolcall_end",
+					contentIndex: entry.index,
+					toolCall: entry.block,
+					partial: this.#partial,
+				});
+			}
+		}
+		this.#toolBlocks.clear();
 		this.#closeText();
 		this.#closeThinking();
 		const hasTools = this.#partial.content.some(block => block.type === "toolCall");
@@ -353,6 +373,11 @@ class InbandStreamProjector {
 		return finalMessage;
 	}
 
+	#feedScanner(text: string): InbandScanEvent[] {
+		this.#scannerTail = (this.#scannerTail + text).slice(-INVALID_ARGUMENTS_RAW_LIMIT);
+		return this.#scanner.feed(text);
+	}
+
 	#apply(events: InbandScanEvent[]): void {
 		for (const event of events) {
 			switch (event.type) {

package/src/dialect/qwen3.ts

@@ -1,5 +1,6 @@
 import { parseJsonWithRepair } from "@oh-my-pi/pi-utils";
 import type { Message, ToolCall } from "../types";
+import { parseToolCallArguments } from "../utils/tool-call-arguments";
 import { asRecord, mintToolCallId, partialSuffixOverlapAny } from "./coercion";
 import dialectPrompt from "./qwen3.md" with { type: "text" };
 import { renderChatMlTranscript, renderToolResponseResults, stringifyJson } from "./rendering";
@@ -180,11 +181,7 @@ export class Qwen3InbandScanner implements InbandScanner {
 			if (typeof parsed.name !== "string" || parsed.name.length === 0) return undefined;
 			let args = parsed.arguments;
 			if (typeof args === "string") {
-				try {
-					args = parseJsonWithRepair<unknown>(args);
-				} catch {
-					args = {};
-				}
+				args = parseToolCallArguments(args);
 			}
 			return { name: parsed.name, arguments: asRecord(args) };
 		} catch {

package/src/error/rate-limit.ts

@@ -37,6 +37,12 @@ const CREDITS_EXHAUSTED_PATTERN =
 // in unrelated diagnostics ("Failed to fetch usage credits from billing
 // service"), which must not rotate a healthy credential.
 const ANTHROPIC_CREDITS_REQUIRED_PATTERN = /\busage credits are required\b|\bcredits_required\b/i;
+// Prepaid-balance exhaustion: Cursor ERROR_USAGE_PRICING_REQUIRED (code 44,
+// surfaced as 429) "Your prepaid balance is used up: Add funds or enable auto
+// top-up …". Account-local until topped up, so rotate to a sibling. The `\b`
+// after the code keeps USAGE_PRICING_REQUIRED_CHANGEABLE out.
+const PREPAID_BALANCE_EXHAUSTED_PATTERN =
+	/\busage_pricing_required\b|\bprepaid balance\b[^\n]{0,40}\b(?:used up|exhausted|depleted)\b/i;
 // Account billing ceilings: Anthropic "monthly spend limit" (#4787) and Google
 // "Your project has exceeded its monthly spending cap" (#13090). The `\b` after
 // `cap` keeps "spending capacity" — a throttle, not a billing ceiling — out.
@@ -260,6 +266,10 @@ export function parseRateLimitReason(errorMessage: string): RateLimitReason {
 		return "QUOTA_EXHAUSTED";
 	}
 
+	if (PREPAID_BALANCE_EXHAUSTED_PATTERN.test(errorMessage)) {
+		return "QUOTA_EXHAUSTED";
+	}
+
 	if (
 		lower.includes("per minute") ||
 		lower.includes("rate limit") ||
@@ -434,6 +444,7 @@ export function matchesUsageLimitText(errorMessage: string): boolean {
 	return (
 		USAGE_LIMIT_PATTERN.test(errorMessage) ||
 		ANTHROPIC_CREDITS_REQUIRED_PATTERN.test(errorMessage) ||
+		PREPAID_BALANCE_EXHAUSTED_PATTERN.test(errorMessage) ||
 		CREDITS_EXHAUSTED_PATTERN.test(errorMessage) ||
 		(CN_QUOTA_EXHAUSTED_PATTERN.test(errorMessage) && !CN_TRANSIENT_CAP_PATTERN.test(errorMessage)) ||
 		SPEND_LIMIT_PATTERN.test(errorMessage) ||

package/src/providers/amazon-bedrock.ts

@@ -13,16 +13,10 @@
 import type { Effort } from "@oh-my-pi/pi-catalog/effort";
 import { mapEffortToAnthropicAdaptiveEffort, requireSupportedEffort } from "@oh-my-pi/pi-catalog/model-thinking";
 import { calculateCost } from "@oh-my-pi/pi-catalog/models";
-import {
-	$flag,
-	fetchWithRetry,
-	logger,
-	parseStreamingJson,
-	parseStreamingJsonThrottled,
-	USER_AGENT,
-} from "@oh-my-pi/pi-utils";
+import { $flag, fetchWithRetry, logger, parseStreamingJsonThrottled, USER_AGENT } from "@oh-my-pi/pi-utils";
 import { renderDemotedThinking } from "../dialect/demotion";
 import * as AIError from "../error";
+import { parseToolCallArguments } from "../utils/tool-call-arguments";
 import { resolveAwsBearerToken } from "../registry/aws";
 import type {
 	Api,
@@ -55,6 +49,7 @@ import { toolWireSchema } from "../utils/schema/wire";
 import { invalidateAwsCredentialCache, resolveAwsCredentials } from "./aws-credentials";
 import { decodeEventStream } from "./aws-eventstream";
 import { signRequest } from "./aws-sigv4";
+import { isThinkingPrefixBindingError } from "./anthropic";
 import { parseAnthropicInputTransformations, THINKING_BINDING_CONTROLS_BETA } from "./anthropic-wire";
 import { isBedrockRequestMetadataValue } from "./bedrock-request-metadata";
 import { transformMessages } from "./transform-messages";
@@ -509,17 +504,7 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 			const urlPath = `${base.pathname.replace(/\/+$/, "")}/model/${encodeURIComponent(model.id)}/converse-stream`;
 			const query = base.search.slice(1) || undefined;
 			const url = `${base.origin}${urlPath}${base.search}`;
-			rawRequestDump = {
-				provider: model.provider,
-				api: output.api,
-				model: model.id,
-				method: "POST",
-				url,
-				body: commandInput,
-			};
 
-			const bodyText = JSON.stringify(commandInput);
-			const body = new TextEncoder().encode(bodyText);
 			// Caller headers are merged BEFORE signing, so SigV4 covers them and they
 			// reach the wire. Bedrock built its header map from scratch and ignored
 			// `options.headers` entirely, so tracing/attribution headers set by a
@@ -559,37 +544,7 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 				"content-type": "application/json",
 				accept: "application/vnd.amazon.eventstream",
 			};
-
 			const bearerToken = resolveBearerToken(options);
-			let requestHeaders: Record<string, string>;
-			if (bearerToken) {
-				requestHeaders = { ...baseHeaders, Authorization: `Bearer ${bearerToken}` };
-			} else {
-				let credentials: { accessKeyId: string; secretAccessKey: string; sessionToken?: string };
-				if ($flag("AWS_BEDROCK_SKIP_AUTH")) {
-					credentials = { accessKeyId: "dummy-access-key", secretAccessKey: "dummy-secret-key" };
-				} else {
-					credentials = await resolveAwsCredentials({
-						profile: options.profile,
-						region,
-						signal: options.signal,
-						fetch: options.fetch,
-					});
-				}
-				const signed = await signRequest({
-					method: "POST",
-					host,
-					path: urlPath,
-					query,
-					body,
-					region,
-					service: "bedrock",
-					credentials,
-					headers: baseHeaders,
-				});
-				requestHeaders = { ...baseHeaders, ...signed };
-			}
-
 			// Bun's native fetch ceiling is disabled below (`timeout: false`) so
 			// configurable watchdogs govern slow-prefill streams (issue #2422).
 			// Direct callers that bypass `register-builtins` (which installs the
@@ -600,35 +555,92 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 			// Clear the pre-response timer the instant headers arrive (below): an
 			// absolute `AbortSignal.timeout` would keep aborting the actively
 			// streaming body, not just a stalled time-to-first-byte (issue #2422).
-			const watchdog = armPreResponseTimeout(options.signal, firstEventTimeoutMs);
-			let response: Response;
-			try {
-				response = await fetchWithRetry(url, {
+			const sendRequest = async (input: ConverseStreamRequest): Promise<Response> => {
+				const bodyText = JSON.stringify(input);
+				const body = new TextEncoder().encode(bodyText);
+				let requestHeaders: Record<string, string>;
+				if (bearerToken) {
+					requestHeaders = { ...baseHeaders, Authorization: `Bearer ${bearerToken}` };
+				} else {
+					let credentials: { accessKeyId: string; secretAccessKey: string; sessionToken?: string };
+					if ($flag("AWS_BEDROCK_SKIP_AUTH")) {
+						credentials = { accessKeyId: "dummy-access-key", secretAccessKey: "dummy-secret-key" };
+					} else {
+						credentials = await resolveAwsCredentials({
+							profile: options.profile,
+							region,
+							signal: options.signal,
+							fetch: options.fetch,
+						});
+					}
+					const signed = await signRequest({
+						method: "POST",
+						host,
+						path: urlPath,
+						query,
+						body,
+						region,
+						service: "bedrock",
+						credentials,
+						headers: baseHeaders,
+					});
+					requestHeaders = { ...baseHeaders, ...signed };
+				}
+				rawRequestDump = {
+					provider: model.provider,
+					api: output.api,
+					model: model.id,
 					method: "POST",
-					headers: requestHeaders,
-					body,
-					signal: watchdog.signal,
-					fetch: options.fetch,
-					timeout: false,
-				});
-			} finally {
-				watchdog.clear();
-			}
+					url,
+					body: input,
+				};
+				const watchdog = armPreResponseTimeout(options.signal, firstEventTimeoutMs);
+				try {
+					return await fetchWithRetry(url, {
+						method: "POST",
+						headers: requestHeaders,
+						body,
+						signal: watchdog.signal,
+						fetch: options.fetch,
+						timeout: false,
+					});
+				} finally {
+					watchdog.clear();
+				}
+			};
 
-			if (!response.ok) {
+			let prefixBindingRetryAttempted = false;
+			let response: Response;
+			while (true) {
+				response = await sendRequest(commandInput);
+				if (response.ok) break;
 				if (!bearerToken && (response.status === 401 || response.status === 403)) {
 					// Stale cached credentials (e.g. rotated session keys in ~/.aws/credentials) —
 					// drop the cache entry so the next attempt re-resolves from scratch.
 					invalidateAwsCredentialCache({ profile: options.profile, region });
 				}
 				const errBody = await response.text().catch(() => "");
-				throw new AIError.BedrockApiError(
-					`Bedrock HTTP ${response.status}: ${errBody.slice(0, 1000)}`,
-					response.status,
-					{
-						headers: response.headers,
-					},
-				);
+				const errorMessage = `Bedrock HTTP ${response.status}: ${errBody.slice(0, 1000)}`;
+				if (
+					!prefixBindingRetryAttempted &&
+					options.anthropicPrefixMismatchBehavior !== "error" &&
+					isThinkingPrefixBindingError(errorMessage)
+				) {
+					prefixBindingRetryAttempted = true;
+					logger.warn("bedrock: thinking prefix changed, stripping bound thinking and retrying", {
+						provider: model.provider,
+						model: model.id,
+						baseUrl: base.origin,
+					});
+					commandInput = {
+						...commandInput,
+						messages: dropBedrockReasoningContent(commandInput.messages),
+					};
+					continue;
+				}
+				throw new AIError.BedrockApiError(errorMessage, response.status, {
+					headers: response.headers,
+				});
 			}
 			if (!response.body) throw new AIError.BedrockApiError("Bedrock response has no body", response.status);
 
@@ -752,6 +764,12 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 				throw new AIError.BedrockApiError(output.errorMessage ?? "An unknown error occurred", 0);
 			}
 
+			for (const [contentBlockIndex, index] of contentIndexByBlockIndex) {
+				const block = blocks[index];
+				if (block?.type === "toolCall" && block[kStreamingPartialJson] !== undefined) {
+					handleContentBlockStop({ contentBlockIndex }, blocks, contentIndexByBlockIndex, output, stream);
+				}
+			}
 			output.duration = performance.now() - startTime;
 			if (firstTokenTime) output.ttft = firstTokenTime - startTime;
 			stream.push({ type: "done", reason: output.stopReason, message: output });
@@ -957,7 +975,7 @@ function handleContentBlockStop(
 			stream.push({ type: "thinking_end", contentIndex: index, content: block.thinking, partial: output });
 			break;
 		case "toolCall":
-			block.arguments = parseStreamingJson(block[kStreamingPartialJson]);
+			block.arguments = parseToolCallArguments(block[kStreamingPartialJson]);
 			clearStreamingPartialJson(block);
 			stream.push({ type: "toolcall_end", contentIndex: index, toolCall: block, partial: output });
 			break;
@@ -1190,6 +1208,19 @@ function convertMessages(
 	return result;
 }
 
+function dropBedrockReasoningContent(messages: WireMessage[]): WireMessage[] {
+	const filtered: WireMessage[] = [];
+	for (const message of messages) {
+		if (message.role !== "assistant") {
+			filtered.push(message);
+			continue;
+		}
+		const content = message.content.filter(block => !("reasoningContent" in block));
+		if (content.length > 0) filtered.push({ ...message, content });
+	}
+	return filtered;
+}
+
 function messagesHaveToolBlocks(messages: WireMessage[]): boolean {
 	for (const message of messages) {
 		for (const block of message.content) {

package/src/providers/anthropic.ts

@@ -18,6 +18,7 @@ import {
 import { NO_AUTH_SENTINEL } from "../auth-retry";
 import { renderDemotedThinking } from "../dialect/demotion";
 import * as AIError from "../error";
+import { parseToolCallArguments } from "../utils/tool-call-arguments";
 import { getEnvApiKey, OUTPUT_FALLBACK_BUFFER } from "../stream";
 import type {
 	AnthropicCompactionPayload,
@@ -2391,26 +2392,12 @@ const streamAnthropicOnce = (
 						block[kStreamingPartialJson].length > 0
 							? block[kStreamingPartialJson]
 							: JSON.stringify(block.arguments ?? {});
-					try {
-						block.arguments = parseJsonWithRepair(finalJson) as ToolCall["arguments"];
-					} catch (parseError) {
-						// Non-fatal: keep the best-effort arguments recovered by the throttled streaming
-						// parser instead of failing the turn on malformed/truncated tool-argument JSON.
+					// Keep malformed calls non-fatal, but never execute their auto-closed previews.
+					block.arguments = parseToolCallArguments(finalJson);
+					if (isRecord(block.arguments) && "__parseError" in block.arguments) {
 						reportAnthropicEnvelopeAnomaly(
-							`tool_use ${block.id} arguments are not valid JSON: ${parseError instanceof Error ? parseError.message : String(parseError)}`,
+							`tool_use ${block.id} arguments are not valid JSON: ${block.arguments.__parseError}`,
 						);
-						const recoveredKeys = Object.keys(block.arguments ?? {});
-						if (recoveredKeys.length === 0) {
-							const maxLen = 512;
-							const truncatedJson =
-								finalJson.length <= maxLen
-									? finalJson
-									: `${finalJson.slice(0, maxLen)}… [truncated ${finalJson.length - maxLen} chars]`;
-							block.arguments = {
-								__parseError: parseError instanceof Error ? parseError.message : String(parseError),
-								__rawJson: truncatedJson,
-							};
-						}
 					}
 					clearStreamingPartialJson(block);
 					stream.push({ type: "toolcall_end", contentIndex, toolCall: block, partial: output });

package/src/providers/apple-foundation-models.ts

@@ -13,6 +13,7 @@ import type { Effort } from "@oh-my-pi/pi-catalog/effort";
 import { appleFmAvailability, appleFmCancel, appleFmGenerate } from "@oh-my-pi/pi-natives";
 import { parseStreamingJson } from "@oh-my-pi/pi-utils";
 import * as AIError from "../error";
+import { parseToolCallArguments } from "../utils/tool-call-arguments";
 import type {
 	AssistantMessage,
 	Context,
@@ -367,7 +368,7 @@ export const streamAppleFoundationModels: StreamFunction<"apple-foundation-model
 			for (const index of toolIndices.values()) {
 				const block = output.content[index] as ToolCallBlock;
 				block.arguments = decodeFoundationModelsArguments(
-					parseStreamingJson<Record<string, unknown>>(block[kStreamingPartialJson] ?? ""),
+					parseToolCallArguments(block[kStreamingPartialJson]),
 					encodedPaths.get(block.name) ?? [],
 				);
 				clearStreamingPartialJson(block);