@oh-my-pi/pi-ai 18.9.1 → 18.10.0

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## [Unreleased]
 
+## [18.9.2] - 2026-10-11
+
+### Breaking Changes
+
+- Renamed `TypeSafeJudge` to `NativeJudge` and `TypeSafeApiError` to `JudgmentApiError`, including their associated option types. `JUDGMENT_ROUTES` has been removed; use `isJudgmentApi` or create a judge for catalog models with `createNativeJudge(model, { apiKey })`.
+
+### Added
+
+- Added native judge support for OpenAI’s Decisions API and Cloudflare Workers AI decision models, including the `openai-decisions` and `workers-ai-systemone` APIs. The auth gateway’s System One route supports both providers.
+- Added `createNativeJudge(model, { apiKey, headers, fetch })` for creating judges from catalog models with their configured request model IDs and question limits.
+- Added Cloudflare Workers AI authentication with `loginCloudflareWorkersAi`, storing the API token and account ID; logging in again with the same token replaces the existing credential.
+- Added automatic question batching to `NativeJudge` for endpoints with question limits, with up to four concurrent batches and merged answers and usage reporting. Usage from successful batches is reported through partial-usage callbacks and both session and auth-gateway usage ledgers, even if another batch fails.
+
+### Changed
+
+- Improved Anthropic prompt caching for long conversations, reducing memory usage while selecting cache breakpoints.
+
+### Fixed
+
+- Fixed Devin-routed OpenAI models returning `invalid_argument` on every turn after an existing session was switched from `openai-codex`.
+
 ## [18.9.1] - 2026-10-11
 
 ### Added

package/dist/types/auth-gateway/dispatch.d.ts

@@ -65,9 +65,11 @@ export declare function resolveGatewayApiKey(storage: AuthStorage, model: Model<
  *   to a sibling (usage-limit block vs credential invalidation by error class).
  *
  * `lastKey` tracks the most recent bearer so the switch step invalidates the
- * credential that actually failed. `onResolvedKey` observes every rotation;
- * routes that retain provider session state use it to re-key the account
- * lease, one-shot routes pass `undefined`.
+ * credential that actually failed; a retry context's `previousKey` wins, since
+ * concurrent operations sharing one resolver (split judgment chunks) each know
+ * the bearer they sent. `onResolvedKey` observes every rotation; routes that
+ * retain provider session state use it to re-key the account lease, one-shot
+ * routes pass `undefined`.
  */
 export declare function buildGatewayApiKeyResolver(storage: AuthStorage, model: Model<Api>, sessionId: string, initialKey: ResolvedApiKey, requestSignal: AbortSignal, format: string, peer: string, onResolvedKey?: (apiKey: string) => void): ApiKeyResolver;
 /**

package/dist/types/judgment/index.d.ts

@@ -1,5 +1,5 @@
 export * from "./chat.js";
+export * from "./native.js";
 export * from "./question-file.js";
 export * from "./text.js";
 export * from "./types.js";
-export * from "./typesafe.js";

package/dist/types/judgment/native.d.ts

@@ -0,0 +1,80 @@
+import type { Api, FetchImpl } from "@oh-my-pi/pi-catalog/types";
+import { type ApiKey } from "../auth-retry.js";
+import * as AIError from "../error/index.js";
+import type { Model, Usage } from "../types.js";
+import { type Judge, type JudgeOptions, type JudgmentRequest, type JudgmentResult, type Questions } from "./types.js";
+import type { JudgmentWire } from "./wire.js";
+export declare const TYPESAFE_PROVIDER = "typesafe";
+export declare const TYPESAFE_DEFAULT_MODEL = "jev-latest";
+declare const JUDGMENT_WIRES: {
+    readonly typesafe: JudgmentWire;
+    readonly "openrouter-decisions": JudgmentWire;
+    readonly "workers-ai-systemone": JudgmentWire;
+    readonly "openai-decisions": JudgmentWire;
+};
+/** APIs {@link NativeJudge} can serve. */
+export type JudgmentApi = keyof typeof JUDGMENT_WIRES;
+/** Whether a catalog API answers judgments natively. */
+export declare function isJudgmentApi(api: Api): api is JudgmentApi;
+/** `TYPESAFE_BASE_URL` when set, else the public API root; trailing slashes stripped. */
+export declare function typesafeBaseUrl(): string;
+/** `TYPESAFE_DEFAULT_MODEL` when set, else {@link TYPESAFE_DEFAULT_MODEL}. */
+export declare function typesafeModel(): string;
+/** Credential and transport overrides for a judge; see {@link createNativeJudge}. */
+export interface NativeJudgeConnection {
+    apiKey: ApiKey;
+    /** Static headers attached to judgment requests (e.g. proxy routing, gateway auth). */
+    headers?: Record<string, string>;
+    fetch?: FetchImpl;
+}
+export interface NativeJudgeOptions extends NativeJudgeConnection {
+    /** Wire dialect; defaults to TypeSafe's own API. */
+    api?: JudgmentApi;
+    /** Catalog provider reported on results; defaults to {@link TYPESAFE_PROVIDER}. */
+    provider?: string;
+    /** Defaults to {@link typesafeBaseUrl}. */
+    baseUrl?: string;
+    /** Wire model id; defaults to {@link typesafeModel}. */
+    model?: string;
+    /** Per-attempt timeout; defaults to {@link DEFAULT_TIMEOUT_MS}. */
+    timeoutMs?: number;
+    /**
+     * Most questions per request the endpoint accepts, a positive integer; larger
+     * requests are split. Unset: no cap.
+     */
+    maxQuestions?: number;
+}
+/** Per-call options for {@link NativeJudge.judge}. */
+export interface NativeJudgeCallOptions extends JudgeOptions {
+    /**
+     * Called before a split judgment rejects, with the summed usage of the chunks that had already
+     * succeeded: billed upstream, but their answers are discarded with the failure. Not called when
+     * no chunk succeeded or the request was not split.
+     */
+    onPartialUsage?: (usage: Usage) => void;
+}
+/** Non-2xx response from a native judgment API. */
+export declare class JudgmentApiError extends AIError.ProviderHttpError {
+    readonly name = "JudgmentApiError";
+}
+export declare class NativeJudge implements Judge {
+    #private;
+    readonly label: string;
+    readonly api: JudgmentApi;
+    readonly provider: string;
+    /** Wire model id sent with every request. */
+    readonly model: string;
+    readonly baseUrl: string;
+    constructor(options: NativeJudgeOptions);
+    judge<Q extends Questions>(request: JudgmentRequest<Q>, options?: NativeJudgeCallOptions): Promise<JudgmentResult<Q>>;
+}
+/**
+ * The {@link NativeJudge} for a catalog judge model: its API's dialect, wire id
+ * (`requestModelId ?? id`), base URL, and catalog question cap
+ * (`judgment-questions-max`). Shared by the coding agent's judge chain and the
+ * auth-gateway System One route so both address a model the same way.
+ *
+ * @throws ConfigurationError when the model's API is not a judgment API.
+ */
+export declare function createNativeJudge(model: Model, connection: NativeJudgeConnection): NativeJudge;
+export {};

package/dist/types/judgment/openai-decisions.d.ts

@@ -0,0 +1,3 @@
+import { type JudgmentWire } from "./wire.js";
+/** OpenAI's `/v1/decisions` route. */
+export declare const openaiDecisionsWire: JudgmentWire;

package/dist/types/judgment/systemone.d.ts

@@ -0,0 +1,7 @@
+import { type JudgmentWire } from "./wire.js";
+/** TypeSafe's own route, shared by every System One server. */
+export declare const typesafeWire: JudgmentWire;
+/** OpenRouter Decisions: the System One body under `/api/alpha`. */
+export declare const openrouterDecisionsWire: JudgmentWire;
+/** Cloudflare Workers AI decision models (Clef) through the account-scoped `ai/run` route. */
+export declare const workersAiWire: JudgmentWire;

package/dist/types/judgment/types.d.ts

@@ -7,7 +7,7 @@
  * — about one {@link JudgmentState}. Every question in a request sees the same
  * state and is answered independently, so callers batch independent questions
  * into one call. The shape mirrors TypeSafe's System One API so the native
- * backend ({@link TypeSafeJudge}) forwards requests verbatim, while the text
+ * backend ({@link NativeJudge}) forwards requests verbatim, while the text
  * bridge ({@link TextJudge}) renders the same questions into keyword prompts
  * for an ordinary chat model.
  */
@@ -75,7 +75,7 @@ export interface JudgmentRequest<Q extends Questions = Questions> {
     questions: Q;
 }
 export interface JudgmentResult<Q extends Questions = Questions> {
-    /** Transport that produced the answers (`typesafe`, or the chat model's api). */
+    /** Transport that produced the answers (a judgment api such as `typesafe`, or the chat model's api). */
     api: string;
     provider: string;
     model: string;

package/dist/types/judgment/wire.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Wire dialects of the native judgment APIs: how {@link NativeJudge} addresses,
+ * encodes, and decodes one request for each API it serves. Internal to the
+ * judgment module; `native.ts` maps every judgment API to its dialect.
+ */
+import type { Usage } from "../types.js";
+import type { JudgmentRequest } from "./types.js";
+/** Where one attempt posts and which bearer token it sends. */
+export interface JudgmentTarget {
+    url: string;
+    token: string;
+}
+/** One decoded response. */
+export interface DecodedJudgment {
+    /** Model that answered, when the response names one. */
+    model: string | undefined;
+    /** Wire answers keyed by question id; {@link NativeJudge} checks each against its question's type. */
+    answers: Readonly<Record<string, unknown>>;
+    /** Question ids the model declined to answer. */
+    refused: readonly string[];
+    usage: Usage;
+}
+/** How one judgment API addresses, encodes, and decodes a request. */
+export interface JudgmentWire {
+    /**
+     * Target of one attempt made with credential `key` against `model`.
+     * Throws when the credential cannot address the endpoint (e.g. no account id).
+     */
+    target(baseUrl: string, model: string, key: string): JudgmentTarget;
+    /** Request body for `model`. */
+    encode(request: JudgmentRequest, model: string): unknown;
+    /** The response's answers and usage; `undefined` when the payload is not this API's response shape. */
+    decode(payload: unknown): DecodedJudgment | undefined;
+}
+/** `value` when it is a finite number. */
+export declare function finiteNumber(value: unknown): number | undefined;

package/dist/types/providers/transform-messages.d.ts

@@ -9,6 +9,20 @@ import type { Api, AssistantMessage, Message, Model } from "../types.js";
  * MUST not push a normalized id past this bound.
  */
 export declare const MAX_TOOL_CALL_ID_LENGTH = 64;
+/**
+ * OpenAI Responses-family APIs mint composite tool ids (`call_id|item_id`);
+ * opaque Chat Completions ids do not (openai-completions preserves same-model
+ * ids verbatim as provider correlation tokens), so ONLY these origins may be
+ * canonicalized to their `call_` component for pairing.
+ */
+export declare function isResponsesFamilyApi(api: Api | undefined): boolean;
+/**
+ * The wire `call_id` component of a (possibly composite) Responses id: the
+ * FIRST segment before `|`. A degenerate `|itemId` (empty call half, pipe at
+ * index 0) keeps its full id so unrelated empty-half ids never collapse onto
+ * one empty-string bucket.
+ */
+export declare function responsesCallComponent(id: string): string;
 export declare function appendDuplicateSuffix(originalId: string, suffix: string, maxLength: number): string;
 /**
  * Whether a tool-call name cannot belong to any declared tool: missing, empty,

package/dist/types/registry/oauth/cloudflare-workers-ai.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthController } from "./types.js";
+/** Collect the Workers AI API token and account id used by CLI, setup-wizard, and TUI login callers. */
+export declare function loginCloudflareWorkersAi(options: OAuthController): Promise<string>;

package/dist/types/utils/retry-wait.d.ts

@@ -0,0 +1,9 @@
+/** Injected retry sleep: `StreamOptions.providerRetryWait` / `UsageFetchContext.retryWait`. */
+export type RetryWaitHook = (delayMs: number, signal?: AbortSignal) => Promise<void>;
+/**
+ * Waits `delayMs` between retry attempts. Honors the caller's retry-wait hook
+ * when one is set (tests and custom transports inject it to avoid real sleeps)
+ * and otherwise sleeps on `signal`, so an abort rejects instead of the retry
+ * proceeding.
+ */
+export declare function waitForRetry(retryWait: RetryWaitHook | undefined, delayMs: number, signal?: AbortSignal): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.9.1",
+	"version": "18.10.0",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,11 +155,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.9.1",
-		"@oh-my-pi/pi-catalog": "18.9.1",
-		"@oh-my-pi/pi-natives": "18.9.1",
-		"@oh-my-pi/pi-utils": "18.9.1",
-		"@oh-my-pi/pi-wire": "18.9.1"
+		"@oh-my-pi/omptype": "18.10.0",
+		"@oh-my-pi/pi-catalog": "18.10.0",
+		"@oh-my-pi/pi-natives": "18.10.0",
+		"@oh-my-pi/pi-utils": "18.10.0",
+		"@oh-my-pi/pi-wire": "18.10.0"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/auth/sqlite-credential-store.ts

@@ -9,7 +9,7 @@ import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { authPolicyFor } from "@oh-my-pi/pi-catalog/compat/auth";
 import { parseAlibabaTokenPlanCredential } from "@oh-my-pi/pi-catalog/wire/alibaba-token-plan";
-import { parseCloudflareAiGatewayCredential } from "@oh-my-pi/pi-catalog/wire/cloudflare-ai-gateway";
+import { parseCloudflareCredential } from "@oh-my-pi/pi-catalog/wire/cloudflare";
 import {
 	getAgentDbPath,
 	getDbBusyTimeoutMs,
@@ -254,9 +254,9 @@ export function matchesReplacementCredential(
 			const incomingToken = parseAlibabaTokenPlanCredential(incoming.key)?.token;
 			return existingToken !== undefined && existingToken === incomingToken;
 		}
-		if (provider === "cloudflare-ai-gateway") {
-			const existingToken = parseCloudflareAiGatewayCredential(existing.key)?.token;
-			const incomingToken = parseCloudflareAiGatewayCredential(incoming.key)?.token;
+		if (provider === "cloudflare-ai-gateway" || provider === "cloudflare-workers-ai") {
+			const existingToken = parseCloudflareCredential(existing.key)?.token;
+			const incomingToken = parseCloudflareCredential(incoming.key)?.token;
 			return existingToken !== undefined && existingToken === incomingToken;
 		}
 		return false;

package/src/auth-gateway/dispatch.ts

@@ -195,9 +195,11 @@ function modelKeyOptions(model: Model<Api>, signal: AbortSignal): AuthApiKeyOpti
  *   to a sibling (usage-limit block vs credential invalidation by error class).
  *
  * `lastKey` tracks the most recent bearer so the switch step invalidates the
- * credential that actually failed. `onResolvedKey` observes every rotation;
- * routes that retain provider session state use it to re-key the account
- * lease, one-shot routes pass `undefined`.
+ * credential that actually failed; a retry context's `previousKey` wins, since
+ * concurrent operations sharing one resolver (split judgment chunks) each know
+ * the bearer they sent. `onResolvedKey` observes every rotation; routes that
+ * retain provider session state use it to re-key the account lease, one-shot
+ * routes pass `undefined`.
  */
 export function buildGatewayApiKeyResolver(
 	storage: AuthStorage,
@@ -210,7 +212,7 @@ export function buildGatewayApiKeyResolver(
 	onResolvedKey?: (apiKey: string) => void,
 ): ApiKeyResolver {
 	let lastKey = initialKey.apiKey;
-	return async ({ lastChance, error, signal }) => {
+	return async ({ lastChance, error, signal, previousKey }) => {
 		const sig = signal ?? requestSignal;
 		if (error === undefined) {
 			lastKey = initialKey.apiKey;
@@ -231,7 +233,7 @@ export function buildGatewayApiKeyResolver(
 			model,
 			sessionId,
 			model.provider,
-			lastKey,
+			previousKey ?? lastKey,
 			error,
 			sig,
 			format,

package/src/auth-gateway/routes/systemone.ts

@@ -4,16 +4,17 @@
  *
  * Same bearer auth, model resolution, broker credential lookup, and a/b/c
  * credential rotation as the chat routes, dispatched through
- * {@link TypeSafeJudge} — pi-ai's client for this wire — so 401 rotation and
- * 429/529 backoff match omp's own judgments. A judgment is one JSON
- * round-trip: no stream, no provider session state. TypeSafe reports tokens
- * only, so the cost is priced from the catalog model for the response header
- * and the broker's observed-usage ledger.
+ * {@link NativeJudge} — pi-ai's client for every judgment API, which
+ * translates to the resolved model's own wire (OpenAI Decisions, Workers AI)
+ * — so 401 rotation and 429/529 backoff match omp's own judgments. A judgment
+ * is one JSON round-trip: no stream, no provider session state. Most judgment
+ * APIs report tokens only, so the cost is priced from the catalog model for the
+ * response header and the broker's observed-usage ledger.
  */
 import { calculateCost } from "@oh-my-pi/pi-catalog/models";
 import { logger } from "@oh-my-pi/pi-utils";
 import { classifyGatewayError } from "../../error/gateway";
-import { isJudgmentApi, TypeSafeJudge } from "../../judgment/typesafe";
+import { createNativeJudge, isJudgmentApi } from "../../judgment/native";
 import * as systemOne from "../../providers/systemone-server";
 import { deterministicUuid } from "../../utils/deterministic-id";
 import {
@@ -75,7 +76,7 @@ export async function handleSystemOne(
 	if (controller.signal.aborted) return aborted();
 	if ("status" in apiKey) return systemOne.formatError(apiKey.status, apiKey.type, apiKey.message);
 
-	const judge = new TypeSafeJudge({
+	const judge = createNativeJudge(model, {
 		apiKey: buildGatewayApiKeyResolver(
 			bootOpts.storage,
 			model,
@@ -85,10 +86,6 @@ export async function handleSystemOne(
 			"systemone",
 			peer,
 		),
-		api: model.api,
-		provider: model.provider,
-		model: model.id,
-		baseUrl: model.baseUrl,
 		fetch: bootOpts.fetch,
 	});
 
@@ -103,7 +100,14 @@ export async function handleSystemOne(
 	});
 
 	try {
-		const result = await judge.judge(parsed.request, { signal: controller.signal });
+		const result = await judge.judge(parsed.request, {
+			signal: controller.signal,
+			// A split judgment that fails still billed the chunks that succeeded.
+			onPartialUsage: usage => {
+				if (usage.cost.total === 0) calculateCost(model, usage);
+				recordGatewayUsage(bootOpts.storage, model, client, usage);
+			},
+		});
 		// Encode before pricing: the body's `cost` means "upstream billed this"
 		// (OpenRouter), while the header and ledger carry the catalog estimate
 		// when the upstream reported tokens only (TypeSafe).

package/src/judgment/index.ts

@@ -1,5 +1,5 @@
 export * from "./chat";
+export * from "./native";
 export * from "./question-file";
 export * from "./text";
 export * from "./types";
-export * from "./typesafe";