jeopi-ai 16.4.2 → 16.4.4

package/CHANGELOG.md

@@ -2,6 +2,34 @@
 
 ## [Unreleased]
 
+## [16.4.4] - 2026-08-03
+
+### Fixed
+
+- Escaped OAuth callback state before embedding it in the HTML script payload, preventing callback error text from breaking out of the response document.
+
+## [16.4.3] - 2026-07-22
+
+### Added
+
+- Added diagnostic response headers to auth-gateway inference endpoints: `x-request-id`/`request-id` (correlates with gateway logs; surfaced by OpenAI/Anthropic SDKs) and LiteLLM-style `x-litellm-model-id`/`x-litellm-model-api-base` on every response, plus `x-litellm-response-cost`, `x-litellm-response-duration-ms`, and `openai-processing-ms` on non-streaming responses. Ported from oh-my-pi (upstream `3e5b7da6f`).
+- Added Cursor OAuth and access-token usage reporting to `jeopi usage` via Cursor's account usage endpoint. Ported from oh-my-pi (upstream `965f5b0bb`).
+
+### Fixed
+
+- OpenAI Responses server non-streaming envelopes always include the required `incomplete_details` field now, using `null` for completed responses instead of omitting the key. Ported from oh-my-pi (upstream `3188506e6`).
+- Responses API tool results with genuinely empty content (e.g. an empty file read) no longer serialize as `"(see attached image)"` — the placeholder is now only emitted when the result actually carries an image block. Ported from oh-my-pi (upstream `31c9f4850`).
+- Preserved Cloud Code Assist tool schemas when mixed-type unions carry branch-local validation descriptions: a differing `description` between merged union variants (or between the merged variant and the parent schema) now concatenates instead of aborting the collapse and leaving the schema on the incompatible `anyOf`/`oneOf` shape. Ported from oh-my-pi (upstream `3f52e26a7`).
+- Fixed OAuth credential resolution returning "No API key found" when the only Pro-eligible OpenAI Codex account was usage-blocked and the sole unblocked account failed the model's Pro gate: resolution now runs a last-resort ladder that first yields a Pro-fitting account regardless of usage blocks (so callers get real usage-limit retry semantics instead of a missing key), then tries every account with the Pro filter dropped before reporting no credential. Ported from oh-my-pi (upstream `7cef4a769`, adapted to jeopi's Pro-only `enforceProRequirement` gate — jeopi has not adopted upstream's more general multi-tier `planRequirement` abstraction this fix originally targeted).
+- Fixed empty provider responses (e.g. "Cloud Code Assist API returned an empty response") being classified as non-retryable: `ProviderResponseError` with kind `empty-body` now carries the transient flag, so session retry and configured model-fallback chains engage instead of hard-failing the turn. Ported from oh-my-pi (upstream `fabded89e`).
+- Fixed the OAuth completion page copy to tell users they can close the tab manually when browsers such as Firefox ignore best-effort `window.close()` calls. Ported from oh-my-pi (upstream `5e781a9c7`).
+- Fixed Cursor `max_mode` requests to send discovered max-mode metadata on both model payload fields (`modelDetails.maxMode` and the new `requestedModel`), so premium models that require max mode no longer silently run without it. Ported from oh-my-pi (upstream `358811115`).
+- Fixed provider credential changes leaving persisted session-sticky OAuth credential mappings active, so existing sessions reselect accounts after login/logout instead of reusing stale `session:sticky:<provider>:<sessionId>` rows: `#resetProviderAssignments` (called on every credential add/remove/login) now also purges every persisted sticky cache row for that provider via a new `deleteCachePrefix` store method, implemented for both `SqliteAuthCredentialStore` (SQL `substr` prefix match) and `RemoteAuthCredentialStore` (in-memory prefix scan). Other providers' sticky rows are untouched. Ported from oh-my-pi (upstream `7029789e7`).
+- Fixed Codex saved-reset redemption to include the selected account in the consume request body, so `/usage reset` applies to the chosen OpenAI account in multi-account setups instead of an ambiguous default. Ported from oh-my-pi (upstream `1d9889810`).
+- Fixed OpenAI Responses `content_filter` terminal events being auto-retried as provider finish errors; `kind: "content-blocked"` provider errors now classify under a dedicated `Flag.ContentBlocked` (kept out of the retriable set) instead of reusing `Flag.ProviderFinishError` (which is retriable), so a safety-filter block stays a hard failure without a same-model retry loop. Ported from oh-my-pi (upstream `c95a2b993` by @belchetz).
+- Fixed OpenAI Chat Completions request parsing to accept assistant tool-call replay messages with `content: null` as absent content, instead of rejecting the whole request when a client (or the gateway's own prior response) round-trips a `null` content field alongside `tool_calls`. Ported from oh-my-pi (upstream `38af95646`).
+- Fixed auth-broker config discovery to accept nested `auth.broker.url` and `auth.broker.token` YAML keys from either `config.yml` or `config.yaml`, while preserving the legacy flat dotted form (nested values win). ([#4734](https://github.com/can1357/oh-my-pi/issues/4734), upstream `b190a3c15` and `5c16dcb15`).
+
 ## [16.2.28] - 2026-07-08
 
 ### Fixed

package/dist/types/auth-broker/discover.d.ts

@@ -19,7 +19,8 @@ export declare function getAuthBrokerTokenFilePath(): string;
  * Resolve broker connection configuration using the same precedence as the TUI:
  *
  * 1. `JEOPI_AUTH_BROKER_URL` / `JEOPI_AUTH_BROKER_TOKEN` env vars.
- * 2. `auth.broker.url` / `auth.broker.token` in `<agentDir>/config.yml`.
+ * 2. `auth.broker.url` / `auth.broker.token` in `<agentDir>/config.yml` or
+ *    `<agentDir>/config.yaml`.
  * 3. `<config-root>/auth-broker.token` file (paired with a URL from env/config).
  *
  * Returns `null` when no broker URL is configured — callers should fall back to

package/dist/types/auth-broker/remote-store.d.ts

@@ -73,6 +73,8 @@ export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
     deleteAuthCredentialsRemote(provider: string, disabledCause: string): Promise<void>;
     getCache(key: string): string | null;
     setCache(key: string, value: string, expiresAtSec: number): void;
+    /** Drop all cache rows whose keys start with the supplied prefix. */
+    deleteCachePrefix(prefix: string): void;
     cleanExpiredCache(): void;
     /**
      * Store-level hook consumed by `AuthStorage` — routes refresh through the

package/dist/types/auth-gateway/http.d.ts

@@ -1,4 +1,21 @@
-export declare function json(status: number, body: unknown): Response;
+import type { Api, AssistantMessage, Model } from "../types";
+export declare function json(status: number, body: unknown, headers?: Record<string, string>): Response;
+/**
+ * Diagnostic response headers for translated inference requests, mirroring the
+ * names existing gateway-aware clients already parse: `x-request-id` /
+ * `request-id` (surfaced as `_request_id` by the OpenAI and Anthropic SDKs,
+ * matches the gateway log line), LiteLLM's model-resolution and cost headers,
+ * and OpenAI's `openai-processing-ms`. Model/request-id headers are always
+ * present; `message` — the final assistant message, available only on
+ * non-streaming responses — adds the computed cost, and `startedAt` the wall
+ * time. Streaming responses send headers before usage exists, so they carry
+ * only the identity headers.
+ */
+export declare function gatewayResponseHeaders(model: Model<Api>, info: {
+    requestId: string;
+    message?: AssistantMessage;
+    startedAt?: number;
+}): Record<string, string>;
 export declare function resolvePeer(req: Request): string;
 /**
  * Constant-time byte comparison. Falls back to a manual XOR accumulator if

package/dist/types/auth-storage.d.ts

@@ -226,6 +226,8 @@ export interface AuthCredentialStore {
         includeExpired?: boolean;
     }): string | null;
     setCache(key: string, value: string, expiresAtSec: number): void;
+    /** Drop all cache rows whose keys start with the supplied prefix. */
+    deleteCachePrefix?(prefix: string): void;
     cleanExpiredCache(): void;
     /**
      * Append usage-limit snapshots for trend history. Optional: stores without
@@ -992,6 +994,8 @@ export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
         includeExpired?: boolean;
     }): string | null;
     setCache(key: string, value: string, expiresAtSec: number): void;
+    /** Drop all cache rows whose keys start with the supplied prefix. */
+    deleteCachePrefix(prefix: string): void;
     cleanExpiredCache(): void;
     recordUsageSnapshots(entries: UsageHistoryEntry[]): void;
     listUsageHistory(query?: UsageHistoryQuery): UsageHistoryEntry[];

package/dist/types/error/flags.d.ts

@@ -8,6 +8,7 @@ export declare const Flag: {
     readonly StaleResponsesItem: 1048576;
     readonly MalformedFunctionCall: 2097152;
     readonly ProviderFinishError: 4194304;
+    readonly ContentBlocked: 32768;
     readonly ContextOverflow: 8388608;
     readonly AuthFailed: 16777216;
     readonly SilentAbort: 33554432;

package/dist/types/index.d.ts

@@ -29,6 +29,7 @@ export * from "./stream";
 export * from "./types";
 export * from "./usage";
 export * from "./usage/claude";
+export * from "./usage/cursor";
 export * from "./usage/gemini";
 export * from "./usage/github-copilot";
 export * from "./usage/google-antigravity";

package/dist/types/providers/openai-chat-server-schema.d.ts

@@ -232,7 +232,7 @@ export declare const assistantMessageSchema: import("arktype/internal/variants/o
         refusal: string;
     } | {
         type: string;
-    })[] | undefined;
+    })[] | null | undefined;
     tool_calls?: {
         id: string;
         type?: "function" | undefined;
@@ -404,7 +404,7 @@ export declare const messageSchema: import("arktype/internal/variants/object.ts"
         refusal: string;
     } | {
         type: string;
-    })[] | undefined;
+    })[] | null | undefined;
     tool_calls?: {
         id: string;
         type?: "function" | undefined;
@@ -581,7 +581,7 @@ export declare const openaiChatRequestSchema: import("arktype/internal/variants/
             refusal: string;
         } | {
             type: string;
-        })[] | undefined;
+        })[] | null | undefined;
         tool_calls?: {
             id: string;
             type?: "function" | undefined;

package/dist/types/providers/openai-shared.d.ts

@@ -385,6 +385,8 @@ export declare function appendReasoningSummaryTextDelta(item: ResponseReasoningI
 export declare function appendReasoningSummaryPartDone(item: ResponseReasoningItem, block: ThinkingContent, stream: AssistantMessageEventStream, output: AssistantMessage, contentIndex: number): void;
 export declare function appendMessageContentPart(item: ResponseOutputMessage, part: ResponseContentPartAddedEvent["part"] | undefined): void;
 export declare function appendMessageTextDelta(item: ResponseOutputMessage, block: TextContent, delta: string, stream: AssistantMessageEventStream, output: AssistantMessage, contentIndex: number, partType: "output_text" | "refusal"): void;
+/** Chooses final message text while treating non-empty terminal content as authoritative. */
+export declare function finalizeMessageText(item: ResponseOutputMessage, streamedText: string): string;
 export declare function accumulateToolCallArgumentsDelta(block: ResponsesToolCallBlock, delta: string, stream: AssistantMessageEventStream, output: AssistantMessage, contentIndex: number): void;
 /**
  * Finalize streamed function-call arguments from the authoritative `.done`

package/dist/types/usage/cursor.d.ts

@@ -0,0 +1,3 @@
+import type { UsageProvider, UsageReport } from "../usage";
+export declare function parseCursorUsage(payload: unknown, fetchedAt?: number): UsageReport | null;
+export declare const cursorUsageProvider: UsageProvider;

package/dist/types/usage/openai-codex-reset.d.ts

@@ -8,7 +8,7 @@
  *
  *   GET  /wham/rate-limit-reset-credits           → list redeemable credits
  *   POST /wham/rate-limit-reset-credits/consume   → spend one credit
- *        body: { credit_id, redeem_request_id }
+ *        body: { credit_id, redeem_request_id, account_id? }
  *
  * `redeem_request_id` is a client-generated idempotency key (UUID). The consume
  * response carries a `code`: `"reset"` on success, otherwise a business reason

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "jeopi-ai",
-	"version": "16.4.2",
+	"version": "16.4.4",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://github.com/akillness/jeopi",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.0",
-		"jeopi-catalog": "16.4.2",
-		"jeopi-utils": "16.4.2",
-		"jeopi-wire": "16.4.2",
+		"jeopi-catalog": "16.4.4",
+		"jeopi-utils": "16.4.4",
+		"jeopi-wire": "16.4.4",
 		"arktype": "^2.2.0",
 		"zod": "^4"
 	},

package/src/auth-broker/discover.ts

@@ -1,6 +1,6 @@
 /**
  * Broker-aware auth-storage discovery used by both the coding-agent runtime and
- * the catalog model generator. Keeps the precedence logic (env → config.yml →
+ * the catalog model generator. Keeps the precedence logic (env → config YAML →
  * token file → local SQLite) in one place so build-time tooling sees the same
  * credentials as the TUI.
  */
@@ -71,22 +71,42 @@ interface ConfigSnapshot {
 	token?: string;
 }
 
+/**
+ * Resolve a dotted config key against a parsed YAML record, accepting nested
+ * keys and the legacy literal-dot form. Nested values take precedence.
+ */
+function readDottedString(record: Record<string, unknown>, dottedKey: string): string | undefined {
+	let current: unknown = record;
+	for (const segment of dottedKey.split(".")) {
+		if (current === null || typeof current !== "object" || Array.isArray(current)) {
+			current = undefined;
+			break;
+		}
+		current = (current as Record<string, unknown>)[segment];
+	}
+	if (typeof current === "string") return current;
+	const flat = record[dottedKey];
+	return typeof flat === "string" ? flat : undefined;
+}
+
 async function readConfigYaml(agentDir: string): Promise<ConfigSnapshot> {
-	const configPath = path.join(agentDir, "config.yml");
-	try {
-		const raw = await Bun.file(configPath).text();
-		const parsed = YAML.parse(raw);
-		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
-		const record = parsed as Record<string, unknown>;
-		const url = typeof record["auth.broker.url"] === "string" ? (record["auth.broker.url"] as string) : undefined;
-		const token =
-			typeof record["auth.broker.token"] === "string" ? (record["auth.broker.token"] as string) : undefined;
-		return { url, token };
-	} catch (err) {
-		if (isEnoent(err)) return {};
-		logger.warn("auth-broker config.yml unreadable", { error: String(err) });
-		return {};
+	for (const filename of ["config.yml", "config.yaml"]) {
+		const configPath = path.join(agentDir, filename);
+		try {
+			const raw = await Bun.file(configPath).text();
+			const parsed = YAML.parse(raw);
+			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+			const record = parsed as Record<string, unknown>;
+			const url = readDottedString(record, "auth.broker.url");
+			const token = readDottedString(record, "auth.broker.token");
+			return { url, token };
+		} catch (err) {
+			if (isEnoent(err)) continue;
+			logger.warn("auth-broker config unreadable", { filename, error: String(err) });
+			return {};
+		}
 	}
+	return {};
 }
 
 function resolveSnapshotTtlMs(): number {
@@ -104,7 +124,8 @@ function resolveSnapshotTtlMs(): number {
  * Resolve broker connection configuration using the same precedence as the TUI:
  *
  * 1. `JEOPI_AUTH_BROKER_URL` / `JEOPI_AUTH_BROKER_TOKEN` env vars.
- * 2. `auth.broker.url` / `auth.broker.token` in `<agentDir>/config.yml`.
+ * 2. `auth.broker.url` / `auth.broker.token` in `<agentDir>/config.yml` or
+ *    `<agentDir>/config.yaml`.
  * 3. `<config-root>/auth-broker.token` file (paired with a URL from env/config).
  *
  * Returns `null` when no broker URL is configured — callers should fall back to

package/src/auth-broker/remote-store.ts

@@ -468,6 +468,13 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		this.#cache.set(key, { value, expiresAtSec });
 	}
 
+	/** Drop all cache rows whose keys start with the supplied prefix. */
+	deleteCachePrefix(prefix: string): void {
+		for (const key of this.#cache.keys()) {
+			if (key.startsWith(prefix)) this.#cache.delete(key);
+		}
+	}
+
 	cleanExpiredCache(): void {
 		const nowSec = Math.floor(Date.now() / 1000);
 		for (const [key, entry] of this.#cache) {

package/src/auth-gateway/http.ts

@@ -5,19 +5,50 @@
  * and peer-resolution logic.
  */
 import { timingSafeEqual as nodeTimingSafeEqual } from "node:crypto";
+import type { Api, AssistantMessage, Model } from "../types";
 
 const JSON_HEADERS = {
 	"Content-Type": "application/json",
 	"X-Content-Type-Options": "nosniff",
 } as const;
 
-export function json(status: number, body: unknown): Response {
+export function json(status: number, body: unknown, headers?: Record<string, string>): Response {
 	return new Response(JSON.stringify(body) ?? "null", {
 		status,
-		headers: JSON_HEADERS,
+		headers: headers ? { ...JSON_HEADERS, ...headers } : JSON_HEADERS,
 	});
 }
 
+/**
+ * Diagnostic response headers for translated inference requests, mirroring the
+ * names existing gateway-aware clients already parse: `x-request-id` /
+ * `request-id` (surfaced as `_request_id` by the OpenAI and Anthropic SDKs,
+ * matches the gateway log line), LiteLLM's model-resolution and cost headers,
+ * and OpenAI's `openai-processing-ms`. Model/request-id headers are always
+ * present; `message` — the final assistant message, available only on
+ * non-streaming responses — adds the computed cost, and `startedAt` the wall
+ * time. Streaming responses send headers before usage exists, so they carry
+ * only the identity headers.
+ */
+export function gatewayResponseHeaders(
+	model: Model<Api>,
+	info: { requestId: string; message?: AssistantMessage; startedAt?: number },
+): Record<string, string> {
+	const headers: Record<string, string> = {
+		"x-request-id": info.requestId,
+		"request-id": info.requestId,
+		"x-litellm-model-id": model.id,
+	};
+	if (model.baseUrl) headers["x-litellm-model-api-base"] = model.baseUrl;
+	if (info.message) headers["x-litellm-response-cost"] = info.message.usage.cost.total.toString();
+	if (info.startedAt !== undefined) {
+		const elapsed = (performance.now() - info.startedAt).toFixed(0);
+		headers["x-litellm-response-duration-ms"] = elapsed;
+		headers["openai-processing-ms"] = elapsed;
+	}
+	return headers;
+}
+
 export function resolvePeer(req: Request): string {
 	const fwd = req.headers.get("x-forwarded-for");
 	if (fwd) return fwd.split(",")[0].trim();
@@ -165,6 +196,8 @@ const CORS_HEADERS: Record<string, string> = {
 	"Access-Control-Allow-Methods": "GET, POST, OPTIONS",
 	"Access-Control-Allow-Headers":
 		"authorization, content-type, anthropic-version, anthropic-beta, openai-organization, openai-project, x-stainless-*, x-api-key",
+	"Access-Control-Expose-Headers":
+		"x-request-id, request-id, x-litellm-model-id, x-litellm-model-api-base, x-litellm-response-cost, x-litellm-response-duration-ms, openai-processing-ms",
 	"Access-Control-Max-Age": "86400",
 };
 

package/src/auth-gateway/server.ts

@@ -32,7 +32,15 @@ import { completeSimple, streamSimple } from "../stream";
 import type { Api, AssistantMessageEventStream, Context, Model, SimpleStreamOptions } from "../types";
 import { deterministicUuid } from "../utils/deterministic-id";
 import { parseBind } from "../utils/parse-bind";
-import { captureRequestHeaders, corsHeaders, isAuthorized, json, resolvePeer, withCors } from "./http";
+import {
+	captureRequestHeaders,
+	corsHeaders,
+	gatewayResponseHeaders,
+	isAuthorized,
+	json,
+	resolvePeer,
+	withCors,
+} from "./http";
 import type {
 	AuthGatewayServerHandle,
 	AuthGatewayServerOptions,
@@ -333,6 +341,8 @@ async function handleFormatEndpoint(
 	req: Request,
 	peer: string,
 ): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
 	const controller = mirrorRequestAbort(req);
 	if (controller.signal.aborted) return clientClosedResponse(route);
 
@@ -429,6 +439,7 @@ async function handleFormatEndpoint(
 	);
 
 	logger.info("auth-gateway request", {
+		requestId,
 		format: route.label,
 		model: parsed.modelId,
 		resolvedProvider: model.provider,
@@ -457,7 +468,11 @@ async function handleFormatEndpoint(
 				const classified = classifyGatewayError(errorMessage);
 				return route.module.formatError(classified.status, classified.type, errorMessage);
 			}
-			return json(200, route.module.encodeResponse(message, parsed.modelId));
+			return json(
+				200,
+				route.module.encodeResponse(message, parsed.modelId),
+				gatewayResponseHeaders(model, { requestId, message, startedAt }),
+			);
 		} catch (error) {
 			if (controller.signal.aborted) return clientClosedResponse(route);
 			const classified = classifyGatewayError(error);
@@ -492,6 +507,7 @@ async function handleFormatEndpoint(
 	return new Response(sseStream, {
 		status: 200,
 		headers: {
+			...gatewayResponseHeaders(model, { requestId }),
 			"Content-Type": "text/event-stream; charset=utf-8",
 			"Cache-Control": "no-cache",
 			Connection: "keep-alive",
@@ -518,6 +534,8 @@ async function handleFormatEndpoint(
  * path.
  */
 async function handlePiNative(bootOpts: AuthGatewayBootOptions, req: Request, peer: string): Promise<Response> {
+	const startedAt = performance.now();
+	const requestId = crypto.randomUUID();
 	const controller = mirrorRequestAbort(req);
 	const aborted = (): Response => piNative.formatError(499, "request_aborted", "client closed request");
 	if (controller.signal.aborted) return aborted();
@@ -604,6 +622,7 @@ async function handlePiNative(bootOpts: AuthGatewayBootOptions, req: Request, pe
 	streamOpts.sessionId ??= sessionId;
 
 	logger.info("auth-gateway request", {
+		requestId,
 		format: "pi-native",
 		model: parsed.modelId,
 		resolvedProvider: model.provider,
@@ -632,7 +651,7 @@ async function handlePiNative(bootOpts: AuthGatewayBootOptions, req: Request, pe
 				const classified = classifyGatewayError(errorMessage);
 				return piNative.formatError(classified.status, classified.type, errorMessage);
 			}
-			return json(200, { message });
+			return json(200, { message }, gatewayResponseHeaders(model, { requestId, message, startedAt }));
 		} catch (error) {
 			if (controller.signal.aborted) return aborted();
 			const classified = classifyGatewayError(error);
@@ -663,6 +682,7 @@ async function handlePiNative(bootOpts: AuthGatewayBootOptions, req: Request, pe
 	return new Response(sseStream, {
 		status: 200,
 		headers: {
+			...gatewayResponseHeaders(model, { requestId }),
 			"Content-Type": "text/event-stream; charset=utf-8",
 			"Cache-Control": "no-cache",
 			Connection: "keep-alive",

package/src/auth-storage.ts

@@ -36,6 +36,7 @@ import type {
 } from "./usage";
 import { resolveUsedFraction } from "./usage";
 import { claudeRankingStrategy, claudeUsageProvider } from "./usage/claude";
+import { cursorUsageProvider } from "./usage/cursor";
 import { googleGeminiCliUsageProvider } from "./usage/gemini";
 import { githubCopilotUsageProvider } from "./usage/github-copilot";
 import { antigravityRankingStrategy, antigravityUsageProvider } from "./usage/google-antigravity";
@@ -52,6 +53,7 @@ import { opencodeGoUsageProvider } from "./usage/opencode-go";
 import { zaiUsageProvider } from "./usage/zai";
 
 const USAGE_RANKING_METRIC_EPSILON = 1e-9;
+const SESSION_STICKY_CACHE_PREFIX = "session:sticky:";
 
 // ─────────────────────────────────────────────────────────────────────────────
 // Credential Types
@@ -298,6 +300,8 @@ export interface AuthCredentialStore {
 	deleteAuthCredentialsForProvider(provider: string, disabledCause: string): void;
 	getCache(key: string, options?: { includeExpired?: boolean }): string | null;
 	setCache(key: string, value: string, expiresAtSec: number): void;
+	/** Drop all cache rows whose keys start with the supplied prefix. */
+	deleteCachePrefix?(prefix: string): void;
 	cleanExpiredCache(): void;
 	/**
 	 * Append usage-limit snapshots for trend history. Optional: stores without
@@ -504,6 +508,7 @@ const DEFAULT_USAGE_PROVIDERS: UsageProvider[] = [
 	zaiUsageProvider,
 	opencodeGoUsageProvider,
 	githubCopilotUsageProvider,
+	cursorUsageProvider,
 ];
 
 const DEFAULT_USAGE_PROVIDER_MAP = new Map<Provider, UsageProvider>(
@@ -1357,7 +1362,7 @@ export class AuthStorage {
 		try {
 			const credentialId = this.#getStoredCredentials(provider)[index]?.id;
 			if (credentialId !== undefined) {
-				const cacheKey = `session:sticky:${provider}:${sessionId}`;
+				const cacheKey = `${SESSION_STICKY_CACHE_PREFIX}${provider}:${sessionId}`;
 				const cacheValue = JSON.stringify({ type, index, credentialId });
 				// Expires in 30 days
 				const expiresAtSec = Math.floor(Date.now() / 1000) + 30 * 24 * 60 * 60;
@@ -1379,7 +1384,7 @@ export class AuthStorage {
 			return sessionMap.get(sessionId);
 		}
 		try {
-			const cacheKey = `session:sticky:${provider}:${sessionId}`;
+			const cacheKey = `${SESSION_STICKY_CACHE_PREFIX}${provider}:${sessionId}`;
 			const raw = this.#store.getCache(cacheKey);
 			if (raw) {
 				const val = JSON.parse(raw) as { type: AuthCredential["type"]; index: number; credentialId?: number };
@@ -1423,7 +1428,7 @@ export class AuthStorage {
 			}
 		}
 		try {
-			const cacheKey = `session:sticky:${provider}:${sessionId}`;
+			const cacheKey = `${SESSION_STICKY_CACHE_PREFIX}${provider}:${sessionId}`;
 			this.#store.setCache(cacheKey, "", 0);
 		} catch (err) {
 			logger.debug("Failed to clear session sticky credential from persistent store cache", { err });
@@ -1464,6 +1469,14 @@ export class AuthStorage {
 		return fallback;
 	}
 
+	#clearProviderSessionCredentialCache(provider: string): void {
+		try {
+			this.#store.deleteCachePrefix?.(`${SESSION_STICKY_CACHE_PREFIX}${provider}:`);
+		} catch (err) {
+			logger.debug("Failed to clear provider session sticky credentials from persistent store cache", { err });
+		}
+	}
+
 	/**
 	 * Clears round-robin and session assignment state for a provider.
 	 * Called when credentials are added/removed to prevent stale index references.
@@ -1475,6 +1488,7 @@ export class AuthStorage {
 			}
 		}
 		this.#sessionLastCredential.delete(provider);
+		this.#clearProviderSessionCredentialCache(provider);
 		for (const key of this.#credentialBackoff.keys()) {
 			if (key.startsWith(`${provider}:`)) {
 				this.#credentialBackoff.delete(key);
@@ -3222,8 +3236,17 @@ export class AuthStorage {
 
 	/**
 	 * Resolves an OAuth credential, trying credentials in priority order.
-	 * Skips blocked credentials and checks usage limits for providers with usage data.
-	 * Falls back to earliest-unblocking credential if all are blocked.
+	 *
+	 * Resolution ladder — a request in hand always beats "no API key":
+	 * 1. strict: unblocked credentials only, usage limits respected, Pro
+	 *    filter enforced (when any account is confirmed Pro-eligible);
+	 * 2. Pro-fitting last resort: same Pro filter, but blocked/exhausted
+	 *    accounts are allowed (blocked candidates rank earliest-unblocking
+	 *    first) so the caller gets real usage-limit semantics from the wire
+	 *    instead of a missing key;
+	 * 3. unfiltered last resort: the Pro filter matched nothing usable —
+	 *    skip it and try every account once; the server is the final arbiter
+	 *    of model access.
 	 *
 	 * Returns both the API key bytes for outbound requests AND the refreshed
 	 * {@link OAuthCredential} so callers needing identity metadata (account id,
@@ -3360,40 +3383,33 @@ export class AuthStorage {
 		const enforceProRequirement =
 			requiresProModel && candidates.some(candidate => hasOpenAICodexProPlan(candidate.usage));
 
-		const fallback = candidates[0];
+		const passes: Array<{ allowBlocked: boolean; enforceProRequirement: boolean }> = [
+			{ allowBlocked: false, enforceProRequirement },
+			{ allowBlocked: true, enforceProRequirement },
+		];
+		if (enforceProRequirement) passes.push({ allowBlocked: true, enforceProRequirement: false });
 
-		for (const candidate of candidates) {
-			const resolved = await this.#tryOAuthCredential(
-				provider,
-				candidate.selection,
-				providerKey,
-				sessionId,
-				options,
-				{
-					checkUsage,
-					allowBlocked: false,
-					prefetchedUsage: candidate.usage,
-					usagePrechecked: candidate.usageChecked,
-					enforceProRequirement,
-					strategy,
-					rankingContext,
-					blockScope,
-				},
-			);
-			if (resolved) return resolved;
-		}
-
-		if (fallback && this.#isCredentialBlocked(providerKey, fallback.selection.index, blockScope)) {
-			return this.#tryOAuthCredential(provider, fallback.selection, providerKey, sessionId, options, {
-				checkUsage,
-				allowBlocked: true,
-				prefetchedUsage: fallback.usage,
-				usagePrechecked: fallback.usageChecked,
-				enforceProRequirement,
-				strategy,
-				rankingContext,
-				blockScope,
-			});
+		for (const pass of passes) {
+			for (const candidate of candidates) {
+				const resolved = await this.#tryOAuthCredential(
+					provider,
+					candidate.selection,
+					providerKey,
+					sessionId,
+					options,
+					{
+						checkUsage,
+						allowBlocked: pass.allowBlocked,
+						prefetchedUsage: candidate.usage,
+						usagePrechecked: candidate.usageChecked,
+						enforceProRequirement: pass.enforceProRequirement,
+						strategy,
+						rankingContext,
+						blockScope,
+					},
+				);
+				if (resolved) return resolved;
+			}
 		}
 
 		return undefined;
@@ -4755,6 +4771,7 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 	#getCacheStmt: Statement;
 	#getCacheIncludingExpiredStmt: Statement;
 	#upsertCacheStmt: Statement;
+	#deleteCachePrefixStmt: Statement;
 	#deleteExpiredCacheStmt: Statement;
 	#insertUsageHistoryStmt: Statement;
 	#insertUsageCostStmt: Statement;
@@ -4800,6 +4817,7 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		this.#upsertCacheStmt = this.#db.prepare(
 			"INSERT INTO cache (key, value, expires_at) VALUES (?, ?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value, expires_at = excluded.expires_at",
 		);
+		this.#deleteCachePrefixStmt = this.#db.prepare("DELETE FROM cache WHERE substr(key, 1, ?) = ?");
 		this.#deleteExpiredCacheStmt = this.#db.prepare(`DELETE FROM cache WHERE expires_at <= ${SQLITE_NOW_EPOCH}`);
 		this.#insertUsageHistoryStmt = this.#db.prepare(
 			"INSERT INTO usage_history (recorded_at, provider, account_key, email, account_id, limit_id, label, window_label, used_fraction, status, resets_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
@@ -5364,6 +5382,15 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		}
 	}
 
+	/** Drop all cache rows whose keys start with the supplied prefix. */
+	deleteCachePrefix(prefix: string): void {
+		try {
+			this.#deleteCachePrefixStmt.run(prefix.length, prefix);
+		} catch {
+			// Ignore cache delete failures
+		}
+	}
+
 	cleanExpiredCache(): void {
 		try {
 			this.#deleteExpiredCacheStmt.run();
@@ -5564,6 +5591,7 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		this.#getCacheStmt.finalize();
 		this.#getCacheIncludingExpiredStmt.finalize();
 		this.#upsertCacheStmt.finalize();
+		this.#deleteCachePrefixStmt.finalize();
 		this.#deleteExpiredCacheStmt.finalize();
 		this.#insertUsageHistoryStmt.finalize();
 		this.#lastUsageHistoryStmt.finalize();

package/src/error/flags.ts

@@ -17,6 +17,7 @@ export const Flag = {
 	StaleResponsesItem: 0x0010_0000,
 	MalformedFunctionCall: 0x0020_0000,
 	ProviderFinishError: 0x0040_0000,
+	ContentBlocked: 0x0000_8000,
 	ContextOverflow: 0x0080_0000,
 	AuthFailed: 0x0100_0000,
 	SilentAbort: 0x0200_0000,
@@ -40,6 +41,7 @@ const KIND_MASK =
 	Flag.StaleResponsesItem |
 	Flag.MalformedFunctionCall |
 	Flag.ProviderFinishError |
+	Flag.ContentBlocked |
 	Flag.ContextOverflow |
 	Flag.AuthFailed |
 	Flag.SilentAbort |
@@ -92,6 +94,7 @@ const AUTH_FAILURE_PATTERN =
 	/\b(?:401|403|unauthorized|forbidden|authentication|auth[_ ]?unavailable|no auth available|(?:invalid|no)[_ ]?api[_ ]?key)\b/i;
 const MALFORMED_FUNCTION_CALL_PATTERN = /\bmalformed.?function.?call\b/i;
 const PROVIDER_FINISH_ERROR_PATTERN = /\bProvider (?:returned error finish_reason|finish_reason:\s*error)\b/i;
+const CONTENT_FILTER_PATTERN = /\b(?:incomplete:\s*)?content_filter\b/i;
 const STALE_RESPONSE_ITEM_PATTERNS = [/\bItem with id ['"][^'"]+['"] not found\.?/i, /previous[ _]?response/i] as const;
 const STALE_RESPONSE_ITEM_DETAIL_PATTERN = /not[ _]?found|invalid|expired|stale|zero[ _-]?data[ _-]?retention/i;
 /**
@@ -167,6 +170,7 @@ const ERROR_KIND_LABELS: readonly [Flag, string][] = [
 	[Flag.StaleResponsesItem, "stale-responses-item"],
 	[Flag.MalformedFunctionCall, "malformed-function-call"],
 	[Flag.ProviderFinishError, "provider-finish-error"],
+	[Flag.ContentBlocked, "content-blocked"],
 	[Flag.ContextOverflow, "context-overflow"],
 	[Flag.AuthFailed, "auth-failed"],
 	[Flag.SilentAbort, "silent-abort"],
@@ -285,6 +289,10 @@ function isProviderFinishErrorText(text: string): boolean {
 	return PROVIDER_FINISH_ERROR_PATTERN.test(text);
 }
 
+function isContentBlockedText(text: string): boolean {
+	return CONTENT_FILTER_PATTERN.test(text);
+}
+
 function matchesOverflowText(text: string): boolean {
 	return OVERFLOW_PATTERNS.some(p => p.test(text)) || OVERFLOW_NO_BODY_PATTERN.test(text);
 }
@@ -295,6 +303,7 @@ function classifyText(errorMessage: string | undefined, errorStatus: number | un
 		if (matchesOverflowText(errorMessage)) kinds |= Flag.ContextOverflow;
 		if (isMalformedFunctionCallText(errorMessage)) kinds |= Flag.MalformedFunctionCall;
 		if (isProviderFinishErrorText(errorMessage)) kinds |= Flag.ProviderFinishError;
+		if (isContentBlockedText(errorMessage)) kinds |= Flag.ContentBlocked;
 		if (isAuthFailureText(errorMessage)) kinds |= Flag.AuthFailed;
 
 		const statusClean = errorStatus ? errorStatus : (status({ message: errorMessage }) ?? undefined);

package/src/error/provider.ts

@@ -36,13 +36,14 @@ export class ProviderResponseError extends Error {
 		this.name = "ProviderResponseError";
 		this.provider = options.provider;
 		this.kind = options.kind ?? "output";
-		// A safety filter block is a terminal provider finish, not a transient fault.
-		if (this.kind === "content-blocked") attach(this, create(Flag.ProviderFinishError));
+		// A safety filter block is terminal and intentionally non-retryable.
+		if (this.kind === "content-blocked") attach(this, create(Flag.ContentBlocked));
 		// An incomplete stream (connection dropped / truncated before any terminal
-		// event) never produced a finish reason — the request didn't complete, so it
-		// is safe to retry. The retry layer's replay-unsafe guard still blocks a
-		// retry when partial tool output was already emitted.
-		else if (this.kind === "incomplete-stream") attach(this, create(Flag.Transient));
+		// event) or an empty body never produced any content — the request didn't
+		// complete, so it is safe to retry and eligible for model fallback. The
+		// retry layer's replay-unsafe guard still blocks a retry when partial tool
+		// output was already emitted.
+		else if (this.kind === "incomplete-stream" || this.kind === "empty-body") attach(this, create(Flag.Transient));
 	}
 }
 

package/src/index.ts

@@ -29,6 +29,7 @@ export * from "./stream";
 export * from "./types";
 export * from "./usage";
 export * from "./usage/claude";
+export * from "./usage/cursor";
 export * from "./usage/gemini";
 export * from "./usage/github-copilot";
 export * from "./usage/google-antigravity";

package/src/providers/cursor.ts

@@ -76,6 +76,7 @@ import {
 	RequestContextResultSchema,
 	RequestContextSchema,
 	RequestContextSuccessSchema,
+	RequestedModelSchema,
 	ResumeActionSchema,
 	SelectedContextSchema,
 	SelectedImageSchema,
@@ -2642,16 +2643,24 @@ function buildGrpcRequest(
 		turns,
 	});
 
+	const wireModelId = model.requestModelId ?? model.id;
+	const cursorMaxMode = model.cursorMaxMode === true;
 	const modelDetails = create(ModelDetailsSchema, {
-		modelId: model.id,
+		modelId: wireModelId,
 		displayModelId: model.id,
 		displayName: model.name,
+		...(cursorMaxMode ? { maxMode: true } : undefined),
+	});
+	const requestedModel = create(RequestedModelSchema, {
+		modelId: wireModelId,
+		maxMode: cursorMaxMode,
 	});
 
 	const runRequest = create(AgentRunRequestSchema, {
 		conversationState,
 		action,
 		modelDetails,
+		requestedModel,
 		conversationId: state.conversationId,
 	});
 

package/src/providers/openai-chat-server-schema.ts

@@ -114,6 +114,7 @@ export const toolChoiceSchema = type("'auto' | 'none' | 'required'")
 // ─── Messages ───────────────────────────────────────────────────────────────
 
 const baseContent = type("string").or(userContentPartSchema.array());
+const assistantContent = baseContent.or("null");
 
 export const systemMessageSchema = type({
 	role: "'system'",
@@ -132,7 +133,7 @@ export const userMessageSchema = type({
 
 export const assistantMessageSchema = type({
 	role: "'assistant'",
-	"content?": baseContent,
+	"content?": assistantContent,
 	"tool_calls?": toolCallSchema.array(),
 	// DeepSeek-style reasoning channel. The gateway emits it on the way out
 	// (encodeResponse/encodeStream); accept it back so thinking-mode

package/src/providers/openai-codex/request-transformer.ts

@@ -281,7 +281,7 @@ export async function transformRequestBody(
 
 	body.text = {
 		...body.text,
-		verbosity: options.textVerbosity || "high",
+		verbosity: options.textVerbosity || "medium",
 	};
 
 	const include = Array.isArray(options.include) ? [...options.include] : [];

package/src/providers/openai-codex-responses.ts

@@ -86,6 +86,7 @@ import {
 	encodeResponsesToolCallId,
 	encodeTextSignatureV1,
 	finalizeCustomToolCallInputDone,
+	finalizeMessageText,
 	finalizePendingResponsesToolCalls,
 	finalizeToolCallArgumentsDone,
 	isOpenAIResponsesProgressEvent,
@@ -1458,9 +1459,7 @@ class CodexStreamProcessor {
 		}
 
 		if (item.type === "message" && block?.type === "text") {
-			block.text = item.content
-				.map(content => (content.type === "output_text" ? content.text : content.refusal))
-				.join("");
+			block.text = finalizeMessageText(item, block.text);
 			const phase = item.phase === "commentary" || item.phase === "final_answer" ? item.phase : undefined;
 			block.textSignature = encodeTextSignatureV1(item.id, phase);
 			stream.push({

package/src/providers/openai-responses-server.ts

@@ -561,6 +561,10 @@ function responseStatusForStopReason(message: AssistantMessage): ResponseStatus
 	return "completed";
 }
 
+function incompleteDetailsForStatus(status: ResponseStatus): { reason: "max_output_tokens" } | null {
+	return status === "incomplete" ? { reason: "max_output_tokens" } : null;
+}
+
 function buildReasoningItem(part: ThinkingContent): ReasoningOutputItem {
 	const baseId = part.itemId ?? makeReasoningId();
 	if (part.thinkingSignature) {
@@ -711,7 +715,7 @@ function buildResponseEnvelope(
 		model: requestedModelId,
 		output: items,
 		usage,
-		...(status === "incomplete" ? { incomplete_details: { reason: "max_output_tokens" } } : {}),
+		incomplete_details: incompleteDetailsForStatus(status),
 		...(status === "failed" ? { error: { message: message.errorMessage ?? "response failed" } } : {}),
 	};
 }
@@ -805,6 +809,7 @@ export function encodeStream(
 				model: requestedModelId,
 				output,
 				usage: null,
+				incomplete_details: incompleteDetailsForStatus(status),
 			});
 
 			const openMessage = (signature?: MessageSignature): OpenMessage => {
@@ -1235,7 +1240,7 @@ export function encodeStream(
 								model: requestedModelId,
 								output: items,
 								usage,
-								...(status === "incomplete" ? { incomplete_details: { reason: "max_output_tokens" } } : {}),
+								incomplete_details: incompleteDetailsForStatus(status),
 								...(status === "failed"
 									? { error: { message: message?.errorMessage ?? "response failed" } }
 									: {}),
@@ -1260,6 +1265,7 @@ export function encodeStream(
 									model: requestedModelId,
 									output: [],
 									error: { message: err instanceof Error ? err.message : String(err) },
+									incomplete_details: null,
 								},
 							}),
 						),

package/src/providers/openai-shared.ts

@@ -1594,12 +1594,19 @@ export function appendResponsesToolResultMessages<TApi extends Api>(
 	const hasImages = toolResult.content.some((block): block is ImageContent => block.type === "image");
 	const omittedImages = hasImages && !supportsImages;
 	const normalized = normalizeResponsesToolCallId(toolResult.toolCallId);
+	// "(see attached image)" is only truthful when the result actually carries
+	// images (they ride as a separate user message on the Responses API). A
+	// genuinely empty text result (empty file read, silent tool) must stay
+	// empty — the placeholder sent models chasing an attachment that never
+	// existed.
 	const output = (
 		omittedImages
 			? joinTextWithImagePlaceholder(textResult, true)
 			: textResult.length > 0
 				? textResult
-				: "(see attached image)"
+				: hasImages
+					? "(see attached image)"
+					: ""
 	).toWellFormed();
 	if (strictResponsesPairing && !knownCallIds.has(normalized.callId)) {
 		// Strict backends (Azure, Copilot) reject unpaired outputs outright, but
@@ -1737,6 +1744,11 @@ export function appendMessageTextDelta(
 	}
 	stream.push({ type: "text_delta", contentIndex, delta, partial: output });
 }
+/** Chooses final message text while treating non-empty terminal content as authoritative. */
+export function finalizeMessageText(item: ResponseOutputMessage, streamedText: string): string {
+	if (!item.content?.length) return streamedText || "";
+	return item.content.map(part => (part.type === "output_text" ? (part.text ?? "") : (part.refusal ?? ""))).join("");
+}
 
 export function accumulateToolCallArgumentsDelta(
 	block: ResponsesToolCallBlock,
@@ -2129,9 +2141,7 @@ export async function processResponsesStream<TApi extends Api>(
 				closeOpenItem(event.output_index, item.id, entry);
 			} else if (item.type === "message") {
 				const block = entry?.block.type === "text" ? entry.block : undefined;
-				const text = item.content
-					.map(part => (part.type === "output_text" ? (part.text ?? "") : (part.refusal ?? "")))
-					.join("");
+				const text = finalizeMessageText(item, block?.text ?? "");
 				const textSignature = encodeTextSignatureV1(item.id, item.phase ?? undefined);
 				let contentIndex: number;
 				if (block) {

package/src/registry/oauth/callback-server.ts

@@ -18,6 +18,26 @@ const DEFAULT_TIMEOUT = 300_000;
 const DEFAULT_HOSTNAME = "localhost";
 const CALLBACK_PATH = "/callback";
 
+function escapeJsonForHtmlScript(value: object): string {
+	const json = JSON.stringify(value) ?? "null";
+	return json.replace(/[<>&\u2028\u2029]/g, character => {
+		switch (character) {
+			case "<":
+				return "\\u003C";
+			case ">":
+				return "\\u003E";
+			case "&":
+				return "\\u0026";
+			case "\u2028":
+				return "\\u2028";
+			case "\u2029":
+				return "\\u2029";
+			default:
+				return character;
+		}
+	});
+}
+
 export type CallbackResult = { code: string; state: string };
 
 export interface OAuthCallbackFlowOptions {
@@ -230,7 +250,7 @@ export abstract class OAuthCallbackFlow {
 		});
 
 		return new Response(
-			(templateHtml as unknown as string).replaceAll("__OAUTH_STATE__", JSON.stringify(resultState)),
+			(templateHtml as unknown as string).replaceAll("__OAUTH_STATE__", () => escapeJsonForHtmlScript(resultState)),
 			{
 				status: resultState.ok ? 200 : 500,
 				headers: { "Content-Type": "text/html" },

package/src/registry/oauth/oauth.html

@@ -299,7 +299,7 @@
 			if (serverState.ok) {
 				app.classList.add("success", "countdown");
 				title.textContent = "Authentication Successful";
-				message.innerHTML = "You have successfully logged in.<br>This window will close automatically.";
+				message.innerHTML = "You have successfully logged in.<br>You can now close this tab.";
 				setTimeout(() => window.close(), 3000);
 			} else {
 				app.classList.add("error");

package/src/usage/cursor.ts

@@ -0,0 +1,169 @@
+import type {
+	UsageAmount,
+	UsageFetchContext,
+	UsageFetchParams,
+	UsageLimit,
+	UsageProvider,
+	UsageReport,
+	UsageStatus,
+	UsageWindow,
+} from "../usage";
+import { toNumber } from "./shared";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function parseTimestamp(value: unknown): number | undefined {
+	const numeric = toNumber(value);
+	if (numeric !== undefined) return numeric < 1_000_000_000_000 ? numeric * 1000 : numeric;
+	if (typeof value !== "string" || !value.trim()) return undefined;
+	const parsed = Date.parse(value);
+	return Number.isFinite(parsed) ? parsed : undefined;
+}
+
+function normalizeCursorBaseUrl(baseUrl?: string): string {
+	if (!baseUrl) return "https://api2.cursor.sh";
+	return baseUrl.replace(/\/+$/, "");
+}
+
+function deriveResetsAt(payload: Record<string, unknown>): number | undefined {
+	const endKeys = ["billingCycleEnd", "endOfMonth", "resetsAt", "nextReset"];
+	for (const key of endKeys) {
+		const parsed = parseTimestamp(payload[key]);
+		if (parsed !== undefined) return parsed;
+	}
+
+	const startKeys = ["startOfMonth", "billingCycleStart", "startOfBillingCycle"];
+	for (const key of startKeys) {
+		const parsed = parseTimestamp(payload[key]);
+		if (parsed !== undefined) {
+			const date = new Date(parsed);
+			date.setUTCMonth(date.getUTCMonth() + 1);
+			return date.getTime();
+		}
+	}
+	return undefined;
+}
+
+export function parseCursorUsage(payload: unknown, fetchedAt = Date.now()): UsageReport | null {
+	if (!isRecord(payload)) return null;
+	const limits: UsageLimit[] = [];
+	const resetsAt = deriveResetsAt(payload);
+
+	const window: UsageWindow = {
+		id: "monthly",
+		label: "Monthly",
+		...(resetsAt !== undefined ? { resetsAt } : {}),
+	};
+
+	for (const [key, value] of Object.entries(payload)) {
+		if (!isRecord(value)) continue;
+
+		const usedVal =
+			toNumber(value.numRequests) ?? toNumber(value.used) ?? toNumber(value.amountUsed) ?? toNumber(value.usdUsed);
+		const limitVal =
+			toNumber(value.maxRequestUsage) ??
+			toNumber(value.limit) ??
+			toNumber(value.amountLimit) ??
+			toNumber(value.usdLimit);
+
+		if (usedVal !== undefined && limitVal !== undefined) {
+			const isUsd =
+				key === "planUsage" ||
+				key.toLowerCase().includes("usd") ||
+				key.toLowerCase().includes("billing") ||
+				key.toLowerCase().includes("stripe");
+
+			const unit = isUsd ? "usd" : "requests";
+			const cleanBucket = key.toLowerCase().trim();
+			const limitId = isUsd ? `cursor:usd:${cleanBucket}` : `cursor:requests:${cleanBucket}`;
+			const label = isUsd ? `${key} spend` : `${key} requests`;
+
+			const amount: UsageAmount = {
+				used: usedVal,
+				limit: limitVal,
+				remaining: Math.max(0, limitVal - usedVal),
+				usedFraction: limitVal > 0 ? usedVal / limitVal : 0,
+				remainingFraction: limitVal > 0 ? Math.max(0, limitVal - usedVal) / limitVal : 0,
+				unit,
+			};
+
+			const usedFraction = amount.usedFraction;
+			let status: UsageStatus = "unknown";
+			if (usedFraction !== undefined) {
+				if (usedFraction >= 1) {
+					status = "exhausted";
+				} else if (usedFraction >= 0.9) {
+					status = "warning";
+				} else {
+					status = "ok";
+				}
+			}
+
+			limits.push({
+				id: limitId,
+				label,
+				scope: { provider: "cursor", windowId: window.id },
+				window,
+				amount,
+				status,
+			});
+		}
+	}
+
+	if (limits.length === 0) return null;
+
+	return {
+		provider: "cursor",
+		fetchedAt,
+		limits,
+		raw: payload,
+	};
+}
+
+export const cursorUsageProvider: UsageProvider = {
+	id: "cursor",
+	supports(params: UsageFetchParams): boolean {
+		if (params.provider !== "cursor") return false;
+		const { credential } = params;
+		if (credential.type === "oauth") return Boolean(credential.accessToken);
+		if (credential.type === "api_key") return Boolean(credential.apiKey);
+		return false;
+	},
+	async fetchUsage(params: UsageFetchParams, ctx: UsageFetchContext): Promise<UsageReport | null> {
+		if (params.provider !== "cursor") return null;
+		const { credential } = params;
+		const token = credential.type === "oauth" ? credential.accessToken : credential.apiKey;
+		if (!token) return null;
+
+		const baseUrl = normalizeCursorBaseUrl(params.baseUrl ?? credential.apiEndpoint);
+		const url = `${baseUrl}/auth/usage`;
+		const headers: Record<string, string> = {
+			Accept: "application/json",
+			Authorization: `Bearer ${token}`,
+		};
+
+		try {
+			const response = await ctx.fetch(url, { headers, signal: params.signal });
+			if (!response.ok) {
+				ctx.logger?.warn("Cursor usage request failed", { status: response.status, provider: params.provider });
+				return null;
+			}
+			const payload = await response.json();
+			const report = parseCursorUsage(payload);
+			if (report) {
+				const metadata = {
+					...(credential.email ? { email: credential.email } : {}),
+					...(credential.accountId ? { accountId: credential.accountId } : {}),
+					...(credential.projectId ? { projectId: credential.projectId } : {}),
+				};
+				if (Object.keys(metadata).length > 0) report.metadata = metadata;
+			}
+			return report;
+		} catch (error) {
+			ctx.logger?.warn("Cursor usage request error", { provider: params.provider, error: String(error) });
+			return null;
+		}
+	},
+};

package/src/usage/openai-codex-reset.ts

@@ -8,7 +8,7 @@
  *
  *   GET  /wham/rate-limit-reset-credits           → list redeemable credits
  *   POST /wham/rate-limit-reset-credits/consume   → spend one credit
- *        body: { credit_id, redeem_request_id }
+ *        body: { credit_id, redeem_request_id, account_id? }
  *
  * `redeem_request_id` is a client-generated idempotency key (UUID). The consume
  * response carries a `code`: `"reset"` on success, otherwise a business reason
@@ -159,7 +159,11 @@ export async function consumeCodexResetCredit(
 	const response = await auth.fetch(url, {
 		method: "POST",
 		headers: buildHeaders(auth, true),
-		body: JSON.stringify({ credit_id: auth.creditId, redeem_request_id: redeemRequestId }),
+		body: JSON.stringify({
+			credit_id: auth.creditId,
+			redeem_request_id: redeemRequestId,
+			account_id: auth.accountId,
+		}),
 		signal: auth.signal,
 	});
 	let body: unknown;

package/src/utils/schema/normalize.ts

@@ -581,7 +581,11 @@ function collapseMixedTypeCombinerVariants(schema: JsonObject, combiner: "anyOf"
 
 			const existingValue = mergedVariantFields[key];
 			if (existingValue !== undefined && !areJsonValuesEqual(existingValue, variantValue)) {
-				return schema;
+				if (key !== "description") return schema;
+				// Descriptions are annotations, so merge branch-local spill text instead of
+				// treating it as a structural incompatibility.
+				mergedVariantFields[key] = mergeSchemaDescriptions(existingValue, variantValue);
+				continue;
 			}
 			mergedVariantFields[key] = variantValue;
 		}
@@ -622,7 +626,9 @@ function collapseMixedTypeCombinerVariants(schema: JsonObject, combiner: "anyOf"
 		const value = mergedVariantFields[key];
 		const existingValue = nextSchema[key];
 		if (existingValue !== undefined && !areJsonValuesEqual(existingValue, value)) {
-			return schema;
+			if (key !== "description") return schema;
+			nextSchema[key] = mergeSchemaDescriptions(existingValue, value);
+			continue;
 		}
 		if (existingValue === undefined) {
 			nextSchema[key] = value;
@@ -631,6 +637,13 @@ function collapseMixedTypeCombinerVariants(schema: JsonObject, combiner: "anyOf"
 	return nextSchema;
 }
 
+function mergeSchemaDescriptions(existing: unknown, incoming: unknown): string {
+	if (typeof existing !== "string") return typeof incoming === "string" ? incoming : "";
+	if (typeof incoming !== "string" || incoming.length === 0 || existing === incoming) return existing;
+	if (existing.length === 0) return incoming;
+	return `${existing}\n\n${incoming}`;
+}
+
 function collapseSameTypeCombinerVariants(schema: JsonObject, combiner: "anyOf" | "oneOf"): JsonObject {
 	const variantsRaw = schema[combiner];
 	if (!Array.isArray(variantsRaw) || variantsRaw.length === 0) return schema;