#3437 (preserve cross-api reasoning replay) and #3439 (preserve 3p thinking blocks across cross-API switches) both rewrite the thinking-block path of transform-messages.ts and the encoder in openai-completions.ts to fix issues #3433/#3434, and overlap structurally. Reconciled into one resolved-compat design:
- transform-messages.ts threads the request-time resolved compat (from #3437) into the predicate, replacing #3439's base+whenThinking union traversal. resolveOpenAICompatPolicy already swaps in whenThinking for thinking-on requests, so the predicate and encoder stay in lockstep (closes both Codex 'use resolved compat' reviews and keeps the #1071/#1484 OpenCode paths correct).
- The predicate keeps #3439's broad coverage: preserve a native, signature-stripped thinking block when the resolved openai-completions target is reasoning-capable, not requiresThinkingAsText, and either requiresReasoningContentForToolCalls or thinkingFormat==='zai'. Other cross-API targets text-demote.
- openai-completions.ts keeps #3439's Z.AI-format encoder branch and #3437's compat threading, but drops #3439's text-fold fallback and isSameModelHistory: under threading they are unreachable (any preserved cross-model block is consumed by the requiresReasoningContentForToolCalls or zai branch; thinking-off targets text-demote in transform). Markup-healed same-model thinking still falls through unemitted, as before.
Regression tests from both PRs retained. Fixes#3433, #3434.
Markup-healed streams (MiniMax M3 \`<think>…</think>\`, Kimi K2 healed
reasoning, every \`getStreamMarkupHealingPattern === "thinking"\` host)
reconstruct thinking blocks from raw text deltas, so the resulting
\`ThinkingContent\` lands with \`thinkingSignature: undefined\`. On a
same-model continuation those blocks are PRIVATE reasoning the source
emitted, not cross-API preserved reasoning — promoting them into the next
request's visible \`content\` would leak hidden chain-of-thought.
The text-fold fallback added in 8f7fb1d for cross-API preserved blocks now
gates on \`!isSameModelHistory\` before firing. Same-model history keeps the
legacy behavior of silently dropping unsigned thinking when no per-compat
branch consumes it, matching pre-#3434 semantics. Cross-API replays
(different api, provider, or model id) still fold to content so the
reasoning chain at least survives as conversation context.
Tests: \`issue-3434-repro.test.ts\` adds a pin for same-model unsigned
thinking on \`opencode-go\`/Kimi — visible content stays exactly the model's
visible answer, no reasoning_content / reasoning / reasoning_text on the
wire.
\`bun test packages/ai\`: 2297 pass / 1 fail (the same \`proxy.test.ts\`
\`Bun.env\` leak that fails on \`main\`). \`bun check\` passes.
Addresses chatgpt-codex-connector P2 review on #3439.
The cross-API preservation predicate added in the parent commit read only
\`model.compat\`, so it missed the resolved \`compat.whenThinking\` view that
OpenCode-hosted reasoning models (Kimi/GLM/DeepSeek/Qwen/MiMo via \`opencode-go\`
/ \`opencode-zen\`) require:
- Base compat keeps \`requiresReasoningContentForToolCalls: false\` so
thinking-disabled requests dodge \`Extra inputs are not permitted\` (#1071).
- \`compat.whenThinking\` reactivates the flag for thinking-engaged requests
so they dodge \`thinking is enabled but reasoning_content is missing\` (#1484).
The old predicate read the base compat, so a cross-API switch into an
OpenCode reasoning model still demoted the prior thinking to text and the
next thinking-on request re-triggered #1484. The predicate now folds both
views (base + \`whenThinking\`) through a shared \`acceptsReasoningContentReplay\`
helper; if either view permits replay, the block is preserved.
Encoder companion fix in \`openai-completions.ts\`: when preserved cross-API
thinking reaches a request whose resolved compat can't surface
\`reasoning_content\` (most often OpenCode in thinking-disabled mode), fold
the reasoning into the visible content. Same shape as
\`requiresThinkingAsText\`, but gated on signature-stripped blocks only, so
same-model replays (which keep the streaming signature) are untouched. This
preserves the pre-#3434 text-demotion semantics for that branch without
silently dropping the reasoning chain.
Tests: \`packages/ai/test/issue-3434-repro.test.ts\` now also pins:
- OpenCode \`whenThinking\` compat surfaces \`reasoning_content\` from the
preserved block (guards against re-opening #1484 on cross-API switch).
- OpenCode base compat (thinking off) folds the preserved block into
content (guards against silently dropping the reasoning chain).
\`bun test packages/ai\`: 2296 pass / 1 fail; the lone failure
(\`proxy.test.ts > normalizes hyphenated provider ids to underscores\`)
is the same pre-existing \`Bun.env\` leak from a sibling test that fails on
\`main\`. \`bun check\` passes.
Addresses chatgpt-codex-connector review on #3439.
Threaded the resolved OpenAI completions compat into transformMessages so thinking-enabled request policy controls cross-API reasoning preservation.
Added coverage for Kimi/OpenCode replay where base compat is false but the thinking-enabled policy requires reasoning_content.
Fixes#3433
On a mid-session switch between an Anthropic-compatible 3p endpoint and an
OpenAI-compatible 3p endpoint on the same vendor (Z.AI Anthropic → Z.AI OpenAI,
Kimi Anthropic → Kimi OpenAI, custom \`models.yaml\` switches that cross API
types), \`transformMessages\` demoted every prior \`thinking\` block to plain
text on the cross-API path. The next request shipped the reasoning chain as
conversation text instead of structured \`reasoning_content\`, so the target
model lost the prior reasoning context and the source-side reasoning tokens
were paid for twice.
Two-half fix:
1. \`packages/ai/src/providers/transform-messages.ts\` — the cross-API thinking
path now preserves the prior reasoning as a native, signature-stripped
\`thinking\` block whenever the \`openai-completions\` target can re-emit it
on the wire (\`requiresReasoningContentForToolCalls\` or
\`thinkingFormat: "zai"\`). The source wire-format signature is always
stripped because it is bound to the source API (Anthropic crypto sig /
OpenAI Responses encrypted blob) and useless to the target.
2. \`packages/ai/src/providers/openai-completions.ts\` — the encoder now
surfaces preserved thinking blocks via \`reasoningContentField\` for
Z.AI-format hosts that don't strictly require the field, so a preserved
block with a stripped/opaque signature still ships as
\`reasoning_content\` on the wire.
Other cross-API targets (openai-responses encrypted blobs, google signed
thought parts, anthropic-from-foreign-source) keep the existing text-demotion
fallback so reasoning still survives as visible conversation context.
Tests:
- New \`packages/ai/test/issue-3434-repro.test.ts\` pins the Z.AI → Z.AI,
Anthropic 3p → DeepSeek, and Anthropic 3p → official-OpenAI-non-reasoning
wire shapes; all 4 tests fail on \`main\` and pass after the fix.
- \`bun test packages/ai\`: 2294 pass / 1 fail; the one failure
(\`proxy.test.ts > normalizes hyphenated provider ids to underscores\`) also
fails on \`main\` from a \`Bun.env.PI_PROXY_*\` leak in a sibling test and is
unrelated to this diff.
Fixes#3434
Preserved cross-API thinking blocks for OpenAI-compatible reasoning targets so the completions encoder can write them to the configured reasoning_content field after signatures are stripped.
Added regression coverage for Anthropic-message history replayed through DeepSeek-compatible chat completions.
Fixes#3433
- Added no-op setters to process.stdout properties in test geometry stubs.
- Prevented potential errors when code under test attempts to reassign stdout dimensions.
Remove `__getLegacyPiBundledRegistry` and `__synthesizeLegacyPiBundledSource`:
both reject outside compiled-binary mode, so no unit test can call them — they
were untested test seams. Real coverage runs through the pure
`__synthesizeLegacyPiBundledSourceWithRegistry` + `__getLegacyPiBundledRegistryGlobal`.
Also document why the synthesized virtual module must bridge back to the host
registry through `globalThis` (separate ES module, no shared closure scope,
live non-serializable exports) so the indirection isn't mistaken for cruft.
Serve bundled pi-* and TypeBox through an in-process virtual namespace
on Bun 1.3.14+ where `--compile` extras are unreachable via any
filesystem API (issue #3423).
Merge resolution:
- Reconciled `TYPEBOX_SHIM_PATH` with main's #3414 fall-through:
`__resolveTypeBoxShimPath(isCompiled, sourcePath, exists)` returns the
`omp-legacy-pi-bundled:` virtual specifier in compiled mode (no FS
probe) and the on-disk source path otherwise, dropping to null when
the shim file is missing so bare typebox imports fall through to native
resolution.
- Removed the now-dead `--compile` extras path: dropped
`LEGACY_COMPAT_BUILD_ENTRYPOINTS` usage from both build-binary.ts and
ci-release-build-binaries.ts and deleted scripts/binary-entrypoints.ts;
the bundler reaches every surface via legacy-pi-bundled-registry.ts.
- Deleted obsolete tests for the removed bunfs machinery
(legacy-pi-compat-entrypoints, legacy-pi-typebox-shim-validation) and
added regression coverage for __resolveTypeBoxShimPath.
- Dropped the binary-compiling smoke driver per maintainer request.
Verified: bun check clean; 77 extensibility tests pass; instrumented
compiled-binary run confirmed onLoad fires for all bundled specifiers.
- Add `usageProviderFor` helper to `AuthStorage` to distinguish between providers without usage endpoints and missing data.
- Implement account filtering in the usage CLI to exclude providers that do not support usage reporting unless explicitly requested.
- Improve CLI diagnostic messages when no usage data is retrieved by differentiating between missing credentials and unsupported providers.
Bun 1.3.14 stopped exposing `--compile` extras through every filesystem-style API: `fs.existsSync`, `Bun.file().exists()`, `Bun.resolveSync`, and `await import()` on `/$bunfs/...` or `file:///$bunfs/...` all fail; only `/$bunfs/root/<binary-name>` itself answers. The pre-existing legacy-pi rewrite emitted `file:///$bunfs/...` URLs that Bun then could not load, so every legacy extension that imported `@oh-my-pi/pi-*` or `@sinclair/typebox` failed on the `omp-darwin-arm64` release binary.
`legacy-pi-compat.ts` now keeps a JS-heap reference to every bundled pi-* surface in a lazy-loaded sibling `legacy-pi-bundled-registry.ts` and serves them through an `omp-legacy-pi-bundled:` virtual namespace whose `Bun.plugin().onLoad` synthesizes a re-export module — no bunfs path ever leaves the module in compiled mode. Dev / source-link / installed-package modes keep the historical `file://` rewrite (source files exist on disk). The matching `--compile` extras in `scripts/build-binary.ts` are gone; `BUNFS_PACKAGE_ROOT`, `bunfsPath`, `__computeBunfsPackageRoot`, and `__joinBunfsPath` are deleted as dead code. `scripts/smoke-3423.ts` compiles a tiny binary that loads a fixture extension end-to-end through the new path.
Fixes#3423
- Added id-based credential persistence and CAS-based invalidation to prevent cross-process race conditions.
- Categorized OAuth failure responses into transient and definitive types for more resilient refresh orchestration.
- Enabled stable credential lookups during refresh to ensure integrity during peer rotation or index shifts.
- Validated new persistence and error handling logic through comprehensive concurrency and failure-mode tests.
- Added listOAuthAccounts and getOAuthAccessAt to permit targeted credential retrieval without impacting sibling accounts.
- Implemented sameOAuthIdentity helper to ensure resolution consistency when manually selecting accounts.
- Added --list and --account CLI flags to token command for inspecting and choosing specific credentials.
- Implemented SGR mouse event routing for dashboard interaction, including tab selection and pane scrolling.
- Added mouse-driven list manipulation in the extension viewer with selection highlighting, click toggling, and wheel navigation.
- Enabled fullscreen alternate-screen behavior and host terminal mouse tracking for the dashboard overlay.
- Integrated hit-testing and row selection logic into the extension list to support unified mouse and keyboard inputs.
Codex Responses Lite only accepts text input, so GPT image prompts with input_image failed before reaching the full multimodal transport.
The request transformer and Codex headers now fall back to full Responses whenever a request body contains input_image, with regression coverage for the lite header.
Fixes#3421
- Extracted the legacy `--compile` entrypoint list to `scripts/binary-entrypoints.ts` and consumed it from both the release CI script and the local dev `build-binary.ts`, so the two cannot drift apart.
- `scripts/ci-release-build-binaries.ts` no longer ships release binaries without the typebox shim, legacy pi shims, and `@oh-my-pi/{agent,natives,tui,utils}` package barrels in bunfs. Commit dc5c93462f removed worker entrypoints and false-comment-claimed the legacy entrypoints were "still" listed, so every published `omp-<platform>-<arch>` since shipped without them and the resolver emitted bunfs URLs to missing files.
- Validated TYPEBOX_SHIM_PATH at module init via __resolveTypeBoxShimPath, mirroring __validateLegacyPiPackageRootOverrides (#2168). When the shim is absent the rewriter leaves bare typebox / @sinclair/typebox imports alone so Bun falls through to native node_modules resolution.
- Pinned both halves of the contract with tests: release+dev scripts must source from the shared constant, every shim path computed in legacy-pi-compat.ts must appear in it, and __resolveTypeBoxShimPath drops missing candidates.
Fixes#3414
Responses-style providers serialize providerPayload history items instead of the
visible message blocks when replaying native history. Include providerPayload in
the append-only per-message digest so payload-only history rewrites stop the
stable-prefix walk and re-sync the changed message before any later divergent
tail.
Add a regression where an assistant message keeps identical visible content and
id but changes its openaiResponsesHistory providerPayload while a later message
also diverges; syncMessages must preserve the prefix before the assistant and
refresh the assistant payload.
Fixes#3406
Direct callers can clear AppendOnlyContextManager.log without resetting the
private sync cursor. The advisor reset path does this when recycling its helper
agent, leaving lastSyncCount and messageDigests describing the old transcript
while the physical log is empty.
Clamp the stable-prefix reuse count to the current log length before truncating
and appending. A direct log clear now forces the next sync to replay from index 0
instead of starting from a stale private cursor and dropping prefix messages from
the provider context.
Add a regression that clears the public log after syncing two messages, then
resyncs a context with the same first message and a rewritten second; both
messages must be present in the rebuilt append-only log.
Fixes#3406
Add a createAgentSession-based subagent regression for issue #3406. The test
runs a taskDepth=1 session against a loopback llama.cpp-style model so
provider.appendOnlyContext auto-enables through the SDK path used by task
subagents.
A real context extension rewrites the prior assistant turn on the second
subagent request. The captured provider contexts assert the first request's user
message object is reused in the second request, proving the append-only log kept
the stable prefix instead of clearing and re-rendering it for subagents.
Fixes#3406
Track internal tool-result metadata in append-only per-message digests so
metadata-only rewrites of toolCallId, toolName, or isError stop the stable-prefix
walk and re-sync the changed tool result before any later divergent tail.
This prevents stale tool-result pairing or error state from being preserved when
the text content stays unchanged but provider-serialized metadata changes.
Fixes#3406
`AppendOnlyContextManager.syncMessages` hashed a single rolling digest
over the entire synced prefix, so any in-place rewrite of an already-
synced message — per-turn `pruneSupersededToolResults` / `pruneToolOutputs`
collapsing a tool result, image stripping, or a `transformContext` re-render
— triggered `log.clear()` and re-appended the full conversation from
the current (mutated) view. The provider's cached bytes still matched
the prefix, but every position past the divergence had to be re-prefilled.
On llama.cpp / Ollama / LM Studio this re-prefilled tens of thousands
of tokens every few turns (`n_past \u2248 end-of-system-prompt` collapse,
~40k-token full re-prefill, GPU pinned >400W).
Replace the rolling digest with per-message digests in `#messageDigests`,
walk the new sync against them to find the longest byte-stable prefix,
truncate the log down to that prefix via a new `AppendOnlyLog.truncate(count)`,
and only re-append the diverged tail. Genuine compaction (`length <
lastSyncCount`) still clears the log.
- Tail-only rewrite: prefix stays byte-stable; only the trailing message
re-syncs.
- Deep rewrite: prefix up to the divergence stays byte-stable; the
provider re-prefills from the divergent message onward (architectural
minimum).
- True compaction: unchanged, full replay.
Replace the now-misleading `detects in-place rewrite of already-synced
messages` / `detects in-place rewrite via digest mismatch` tests with
`preserves the byte-stable prefix when a deep message is rewritten (#3406)`,
`preserves the prefix when the tail is rewritten (#3406)`, `appended
new messages keep the prefix stable even when the prior tail also
diverged (#3406)`, and `rewriting the first message still re-syncs
from scratch` so each invariant is asserted directly.
Fixes#3406
Mapped cacheRetention="long" to cache_control.ttl="1h" on OpenRouter Anthropic Responses requests; guarded against overwriting a caller-supplied cache_control.\n\nRefs #3397
When the inner-terminal env markers (KITTY_WINDOW_ID, GHOSTTY_RESOURCES_DIR,
WEZTERM_PANE, ITERM_SESSION_ID) leak into a tmux session, TERMINAL_ID
resolves to the inner terminal and notifyProtocol becomes OSC 9 / OSC 99.
sendNotification() wrote that raw OSC straight to stdout, but tmux does not
forward bare OSC 9/99 to the outer terminal and the bare sequence does not
flag tmux's own monitor-bell / monitor-activity — so a backgrounded omp pane
under the common tmux + kitty/ghostty/wezterm/iTerm2 stack had no signal at
all for completion or 'ask' blockage.
Under TMUX, OSC-protocol notifications are now wrapped in tmux's
\x1bPtmux;…\x1b\\ DCS passthrough envelope (so users with
allow-passthrough on still get the real desktop toast) and followed by a
\x07 BEL (so monitor-bell flags the window otherwise — the standard
'needs attention' workflow). The OSC 99 capability probe is wrapped the
same way so rich notifications keep working across tmux. Bell-protocol
paths are unchanged.
Fixes#3395
Ollama Cloud rejects any chat request whose options.num_predict exceeds
65536 with HTTP 400, but the existing safety relied on the load-time
omitMaxOutputTokens policy in model-registry.ts. Stale models.db rows
predating that policy (and custom modelOverrides re-enabling output
caps) carried maxTokens: 1048576 forward to the wire layer untouched,
so every request to deepseek-v4-pro / deepseek-v4-flash 400'd with:
max_tokens (1048576) exceeds model's maximum output tokens (65536)
for model deepseek-v4-pro
createChatBody now resolves num_predict through resolveNumPredict,
which clamps every ollama-cloud request at the documented cap before
serialization — independent of the cached spec, on top of the existing
omitMaxOutputTokens path. Self-hosted ollama traffic is unaffected.
Fixes#3392
`buildAnthropicHeaders` filtered `Authorization` and `X-Api-Key` out of
`model.headers` (and `ANTHROPIC_CUSTOM_HEADERS`) via `enforcedHeaderKeys`,
then re-attached the auto-built `Bearer <apiKey>` / `X-Api-Key: <apiKey>`,
so custom-proxy users could never override anthropic-messages auth — unlike
`openai-responses` (`headers.Authorization ??= Bearer apiKey`) and the
GitHub Copilot anthropic branch (`mergeHeaders(..., model.headers, ...)`).
Non-OAuth, non-Cloudflare branches now honor the caller's `Authorization` /
`X-Api-Key`; case-insensitive capture keeps the spread free of duplicate
keys. OAuth still forces `Authorization: Bearer <oauth-token>` (the OAuth
credential itself) and Cloudflare AI Gateway still owns
`cf-aig-authorization` — both drop + log caller overrides.
`buildAnthropicClientOptions` no longer requires the surviving
`Authorization` to start with `Bearer ` before suppressing the
client-level `X-Api-Key`; any custom Authorization on a non-official
endpoint suppresses it so the proxy gets a single credential.
Fixes#3391
Trailing empty assistant 'stop' arriving after a successful 'yield'
revived the already-yielded subagent. AgentSession.agent_end maintenance
compared #assistantEndedWithSuccessfulYield(msg) against the trailing
empty-stop message — not the yield-bearing one — so the empty-stop
recovery path appended a retry reminder and scheduled agent.continue().
Track a sticky #yieldTerminationPending flag set when the yield tool
finishes without error and cleared on the next #promptWithMessage. The
agent_end routing extends the existing successful-yield branch: when the
flag is set, or the current message ended with yield, short-circuit
empty-stop / unexpected-stop / compaction continuations for the rest of
the run, so a successful yield is terminal regardless of trailing stops.
Fixes#3389
can1357