@bubblebrain-ai/bubble 0.0.46 → 0.0.48

package/dist/provider-registry.js

@@ -10,10 +10,58 @@ import { ModelConfig } from "./model-config.js";
 import { AuthStorage } from "./oauth/index.js";
 import { fetchGeminiModels } from "./provider-ai-sdk.js";
 import { extractChatGptAccountId, fetchOpenAICodexModelCatalog } from "./provider-openai-codex.js";
+import { fetchGrokSubscriptionModels, inferGrokReasoningLevels } from "./provider-grok.js";
 import { refreshOpenAICodex } from "./oauth/openai-codex.js";
 import { refreshGrok } from "./oauth/grok.js";
+/** True for providers speaking the OpenAI chat-completions protocol (the default). */
+export function isOpenAICompatibleProtocol(protocol) {
+    return protocol === undefined || protocol === "openai-chat";
+}
+/**
+ * Ids that are clearly not text chat models. Vendors with one big catalog
+ * (alibaba returns 236 entries) would otherwise flood the model picker.
+ * Deliberately conservative: vision/preview chat models must pass.
+ */
+const NON_CHAT_ID_PATTERN = /(^|[-_/])(embed|embedding|embeddings|rerank|reranker|tts|asr|whisper|ocr|moderation|guard|image|video|audio|speech|voice|paint|draw)([-_/]|$)/i;
+export function isLikelyChatModelId(id) {
+    return !NON_CHAT_ID_PATTERN.test(id);
+}
+/** GET {baseURL}/models, tolerating the common response shapes. */
+async function fetchOpenAICompatibleModelIds(provider) {
+    const base = provider.baseURL.replace(/\/+$/, "");
+    const response = await fetch(`${base}/models`, {
+        headers: {
+            Authorization: `Bearer ${provider.apiKey}`,
+            ...(provider.headers ?? {}),
+        },
+        signal: AbortSignal.timeout(MODEL_DISCOVERY_TIMEOUT_MS),
+    });
+    if (!response.ok)
+        throw new Error(`HTTP ${response.status}`);
+    const payload = (await response.json());
+    const entries = payload.data ?? payload.models ?? [];
+    return entries
+        .filter((entry) => typeof entry?.id === "string" && entry.id.trim().length > 0)
+        .map((entry) => ({
+        id: entry.id,
+        name: typeof entry.name === "string" ? entry.name : undefined,
+    }));
+}
+/** Keep only string-valued headers; returns undefined for empty/invalid maps. */
+export function sanitizeProviderHeaders(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const out = {};
+    for (const [key, raw] of Object.entries(value)) {
+        if (typeof raw === "string" && key.trim())
+            out[key] = raw;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
 const MODEL_DISCOVERY_SUCCESS_TTL_MS = 60_000;
 const MODEL_DISCOVERY_FAILURE_TTL_MS = 10_000;
+/** Discovery must never delay startup or a model picker for long. */
+const MODEL_DISCOVERY_TIMEOUT_MS = 5_000;
 export const BUILTIN_PROVIDERS = CATALOG_PROVIDERS;
 export const USER_VISIBLE_PROVIDER_IDS = BUILTIN_PROVIDERS
     .filter((provider) => !provider.hidden && provider.id !== "openrouter" && provider.id !== "openai-codex")
@@ -230,6 +278,7 @@ export class ProviderRegistry {
                     enabled: true,
                     authType: "api",
                     protocol: resolveConfiguredProtocol(id, baseURL, cfg.protocol),
+                    headers: sanitizeProviderHeaders(cfg.headers),
                 };
             });
         }
@@ -241,6 +290,7 @@ export class ProviderRegistry {
                     ...provider,
                     baseURL,
                     protocol: resolveConfiguredProtocol(provider.id, baseURL, provider.protocol),
+                    headers: sanitizeProviderHeaders(provider.headers),
                 };
             });
         }
@@ -472,6 +522,79 @@ export class ProviderRegistry {
                 return this.fallbackDiscovery(provider, error);
             }
         }
+        // Grok subscription: the CLI chat proxy gates on the grok-cli identity
+        // headers and a fresh OAuth bearer, neither of which the generic path below
+        // sends. Discover through the refreshing subscription fetch, then merge the
+        // curated catalog with any remote-only ids so newly-released models surface
+        // without a code change. Authoritative because the merged list is what the
+        // routing catalog and model picker should treat as the account's catalog.
+        if (provider.id === "grok" && provider.authType === "oauth" && provider.apiKey) {
+            try {
+                await this.prepareProvider("grok");
+                const currentProvider = this.getConfigured().find((item) => item.id === "grok") ?? provider;
+                const grokAuth = this.createGrokAuthAdapter("grok");
+                if (!grokAuth)
+                    throw new Error("Grok OAuth credentials are unavailable.");
+                const remote = await fetchGrokSubscriptionModels(currentProvider.baseURL, grokAuth);
+                const local = this.localModelsForProvider(currentProvider);
+                const known = new Set(local.map((model) => model.id));
+                const extras = remote
+                    .filter((entry) => !known.has(entry.id) && isLikelyChatModelId(entry.id))
+                    .map((entry) => {
+                    const inferred = inferGrokReasoningLevels(entry.id);
+                    return {
+                        id: entry.id,
+                        name: entry.name || entry.id,
+                        providerId: currentProvider.id,
+                        reasoningLevels: inferred.levels,
+                        ...(inferred.defaultLevel ? { defaultReasoningLevel: inferred.defaultLevel } : {}),
+                    };
+                })
+                    .sort((a, b) => a.id.localeCompare(b.id));
+                return {
+                    models: [...local, ...extras],
+                    source: "remote",
+                    authoritative: true,
+                };
+            }
+            catch (error) {
+                return this.fallbackDiscovery(provider, error);
+            }
+        }
+        // Generic OpenAI-compatible discovery: most vendors expose GET /models on
+        // the same base URL. Probed against every configured provider, their lists
+        // turned out to be neither complete nor clean — zhipuai omits glm-5.2,
+        // stepfun omits step-3.7-flash (both demonstrably usable), alibaba returns
+        // 236 entries including image/audio models, fireworks 412s. So the remote
+        // list AUGMENTS the curated catalog instead of replacing it: builtin
+        // entries always survive (they carry tier/reasoning metadata and some work
+        // while unlisted), remote-only ids are appended, obvious non-chat
+        // modalities are filtered out. Not authoritative — membership is a union,
+        // so nothing downstream may treat it as a closed allowlist.
+        if (isOpenAICompatibleProtocol(provider.protocol) && provider.apiKey) {
+            try {
+                const remote = await fetchOpenAICompatibleModelIds(provider);
+                const local = this.localModelsForProvider(provider);
+                const known = new Set(local.map((model) => model.id));
+                const extras = remote
+                    .filter((entry) => !known.has(entry.id) && isLikelyChatModelId(entry.id))
+                    .map((entry) => ({
+                    id: entry.id,
+                    name: entry.name || entry.id,
+                    providerId: provider.id,
+                }))
+                    .sort((a, b) => a.id.localeCompare(b.id));
+                if (extras.length === 0) {
+                    return { models: local, source: "static", authoritative: true };
+                }
+                return { models: [...local, ...extras], source: "remote", authoritative: false };
+            }
+            catch {
+                // Vendors that don't implement /models (or gate it) fall back silently:
+                // the curated catalog is the contract, discovery is a bonus.
+                return { models: this.localModelsForProvider(provider), source: "static", authoritative: true };
+            }
+        }
         return {
             models: this.localModelsForProvider(provider),
             source: "static",
@@ -559,7 +682,9 @@ export class ProviderRegistry {
             ? "openai-codex"
             : provider.id === "google" && provider.protocol === "ai-sdk"
                 ? "google"
-                : undefined;
+                : provider.id === "grok"
+                    ? "grok"
+                    : undefined;
         if (!dynamicProviderId)
             return;
         if (!result.authoritative) {
@@ -570,8 +695,11 @@ export class ProviderRegistry {
             id: model.id,
             name: model.name,
             providerId: dynamicProviderId,
-            // Empty means the remote model exists but declared no trusted effort metadata.
-            reasoningLevels: model.reasoningLevels ?? [],
+            // A remote model with no trusted effort metadata still has to be
+            // selectable: default it to the plain "off" level (no reasoning control)
+            // rather than an empty ladder, which the model picker would render
+            // "unavailable" and skip during arrow-key navigation.
+            reasoningLevels: model.reasoningLevels ?? ["off"],
             defaultReasoningLevel: model.defaultReasoningLevel,
             contextWindow: model.contextWindow,
             useResponsesLite: model.useResponsesLite,

package/dist/provider-transform.js

@@ -2,7 +2,17 @@ import { getBuiltinModel } from "./model-catalog.js";
 import { getAvailableThinkingLevels, normalizeInheritedThinkingLevel, normalizeThinkingLevel } from "./variant/variant-resolver.js";
 export { getAvailableThinkingLevels, getDefaultThinkingLevel, isThinkingOnlyLevels, isThinkingOnlyModel, isThinkingToggleModel, normalizeInheritedThinkingLevel, normalizeThinkingLevel } from "./variant/variant-resolver.js";
 const MOONSHOT_PROVIDER_IDS = new Set(["moonshot-cn", "moonshot-intl", "kimi-for-coding"]);
-const KIMI_K27_FAMILY = new Set(["kimi-k2.7-code", "kimi-k2.7-code-highspeed"]);
+const KIMI_K27_FAMILY = new Set([
+    "kimi-k2.7-code",
+    "kimi-k2.7-code-highspeed",
+    // Coding-plan slot ids for the same generation (GET /coding/v1/models).
+    "kimi-for-coding",
+    "kimi-for-coding-highspeed",
+]);
+// K3 takes OpenAI-style reasoning_effort (low/high/max, no "medium"); "off"
+// disables thinking via top-level thinking.type. Verified live: effort changes
+// reasoning-token spend, and nested extra_body.thinking is ignored server-side.
+const KIMI_K3_FAMILY = new Set(["k3", "k3-256k", "kimi-k3"]);
 const KIMI_TOGGLE_THINKING_FAMILY = new Set(["kimi-k2.5", "kimi-k2.6"]);
 const KIMI_K26_DEFAULT_MAX_TOKENS = 32768;
 const MINIMAX_M3_FAMILY = new Set(["MiniMax-M3"]);
@@ -60,6 +70,18 @@ export function resolveProviderRequestConfig(providerId, modelId, requestedLevel
             },
         };
     }
+    // Bailian token plan speaks OpenAI-compatible reasoning_effort, with "none"
+    // as its off value (verified: enable_thinking=false works too, but "none"
+    // keeps one parameter for every level). Grades are validated server-side —
+    // an unknown value is a 400 — so the catalog's per-model ladder matters.
+    if (providerId === "bailian-token-plan") {
+        return {
+            effectiveThinkingLevel,
+            extraBody: {
+                reasoning_effort: effectiveThinkingLevel === "off" ? "none" : effectiveThinkingLevel,
+            },
+        };
+    }
     if (providerId === "stepfun") {
         return {
             effectiveThinkingLevel,
@@ -137,6 +159,20 @@ export function resolveProviderRequestConfig(providerId, modelId, requestedLevel
                 },
             };
         }
+        if (KIMI_K3_FAMILY.has(modelId)) {
+            return {
+                effectiveThinkingLevel,
+                omitTemperature: true,
+                reasoningContentEcho: "tool_calls",
+                // extraBody spreads onto the request body verbatim. The sibling
+                // `reasoningEffort` field is NOT the same thing: the generic chat path
+                // turns it into OpenRouter's `reasoning: {enabled: true}`, which drops
+                // the grade entirely.
+                extraBody: effectiveThinkingLevel === "off"
+                    ? { thinking: { type: "disabled" } }
+                    : { reasoning_effort: effectiveThinkingLevel },
+            };
+        }
         if (KIMI_TOGGLE_THINKING_FAMILY.has(modelId)) {
             return {
                 effectiveThinkingLevel,

package/dist/provider.d.ts

@@ -28,6 +28,13 @@ export interface ProviderInstanceOptions {
     /** Stable per-session seed for provider prompt caches. */
     promptCacheKey?: string;
     protocol?: ProviderProtocol;
+    /**
+     * User-configured extra request headers (provider entry `headers` in
+     * config.json/models.json). Merged over protocol defaults, so a coding-plan
+     * endpoint's client-identity gate (usually a User-Agent allowlist) can be
+     * satisfied from config.
+     */
+    headers?: Record<string, string>;
     /** Dynamic OAuth access-token loader/refresh hook for ChatGPT Codex requests. */
     openAICodexAuth?: OpenAICodexAuthAdapter;
     /** Dynamic OAuth access-token loader/refresh hook for Grok subscription requests. */

package/dist/provider.js

@@ -102,13 +102,19 @@ export function createProviderInstance(options) {
     // CLI identity headers the proxy gates on, plus a fetch that keeps the
     // short-lived OAuth bearer fresh (and proxy-aware) across long sessions.
     const grokSubscription = options.providerId === "grok" || isGrokSubscriptionBaseUrl(options.baseURL);
+    // User-configured headers merge over the built-in identity headers so a
+    // config entry can override even the Grok defaults deliberately.
+    const defaultHeaders = {
+        ...(grokSubscription ? buildGrokSubscriptionHeaders() : {}),
+        ...(options.headers ?? {}),
+    };
     const client = new OpenAI({
         apiKey: options.apiKey,
         baseURL: options.baseURL,
         timeout: resolveRequestTimeoutMs(process.env.BUBBLE_PROVIDER_REQUEST_TIMEOUT_MS),
+        ...(Object.keys(defaultHeaders).length > 0 ? { defaultHeaders } : {}),
         ...(grokSubscription
             ? {
-                defaultHeaders: buildGrokSubscriptionHeaders(),
                 fetch: (options.grokAuth
                     ? createGrokSubscriptionFetch(options.grokAuth)
                     : getChatGptFetch()),
@@ -266,10 +272,16 @@ function shouldRequestStreamUsage(options) {
         || providerId === "deepseek"
         || providerId === "moonshot-cn"
         || providerId === "moonshot-intl"
+        // Verified 2026-08-04: this endpoint streams NO usage at all without the
+        // flag, so every coding-plan session was silently unpriced and left the
+        // context-budget anchor guessing.
+        || providerId === "kimi-for-coding"
         || providerId === "zhipuai"
         || providerId === "zhipuai-coding-plan"
         || providerId === "zai"
         || providerId === "zai-coding-plan"
+        // Bailian sends usage either way; ask explicitly so it stays guaranteed.
+        || providerId === "bailian-token-plan"
         || isMiniMaxOpenAICompatible(options);
 }
 function shouldUseNonStreamingToolCalls(options, tools, toolChoice) {

package/dist/sdk/index.d.ts

@@ -0,0 +1,152 @@
+/**
+ * Bubble SDK — the programmatic embedding surface for external hosts.
+ *
+ * Two layers:
+ *  1. `BubbleSdk` — a high-level facade that owns config/provider resolution and
+ *     assembles a full agent turn (tools, approvals, questions, plan mode, MCP,
+ *     skills, hooks, session persistence) behind a single `runTurn()` async
+ *     iterator of `AgentEvent`s. This is what a host like an Electron app should
+ *     consume: wire the three interaction callbacks (approval / question / plan)
+ *     to its own UI and map the event stream to its own message format.
+ *  2. Curated re-exports of the underlying building blocks, for hosts that need
+ *     to assemble a custom loop the facade doesn't cover.
+ *
+ * Runs under plain Node (>=20); nothing here touches the TUI layer.
+ */
+import { type SessionSummary } from "../session.js";
+import type { ApprovalDecision, ApprovalRequest } from "../approval/types.js";
+import { UserConfig } from "../config.js";
+import { ProviderRegistry } from "../provider-registry.js";
+import { type QuestionAnswer, type QuestionRequest } from "../question/controller.js";
+import { SkillRegistry } from "../skills/registry.js";
+import type { SkillSummary } from "../skills/types.js";
+import type { AgentEvent, ContentPart, Message, PermissionMode, ThinkingLevel } from "../types.js";
+export interface BubbleSdkOptions {
+    /** Fallback working directory for sessions created without an explicit cwd. */
+    defaultCwd?: string;
+    /**
+     * Load MCP servers from user/project settings (default true). Hermetic hosts
+     * (evals, tests) set false so runs never depend on ambient MCP config.
+     */
+    mcp?: boolean;
+}
+/** Resolved turn configuration, reported via onStart (e.g. for a host's system-init event). */
+export interface TurnStartInfo {
+    providerId: string;
+    model: string;
+    thinkingLevel: ThinkingLevel;
+    mode: PermissionMode;
+    tools: string[];
+    skills: string[];
+}
+/** Host-side interaction callbacks for one turn. All optional; missing handlers fail safe (reject). */
+export interface TurnHandlers {
+    /**
+     * Tool call needs user permission (bash / edit / write / …). When the turn is
+     * aborted, any still-pending request auto-resolves to reject — the host's
+     * promise may settle later and is then ignored.
+     */
+    onApproval?: (req: ApprovalRequest) => Promise<ApprovalDecision>;
+    /** Agent asked the user a structured question. Return answers, or null to decline. */
+    onQuestion?: (req: QuestionRequest) => Promise<QuestionAnswer[] | null>;
+    /** Plan-mode proposal. Return true to approve executing the plan. */
+    onPlanApproval?: (planMarkdown: string) => Promise<boolean>;
+    /** Fired once per turn after provider/model/tools are resolved, before the first event. */
+    onStart?: (info: TurnStartInfo) => void;
+}
+export interface RunTurnOptions extends TurnHandlers {
+    /** Plain text, or content parts (text + base64 images) for attachments. */
+    prompt: string | ContentPart[];
+    /** "provider:model" or bare model id (resolved against the default provider). */
+    model?: string;
+    mode?: PermissionMode;
+    thinkingLevel?: ThinkingLevel;
+    /**
+     * Extra text appended to the built system prompt. Lets hosts (and the eval
+     * harness) A/B prompt variants without forking the prompt builder.
+     */
+    appendSystemPrompt?: string;
+    signal?: AbortSignal;
+}
+export interface SdkSessionRef {
+    id: string;
+    cwd: string;
+}
+export declare class BubbleSdk {
+    readonly userConfig: UserConfig;
+    readonly registry: ProviderRegistry;
+    private readonly defaultCwd;
+    private readonly mcpEnabled;
+    private readonly cwdBySession;
+    private readonly bashAllowlists;
+    private readonly activeTurns;
+    private readonly mcpToolsByCwd;
+    /** id -> {cwd,file} rebuilt from disk so sessions survive host restarts. */
+    private sessionIndex;
+    constructor(options?: BubbleSdkOptions);
+    listSessions(): SessionSummary[];
+    createSession(options?: {
+        cwd?: string;
+        id?: string;
+    }): SdkSessionRef;
+    getHistory(sessionId: string): Message[];
+    deleteSession(sessionId: string): void;
+    /** Abort the in-flight turn of a session, if any. */
+    stop(sessionId: string): void;
+    listSkills(cwd?: string): SkillSummary[];
+    /** Configured providers + default model, for a host's model picker. */
+    getModelConfig(): {
+        defaultProviderId: string;
+        defaultModel: string;
+        providers: Array<{
+            id: string;
+            baseURL?: string;
+            hasApiKey: boolean;
+        }>;
+    };
+    runTurn(sessionId: string, options: RunTurnOptions): AsyncGenerator<AgentEvent>;
+    private bashAllowlistFor;
+    /** MCP servers are started lazily, once per cwd (McpManager has no stop). */
+    private mcpToolsFor;
+    private resolveSession;
+    private resolveProvider;
+}
+/**
+ * Attach a `cost` field to turn_end events that carry usage, priced via the
+ * static pricing table. Pricing is an accounting concern, so it rides along
+ * here in the SDK rather than in the agent core. Multi-step turns emit several
+ * turn_end events; each cost covers only that step's usage, so hosts sum them.
+ * Events for unpriced models (or without usage) pass through untouched.
+ */
+export declare function attachTurnCost(event: AgentEvent, providerId: string, modelId: string): AgentEvent;
+/**
+ * If the prompt (or its first text part) is a "/<skill-name> <task>" skill
+ * invocation, rewrite it into the same explicit execution prompt the TUI
+ * sends. Non-matching prompts pass through untouched.
+ */
+export declare function rewriteSkillInvocationPrompt(prompt: string | ContentPart[], registry: SkillRegistry): string | ContentPart[];
+export { Agent, AgentAbortError, type AgentOptions, type AgentRunOptions } from "../agent.js";
+export { SessionManager, getSessionsDir, type SessionSummary, type UserTurn, type RewindResult, } from "../session.js";
+export { PermissionAwareApprovalController } from "../approval/controller.js";
+export { BashAllowlist } from "../approval/session-cache.js";
+export type { ApprovalController, ApprovalDecision, ApprovalRequest } from "../approval/types.js";
+export { createAllTools, buildToolPromptOptions, type PlanController } from "../tools/index.js";
+export { buildSystemPrompt } from "../system-prompt.js";
+export { FileStateTracker } from "../tools/file-state.js";
+export { BudgetLedger } from "../agent/budget-ledger.js";
+export { UserConfig } from "../config.js";
+export { ProviderRegistry, encodeModel, decodeModel, displayModel, type ProviderProfile, type ModelInfo, } from "../provider-registry.js";
+export { createProviderInstance } from "../provider.js";
+export { getDefaultThinkingLevel } from "../variant/variant-resolver.js";
+export { QuestionController, QuestionRejectedError, type QuestionAnswer, type QuestionEvent, type QuestionRequest, } from "../question/controller.js";
+export { SkillRegistry } from "../skills/registry.js";
+export { parseSkillInvocation, type SkillInvocation } from "../skills/invocation.js";
+export type { SkillSummary } from "../skills/types.js";
+export { GoalStore } from "../goal/store.js";
+export { McpManager } from "../mcp/manager.js";
+export { loadMcpConfig } from "../mcp/config.js";
+export { ExternalHookController } from "../hooks/controller.js";
+export { calculateUsageCost, getModelPricing, type ModelPricing, type PricingCurrency, } from "../model-pricing.js";
+export { registry as slashCommandRegistry } from "../slash-commands/index.js";
+export type { SlashCommandContext } from "../slash-commands/types.js";
+export type { AgentEvent, ContentPart, Message, PermissionMode, Provider, ThinkingLevel, Todo, TokenUsage, UsageCost, ToolRegistryEntry, ToolResult, ToolUpdate, } from "../types.js";