@code-yeongyu/senpi-ai 2026.10.10 → 2026.10.12

package/dist/api/openai-responses.js

@@ -1,5 +1,6 @@
 import OpenAI from "openai";
 import { calculateCost, clampThinkingLevel, inferOpenAIThinkingLevelMap, supportsMax, supportsXhigh, } from "../models.js";
+import { supportsAllowedToolChoice } from "../openai-responses-compat.js";
 import { readProviderDiagnostic } from "../provider-diagnostic.js";
 import { formatProviderError, normalizeProviderError } from "../utils/error-body.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
@@ -10,13 +11,14 @@ import { awaitProviderTransport, openAICompatibleProviderDiagnosticFromError, }
 import { getProviderEnvValue } from "../utils/provider-env.js";
 import { retryProviderRequest } from "../utils/provider-retry.js";
 import { sendWithForcedToolChoiceFallback } from "../utils/tool-choice-fallback.js";
-import { getCurrentTools, getDeclaredTools, normalizeContext, resolveTranscript } from "../utils/transcript.js";
+import { getDeclaredTools, normalizeContext, resolveTranscript } from "../utils/transcript.js";
 import { isCloudflareProvider, resolveCloudflareBaseUrl } from "./cloudflare.js";
 import { createGrammarToolInputProperties } from "./constrained-sampling.js";
 import { withGitHubCopilotFailureNote } from "./github-copilot-errors.js";
 import { buildCopilotDynamicHeaders, hasCopilotVisionInput } from "./github-copilot-headers.js";
 import { resolveOpenAIClientAuth } from "./openai-client-auth.js";
 import { clampOpenAIPromptCacheKey } from "./openai-prompt-cache.js";
+import { applyAllowedToolsChoice, hasRefusedAllowedToolsChoice, isAllowedToolsChoiceRefusal, rememberAllowedToolsChoiceRefusal, restrictToAllowedTools, } from "./openai-responses-allowed-tools.js";
 import { findPromptCacheComparisonResponseId, withPromptCacheComparison, } from "./openai-responses-prompt-cache.js";
 import { convertResponsesMessages, convertResponsesTools, processResponsesStream, resolveResponsesDeferredToolsMode, resolveResponsesToolPlacement, } from "./openai-responses-shared.js";
 import { buildBaseOptions, clampMaxForOpenAI, OPENAI_RESPONSES_RESERVED_BODY_KEYS } from "./simple-options.js";
@@ -61,6 +63,7 @@ function getCompat(model, env) {
         supportsWebSocket: model.compat?.supportsWebSocket ?? isNativeEndpoint,
         supportsRemoteCompactionV2: model.compat?.supportsRemoteCompactionV2 ?? isNativeEndpoint,
         supportsWebSearchPreview: model.compat?.supportsWebSearchPreview ?? isNativeEndpoint,
+        webSearchToolType: model.compat?.webSearchToolType ?? "web_search_preview",
         supportsImageGeneration: model.compat?.supportsImageGeneration ?? isNativeEndpoint,
         supportsStrictMode: model.compat?.supportsStrictMode ?? false,
         supportsOpenAIGrammarTools: model.compat?.supportsOpenAIGrammarTools ?? false,
@@ -70,7 +73,7 @@ function getCompat(model, env) {
         supportsConfigurationUpdate: model.compat?.supportsConfigurationUpdate ?? false,
         supportsMaxOutputTokens: model.compat?.supportsMaxOutputTokens ?? true,
         supportsForcedToolChoice: model.compat?.supportsForcedToolChoice ?? true,
-        supportsAllowedTools: model.compat?.supportsAllowedTools ?? false,
+        supportsAllowedTools: supportsAllowedToolChoice(model),
     };
 }
 function isOpenAIResponsesNativeEndpoint(model, env) {
@@ -100,7 +103,10 @@ function isRecord(value) {
     return typeof value === "object" && value !== null;
 }
 function isOpenAiWebSearchPreviewTool(value) {
-    return isRecord(value) && (value.type === "web_search_preview" || value.type === "web_search_preview_2025_03_11");
+    return (isRecord(value) &&
+        (value.type === "web_search" ||
+            value.type === "web_search_preview" ||
+            value.type === "web_search_preview_2025_03_11"));
 }
 function sanitizeUnsupportedNativeTools(params, compat) {
     if (compat.supportsWebSearchPreview) {
@@ -141,53 +147,6 @@ function sanitizeUnsupportedNativeTools(params, compat) {
     }
     return sanitized ? sanitized : params;
 }
-function allowedReference(tool) {
-    if (tool.type === "function" || tool.type === "custom")
-        return { type: tool.type, name: tool.name };
-    if (tool.type === "mcp")
-        return { type: "mcp", server_label: tool.server_label };
-    return { type: tool.type };
-}
-/**
- * senpi#2095: `tools` carries every tool declared this session, so removing a tool never rewrites the
- * cached prefix; the callable subset rides `tool_choice: allowed_tools` instead. Hosted tools a payload
- * hook added stay callable, and deferred tools (declared by transcript items rather than `tools`) are
- * referenced by name. A declared tool a payload hook removed from `tools` is not referenced (senpi#2234).
- * An empty subset forbids tool calls. An explicit `tool_choice` always wins.
- */
-function applyAllowedToolsChoice(params, context, activeToolNames, compat) {
-    if (!compat.supportsAllowedTools || activeToolNames === undefined || params.tool_choice !== undefined) {
-        return params;
-    }
-    const active = new Set(activeToolNames);
-    const declaredTools = getCurrentTools(context.messages);
-    if (declaredTools.every((tool) => active.has(tool.name)))
-        return params;
-    const allowed = [];
-    const namedInTools = new Set();
-    for (const tool of params.tools ?? []) {
-        if (tool.type === "function" || tool.type === "custom") {
-            namedInTools.add(tool.name);
-            if (!active.has(tool.name))
-                continue;
-        }
-        allowed.push(allowedReference(tool));
-    }
-    // Tools missing from the request-level `tools` placement are the ones transcript items load in place.
-    const requestToolNames = new Set(resolveResponsesToolPlacement(context.messages, resolveResponsesDeferredToolsMode(compat) !== undefined).requestTools.map((tool) => tool.name));
-    for (const tool of declaredTools) {
-        if (namedInTools.has(tool.name) || !active.has(tool.name) || requestToolNames.has(tool.name))
-            continue;
-        const [converted] = convertResponsesTools([tool], {
-            supportsStrictMode: compat.supportsStrictMode,
-            supportsOpenAIGrammarTools: compat.supportsOpenAIGrammarTools,
-        });
-        if (converted)
-            allowed.push(allowedReference(converted));
-    }
-    const toolChoice = allowed.length > 0 ? { type: "allowed_tools", mode: "auto", tools: allowed } : "none";
-    return { ...params, tool_choice: toolChoice };
-}
 function formatOpenAIResponsesError(error, provider) {
     const errorMessage = formatProviderError(normalizeProviderError(error), `${provider === "openai" ? "OpenAI" : provider} API error`);
     // Sign in with ChatGPT shares the subscription's usage limit with other apps.
@@ -234,12 +193,15 @@ export const stream = (model, context, options) => {
             }
             params = sanitizeUnsupportedNativeTools(params, compat);
             params = applyAllowedToolsChoice(params, normalizedContext, context.activeToolNames, compat);
+            if (hasRefusedAllowedToolsChoice(model))
+                params = restrictToAllowedTools(params);
             const limitedTools = limitGitHubCopilotTools(model.provider, params.tools, params.tool_choice);
             if (limitedTools.omittedCount > 0) {
                 params = { ...params, tools: limitedTools.tools };
                 recordGitHubCopilotToolLimit(output, limitedTools.omittedCount);
             }
             const transport = options?.transport ?? "sse";
+            let refusedAllowedToolsOverWebSocket = false;
             if (transport !== "sse" && compat.supportsWebSocket) {
                 let websocketStarted = false;
                 try {
@@ -254,9 +216,16 @@ export const stream = (model, context, options) => {
                     return;
                 }
                 catch (error) {
-                    if (transport === "websocket" || websocketStarted) {
+                    const refusedAllowedTools = output.content.length === 0 && isAllowedToolsChoiceRefusal(error, params, { beforeContent: true });
+                    if (!refusedAllowedTools && (transport === "websocket" || websocketStarted)) {
                         throw error;
                     }
+                    if (refusedAllowedTools) {
+                        params = restrictToAllowedTools(params);
+                        refusedAllowedToolsOverWebSocket = true;
+                        output.stopReason = "pending";
+                        delete output.errorMessage;
+                    }
                 }
             }
             const requestOptions = {
@@ -264,26 +233,46 @@ export const stream = (model, context, options) => {
                 ...(options?.timeoutMs !== undefined ? { timeout: options.timeoutMs } : {}),
                 maxRetries: 0,
             };
-            const createRequest = async () => {
+            const sendOnce = async (body) => {
                 const sent = await sendWithForcedToolChoiceFallback({
                     target: model,
-                    params,
+                    params: body,
                     acceptsForcedToolChoice: compat.supportsForcedToolChoice,
                     isForced: isForcedOpenAIResponsesToolChoice,
-                    send: (body) => model.provider === "github-copilot"
-                        ? awaitProviderTransport(() => client.responses.create(body, requestOptions).withResponse(), openAICompatibleProviderDiagnosticFromError)
-                        : client.responses.create(body, requestOptions).withResponse(),
+                    send: (request) => model.provider === "github-copilot"
+                        ? awaitProviderTransport(() => client.responses.create(request, requestOptions).withResponse(), openAICompatibleProviderDiagnosticFromError)
+                        : client.responses.create(request, requestOptions).withResponse(),
                 });
                 params = sent.params;
                 return sent.result;
             };
+            // senpi#3080: an endpoint that refuses `allowed_tools` gets the request restricted to the active
+            // tools; the model is remembered once that restricted request is accepted.
+            const createRequest = async () => {
+                try {
+                    const result = await sendOnce(params);
+                    if (refusedAllowedToolsOverWebSocket)
+                        rememberAllowedToolsChoiceRefusal(model);
+                    return result;
+                }
+                catch (error) {
+                    if (!isAllowedToolsChoiceRefusal(error, params))
+                        throw error;
+                    params = restrictToAllowedTools(params);
+                    const result = await sendOnce(params);
+                    rememberAllowedToolsChoiceRefusal(model);
+                    return result;
+                }
+            };
             const { data: openaiStream, response } = await retryProviderRequest(() => createRequest(), {
                 maxRetries: options?.maxRetries,
                 maxRetryDelayMs: options?.maxRetryDelayMs,
                 signal: options?.signal,
             });
             await options?.onResponse?.({ status: response.status, headers: headersToRecord(response.headers) }, model);
-            stream.push({ type: "start", partial: output });
+            // A WebSocket attempt that fell through after its refusal already pushed `start`.
+            if (!refusedAllowedToolsOverWebSocket)
+                stream.push({ type: "start", partial: output });
             await processResponsesStream(openaiStream, output, stream, model, {
                 onProviderStreamEvent: options?.onProviderStreamEvent,
                 serviceTier: options?.serviceTier,
@@ -861,9 +850,9 @@ function buildWebSocketHeaders(model, context, apiKey, optionsHeaders, sessionId
 function getServiceTierCostMultiplier(model, serviceTier) {
     switch (serviceTier) {
         case "ultrafast":
-            // OpenAI publishes an Ultrafast price for GPT-6 Astra only: 6x Standard on every
+            // OpenAI prices GPT-6 Astra and GPT-6.1 Sol Ultrafast at 6x Standard on every
             // token class and context tier. Any other model keeps its base rate.
-            return model.id === "gpt-6-astra" ? 6 : 1;
+            return ["gpt-6-astra", "gpt-6.1-sol"].includes(model.upstreamModelId ?? model.id) ? 6 : 1;
         case "flex":
             return 0.5;
         case "priority":

package/dist/auth/oauth/anthropic.js

@@ -4,6 +4,7 @@
  * NOTE: This module uses Node.js http.createServer for the OAuth callback server.
  * It is only intended for CLI use, not browser environments.
  */
+import { OAuthTokenEndpointError } from "../../utils/oauth-refresh-error.js";
 import { getProviderEnvValue } from "../../utils/provider-env.js";
 import { PREFERRED_CALLBACK_PORT, startCallbackListener, } from "./anthropic-callback-listener.js";
 import { parseAuthorizationInput } from "./authorization-input.js";
@@ -57,7 +58,7 @@ async function postJson(url, body, signal) {
     });
     const responseBody = await response.text();
     if (!response.ok) {
-        throw new Error(`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`);
+        throw new OAuthTokenEndpointError(`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`, response.status);
     }
     return responseBody;
 }
@@ -74,7 +75,7 @@ async function exchangeAuthorizationCode(code, state, verifier, redirectUri, sig
         }, signal);
     }
     catch (error) {
-        throw new Error(`Token exchange request failed. url=${TOKEN_URL}; redirect_uri=${redirectUri}; response_type=authorization_code; details=${formatErrorDetails(error)}`);
+        throw new Error(`Token exchange request failed. url=${TOKEN_URL}; redirect_uri=${redirectUri}; response_type=authorization_code; details=${formatErrorDetails(error)}`, { cause: error });
     }
     let tokenData;
     try {
@@ -240,7 +241,7 @@ async function refreshAnthropicToken(refreshToken, signal) {
         }, signal);
     }
     catch (error) {
-        throw new Error(`Anthropic token refresh request failed. url=${TOKEN_URL}; details=${formatErrorDetails(error)}`);
+        throw new Error(`Anthropic token refresh request failed. url=${TOKEN_URL}; details=${formatErrorDetails(error)}`, { cause: error });
     }
     let data;
     try {

package/dist/auth/oauth/chatgpt-subscription.js

@@ -12,6 +12,7 @@ if (typeof process !== "undefined" && (process.versions?.node || process.version
     });
 }
 import { extractChatGptSubscriptionAccountId } from "../../utils/chatgpt-subscription-auth.js";
+import { OAuthTokenEndpointError } from "../../utils/oauth-refresh-error.js";
 import { getProviderEnvValue } from "../../utils/provider-env.js";
 import { getWireIdentity } from "../../wire-identity.js";
 import { startOAuthCallbackServer, waitForCallbackOrManualInput } from "./callback-server.js";
@@ -80,7 +81,7 @@ async function fetchWithLoginCancellation(input, init) {
 async function readTokenResponse(response, operation) {
     if (!response.ok) {
         const text = await response.text().catch(() => "");
-        throw new Error(`ChatGPT Subscription token ${operation} failed (${response.status}): ${text || response.statusText}`);
+        throw new OAuthTokenEndpointError(`ChatGPT Subscription token ${operation} failed (${response.status}): ${text || response.statusText}`, response.status);
     }
     const rawJson = await response.json();
     const json = rawJson;
@@ -123,7 +124,7 @@ async function refreshAccessToken(refreshToken, signal) {
         });
     }
     catch (error) {
-        throw new Error(`ChatGPT Subscription token refresh error: ${error instanceof Error ? error.message : String(error)}`);
+        throw new Error(`ChatGPT Subscription token refresh error: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
     return readTokenResponse(response, "refresh");
 }

package/dist/auth/oauth/cursor.js

@@ -10,6 +10,7 @@
  * (or a dashboard user API key) at `auth/exchange_user_api_key` for a fresh
  * session JWT.
  */
+import { OAuthTokenEndpointError } from "../../utils/oauth-refresh-error.js";
 import { generatePKCE } from "./pkce.js";
 const CURSOR_LOGIN_URL = "https://cursor.com/loginDeepControl";
 const CURSOR_POLL_URL = "https://api2.cursor.sh/auth/poll";
@@ -205,12 +206,12 @@ async function refreshCursorCredential(credential, signal) {
     }
     catch (error) {
         if (signal.aborted)
-            throw new Error("Cursor token refresh cancelled");
+            throw new Error("Cursor token refresh cancelled", { cause: signal.reason });
         throw error;
     }
     const body = await readJsonBody(response);
     if (!response.ok) {
-        throw new Error(`Cursor token refresh failed (${describeFailure(response.status, body)})`);
+        throw new OAuthTokenEndpointError(`Cursor token refresh failed (${describeFailure(response.status, body)})`, response.status);
     }
     const access = requiredString(body ?? {}, "accessToken");
     const rotated = body?.refreshToken;

package/dist/auth/oauth/devin-token.js

@@ -7,6 +7,7 @@
  * "token" that serves as both the access and the refresh credential. Expiry is
  * read from the JWT itself because the response carries no expires_in.
  */
+import { OAuthTokenEndpointError } from "../../utils/oauth-refresh-error.js";
 export const DEVIN_TOKEN_URL = "https://api.devin.ai/auth/cli/token";
 export const DEVIN_API_ENDPOINT = "https://api.devin.ai";
 /** Devin issues long-lived CLI tokens; used when the JWT carries no usable exp. */
@@ -91,7 +92,7 @@ export async function exchangeDevinAuthorizationCode(code, verifier, signal) {
     }
     if (!response.ok) {
         const detail = errorDetail(body);
-        throw new Error(`Devin OAuth token exchange failed (HTTP ${response.status})${detail ? `: ${detail}` : ""}`);
+        throw new OAuthTokenEndpointError(`Devin OAuth token exchange failed (HTTP ${response.status})${detail ? `: ${detail}` : ""}`, response.status);
     }
     if (typeof body.token !== "string" || body.token.length === 0) {
         throw new Error('Devin OAuth response carries no "token"');

package/dist/auth/oauth/github-copilot.js

@@ -3,6 +3,7 @@
  */
 import { GITHUB_COPILOT_INDIVIDUAL_BASE_URL, githubCopilotTokenField, parseGitHubCopilotApiEndpoint, resolveGitHubCopilotBaseUrl, } from "../../api/github-copilot-endpoint.js";
 import { GITHUB_COPILOT_REJECTED_TOKEN_STATUSES } from "../../api/github-copilot-headers.js";
+import { OAuthTokenEndpointError } from "../../utils/oauth-refresh-error.js";
 import { sleep } from "../../utils/sleep.js";
 import { pollOAuthDeviceCodeFlow } from "./device-code.js";
 import { parseGitHubCopilotModelCatalog } from "./github-copilot-model-catalog.js";
@@ -79,7 +80,7 @@ async function fetchGitHubCopilotModels(copilotToken, enterpriseDomain, signal,
         },
     }, signal, retryPolicy);
     if (!response.ok) {
-        throw new Error(`${response.status} ${response.statusText}: ${await response.text()}`);
+        throw new OAuthTokenEndpointError(`${response.status} ${response.statusText}: ${await response.text()}`, response.status);
     }
     return parseGitHubCopilotModelCatalog(await response.json(), allowPolicyFallback);
 }
@@ -87,7 +88,7 @@ async function fetchJson(url, init) {
     const response = await fetch(url, init);
     if (!response.ok) {
         const text = await response.text();
-        throw new Error(`${response.status} ${response.statusText}: ${text}`);
+        throw new OAuthTokenEndpointError(`${response.status} ${response.statusText}: ${text}`, response.status);
     }
     return response.json();
 }

package/dist/auth/oauth/kimi-coding.js

@@ -6,6 +6,7 @@
  * access token authenticates requests to that region's coding API as an
  * `Authorization: Bearer` header; see kimi-region.ts for the host table.
  */
+import { OAuthTokenEndpointError } from "../../utils/oauth-refresh-error.js";
 import { sleep } from "../../utils/sleep.js";
 import { pollOAuthDeviceCodeFlow } from "./device-code.js";
 import { kimiCodeIdentityHeaders } from "./kimi-identity.js";
@@ -178,7 +179,7 @@ async function refreshToken(oauthHost, refreshTokenValue, signal) {
             await sleep(1000 * 2 ** (attempt - 1), signal);
         }
         if (signal.aborted) {
-            throw new Error("Kimi Code token refresh aborted");
+            throw new Error("Kimi Code token refresh aborted", { cause: signal.reason });
         }
         let response;
         try {
@@ -208,14 +209,14 @@ async function refreshToken(oauthHost, refreshTokenValue, signal) {
         // Unauthorized: the stored credential is dead; Models clears it and prompts re-login.
         if (response.status === 401 || response.status === 403 || json?.error === "invalid_grant") {
             const description = typeof json?.error_description === "string" ? `: ${json.error_description}` : "";
-            throw new Error(`Kimi Code token refresh unauthorized (status ${response.status})${description}`);
+            throw new OAuthTokenEndpointError(`Kimi Code token refresh unauthorized (status ${response.status})${description}`, response.status);
         }
         if (isRetryableRefreshFailure(response) && attempt < REFRESH_MAX_RETRIES) {
-            lastError = new Error(`Kimi Code token refresh failed with status ${response.status}`);
+            lastError = new OAuthTokenEndpointError(`Kimi Code token refresh failed with status ${response.status}`, response.status);
             continue;
         }
         const text = JSON.stringify(json);
-        throw new Error(`Kimi Code token refresh failed with status ${response.status}${text ? `: ${text}` : ""}`);
+        throw new OAuthTokenEndpointError(`Kimi Code token refresh failed with status ${response.status}${text ? `: ${text}` : ""}`, response.status);
     }
     throw lastError ?? new Error("Kimi Code token refresh failed");
 }

package/dist/auth/oauth/openai-chatgpt.js

@@ -7,6 +7,7 @@
 import { randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import { oauthErrorHtml, oauthSuccessHtml } from "../../utils/oauth-page.js";
+import { OAuthTokenEndpointError } from "../../utils/oauth-refresh-error.js";
 import { getProviderEnvValue } from "../../utils/provider-env.js";
 import { generatePKCE } from "./pkce.js";
 // every login registers a new client with this ID; OpenAI returns the issued client ID in the callback
@@ -119,7 +120,7 @@ async function requestToken(body, signal) {
     });
     if (!response.ok) {
         const responseBody = await response.text().catch(() => "");
-        throw new Error(`OpenAI OAuth token request failed (${response.status}): ${responseBody || response.statusText}`);
+        throw new OAuthTokenEndpointError(`OpenAI OAuth token request failed (${response.status}): ${responseBody || response.statusText}`, response.status);
     }
     const data = await response.json();
     if (typeof data !== "object" || data === null || Array.isArray(data)) {

package/dist/auth/oauth/openrouter.js

@@ -10,6 +10,7 @@
  * NOTE: This module uses node:http (via callback-server.ts) for the OAuth callback server.
  * It is only intended for CLI use, not browser environments.
  */
+import { OAuthTokenEndpointError } from "../../utils/oauth-refresh-error.js";
 import { getProviderEnvValue } from "../../utils/provider-env.js";
 import { startOAuthCallbackServer, waitForCallbackOrManualInput } from "./callback-server.js";
 import { generatePKCE } from "./pkce.js";
@@ -88,7 +89,7 @@ async function exchangeAuthorizationCode(code, verifier, signal) {
     }
     if (!response.ok) {
         const detail = errorDetail(body);
-        throw new Error(`OpenRouter OAuth key exchange failed (HTTP ${response.status})${detail ? `: ${detail}` : ""}`);
+        throw new OAuthTokenEndpointError(`OpenRouter OAuth key exchange failed (HTTP ${response.status})${detail ? `: ${detail}` : ""}`, response.status);
     }
     if (typeof body.key !== "string" || body.key.length === 0) {
         throw new Error('OpenRouter OAuth response carries no "key"');

package/dist/auth/oauth/radius.js

@@ -9,6 +9,7 @@
  * It is only intended for CLI use, not browser environments.
  */
 import { normalizeRadiusGatewayUrl } from "../../providers/radius-config.js";
+import { OAuthTokenEndpointError } from "../../utils/oauth-refresh-error.js";
 import { startOAuthCallbackServer } from "./callback-server.js";
 import { pollOAuthDeviceCodeFlow } from "./device-code.js";
 import { generatePKCE } from "./pkce.js";
@@ -36,15 +37,14 @@ async function loadRadiusOAuthDiscovery(gateway, signal) {
     }
     return { authorizationEndpoint: discovery.authorizationEndpoint };
 }
-class OAuthResponseError extends Error {
+class OAuthResponseError extends OAuthTokenEndpointError {
     constructor(status, oauthError, description, message) {
         const detail = oauthError
             ? description
                 ? `${oauthError}: ${description}`
                 : oauthError
             : description || String(status);
-        super(`${message}: ${detail}`);
-        this.status = status;
+        super(`${message}: ${detail}`, status);
         this.oauthError = oauthError;
     }
 }
@@ -76,7 +76,7 @@ async function requestOAuthToken(gateway, body, signal) {
     }
     catch (error) {
         if (signal.aborted) {
-            throw new Error("Login cancelled");
+            throw new Error("Login cancelled", { cause: signal.reason });
         }
         throw error;
     }
@@ -149,7 +149,7 @@ async function requestDeviceAuthorization(gateway, signal) {
     }
     catch (error) {
         if (signal.aborted) {
-            throw new Error("Login cancelled");
+            throw new Error("Login cancelled", { cause: signal.reason });
         }
         throw error;
     }

package/dist/auth/oauth/xai.js

@@ -1,6 +1,7 @@
 /**
  * xAI OAuth device-code flow.
  */
+import { OAuthTokenEndpointError } from "../../utils/oauth-refresh-error.js";
 import { pollOAuthDeviceCodeFlow } from "./device-code.js";
 const XAI_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
 const XAI_SCOPE = "openid profile email offline_access grok-cli:access api:access";
@@ -53,7 +54,7 @@ async function postForm(url, fields, signal) {
     }
     catch (error) {
         if (signal.aborted) {
-            throw new Error("Login cancelled");
+            throw new Error("Login cancelled", { cause: signal.reason });
         }
         throw error;
     }
@@ -64,9 +65,11 @@ async function postForm(url, fields, signal) {
     }
     catch {
         if (signal.aborted) {
-            throw new Error("Login cancelled");
+            throw new Error("Login cancelled", { cause: signal.reason });
         }
-        throw new Error(`xAI OAuth returned invalid JSON (HTTP ${response.status})`);
+        const message = `xAI OAuth returned invalid JSON (HTTP ${response.status})`;
+        // An error page (an HTML 503 from a proxy, say) still carries the status the retry decision needs.
+        throw response.ok ? new Error(message) : new OAuthTokenEndpointError(message, response.status);
     }
     return {
         ok: response.ok,
@@ -78,7 +81,7 @@ function requestFailure(action, response) {
     const error = typeof response.body.error === "string" ? response.body.error : undefined;
     const description = typeof response.body.error_description === "string" ? response.body.error_description : undefined;
     const detail = [error, description].filter(Boolean).join(": ");
-    return new Error(`xAI OAuth ${action} failed (HTTP ${response.status})${detail ? `: ${detail}` : ""}`);
+    return new OAuthTokenEndpointError(`xAI OAuth ${action} failed (HTTP ${response.status})${detail ? `: ${detail}` : ""}`, response.status);
 }
 function parseDeviceCode(body) {
     // RFC 8628 allows interval 0 (no minimum wait); fall back to the poller's

package/dist/auth/oauth-refresh.js

@@ -15,6 +15,7 @@
  * superseded catalog refresh stops waiting but never aborts the exchange.
  */
 import { raceWithAbortSignal } from "../utils/abort.js";
+import { oauthRefreshFailureCause } from "../utils/oauth-refresh-error.js";
 import { mergeRefreshed, mergeRefreshedSlot, projectSlot } from "./pool/slots.js";
 export const DEFAULT_OAUTH_REFRESH_TIMEOUT_MS = 15_000;
 /** The provider rejected or timed out the token exchange. */
@@ -103,6 +104,15 @@ async function exchangeAndStore(request, signal) {
         signal.throwIfAborted();
     }
     catch (error) {
+        signal.throwIfAborted();
+        const causeClass = oauthRefreshFailureCause(error);
+        if (causeClass !== undefined) {
+            console.warn("OAuth refresh unavailable", JSON.stringify({
+                provider: providerId,
+                ...(slotName ? { slot: slotName } : {}),
+                cause: causeClass,
+            }));
+        }
         throw new OAuthRefreshExchangeError(error);
     }
     try {

package/dist/auth/resolve.js

@@ -1,5 +1,6 @@
 import { operationSignal, raceWithAbortSignal } from "../utils/abort.js";
 import { ModelsError } from "../utils/models-error.js";
+import { classifyOAuthRefreshFailure, OAuthRefreshUnavailableError } from "../utils/oauth-refresh-error.js";
 import { OAuthRefreshExchangeError, OAuthRefreshStoreError, projectOAuthSlot, refreshOAuthCredential, } from "./oauth-refresh.js";
 import { projectSlot } from "./pool/slots.js";
 export { ModelsError } from "../utils/models-error.js";
@@ -82,6 +83,9 @@ export function oauthRefreshModelsError(error, providerId) {
     if (error instanceof ModelsError)
         return error;
     if (error instanceof OAuthRefreshExchangeError) {
+        if (classifyOAuthRefreshFailure(error.cause) === "transient") {
+            return new OAuthRefreshUnavailableError(providerId, error.cause);
+        }
         return new ModelsError("oauth", `OAuth refresh failed for ${providerId}`, { cause: error.cause });
     }
     const cause = error instanceof OAuthRefreshStoreError ? error.cause : error;
@@ -112,6 +116,7 @@ async function resolveStoredOAuth(credentials, providerId, oauth, stored, authCo
             });
         }
         catch (error) {
+            signal.throwIfAborted();
             throw oauthRefreshModelsError(error, providerId);
         }
         if (post?.type !== "oauth")

package/dist/model.d.ts

@@ -44,8 +44,12 @@ export interface Model<TApi extends Api> extends BaseModel<TApi> {
      * probe; `modelSupportsAssistantPrefill` also applies the request settings.
      */
     supportsAssistantPrefill?: boolean;
-    /** Compatibility overrides for OpenAI-compatible APIs. If not set, auto-detected from baseUrl. */
-    compat?: TApi extends "openai-completions" ? OpenAICompletionsCompat : TApi extends "openai-responses" | "openai-codex-responses" | "azure-openai-responses" ? OpenAIResponsesCompat : TApi extends "anthropic-messages" ? AnthropicMessagesCompat : TApi extends "bedrock-converse-stream" ? BedrockCompat : TApi extends "mistral-conversations" ? MistralConversationsCompat : TApi extends "cursor-agent" ? CursorAgentCompat : TApi extends "devin-agent" ? DevinAgentCompat : never;
+    /** API compatibility overrides. Hosted search on unverified routes requires explicit opt-in. */
+    compat?: TApi extends "openai-completions" ? OpenAICompletionsCompat : TApi extends "openai-responses" | "openai-codex-responses" | "azure-openai-responses" ? OpenAIResponsesCompat : TApi extends "anthropic-messages" ? AnthropicMessagesCompat : TApi extends "bedrock-converse-stream" ? BedrockCompat : TApi extends "mistral-conversations" ? MistralConversationsCompat : TApi extends "cursor-agent" ? CursorAgentCompat : TApi extends "devin-agent" ? DevinAgentCompat : TApi extends "google-generative-ai" | "google-vertex" ? GoogleCompat : never;
+}
+export interface GoogleCompat {
+    /** Opt in to Google Search grounding, including mixed function-tool requests. */
+    supportsWebSearch?: boolean;
 }
 /** Devin (Cascade) model metadata the transport branches on. */
 export interface DevinAgentCompat {

package/dist/openai-responses-compat.d.ts

@@ -42,10 +42,15 @@ export interface OpenAIResponsesCompat {
      * Whether the model accepts `tool_choice: { type: "allowed_tools" }`. When set, callers keep every
      * declared tool in `tools` and restrict the callable subset through `Context.activeToolNames`, so a
      * shrinking tool set does not rewrite the cached prompt prefix. Honored by the `openai-responses`
-     * adapter. Default: false.
+     * adapter, and only on the native OpenAI API hosts (`api.openai.com` and its regional `*.api.openai.com`
+     * hosts): Responses-compatible gateways reject the choice (senpi#3080), and since a provider `baseUrl`
+     * override keeps the catalog compat, the flag cannot opt a gateway in. Default: false.
      */
     supportsAllowedTools?: boolean;
 }
-/** Whether a model's compat declares `allowed_tools` support (see {@link OpenAIResponsesCompat.supportsAllowedTools}). */
+/**
+ * Whether requests to `model` restrict tools through `allowed_tools`: its compat declares support and it is
+ * served by the native OpenAI endpoint (see {@link OpenAIResponsesCompat.supportsAllowedTools}).
+ */
 export declare function supportsAllowedToolChoice(model: Model<Api>): boolean;
 //# sourceMappingURL=openai-responses-compat.d.ts.map

package/dist/openai-responses-compat.js

@@ -1,5 +1,18 @@
-/** Whether a model's compat declares `allowed_tools` support (see {@link OpenAIResponsesCompat.supportsAllowedTools}). */
+function isNativeOpenAIEndpoint(baseUrl) {
+    try {
+        const { hostname } = new URL(baseUrl || "https://api.openai.com/v1");
+        return hostname === "api.openai.com" || hostname.endsWith(".api.openai.com");
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether requests to `model` restrict tools through `allowed_tools`: its compat declares support and it is
+ * served by the native OpenAI endpoint (see {@link OpenAIResponsesCompat.supportsAllowedTools}).
+ */
 export function supportsAllowedToolChoice(model) {
-    return model.compat?.supportsAllowedTools === true;
+    return (model.compat?.supportsAllowedTools === true &&
+        isNativeOpenAIEndpoint(model.baseUrl));
 }
 //# sourceMappingURL=openai-responses-compat.js.map

package/dist/providers/all.d.ts

@@ -50,7 +50,7 @@ declare const FORK_OWNED_CATALOGS: {
                     readonly input: 3;
                     readonly output: 15;
                     readonly cacheRead: 0.3;
-                    readonly cacheWrite: 0;
+                    readonly cacheWrite: 3;
                 };
                 readonly contextWindow: 1048576;
                 readonly maxTokens: 131072;

package/dist/providers/data/.manifest.json

@@ -1 +1 @@
-{"schemaVersion":6,"generatedAt":"2026-10-05T00:22:16.949Z","structureHash":"ff5f1c5ea3d0a6d7d36208bac83298ca0f7762d9067e289536e1a1e02777e038","files":{"alibaba-token-plan.json":"16b3c6c78d72c73ca34a1e79ce71c0cf36ba409d02e83a17396ce0949a1d5363","amazon-bedrock.json":"e918146642945e9ef5f2ccc04f8de04d5a34b1cc32d0e1b0ddc231254263a656","ant-ling.json":"628feab3ef6c7d80ce96f75999804e1d9f05fec3851e5302e30fff3b69db90f6","anthropic.json":"2c0c4389cd71d21d4553075f399922892078192b0490fead423544e360af1a43","azure-openai-responses.json":"a3e52bd78f0220aa32bce519e13955b8e6e567860416343844cbe19902f4a682","bai.json":"7e6861aaf27d8af34e1771c6092602194fcec0a0046e6adfab9c3ee54d32b99f","baseten.json":"b04d1423d6958bec857ffccc36726f091ec1a8f3a09cf0836b64cc94b0ee697d","cerebras.json":"3eccb58c5de3d0dc7ba49dc6e477ba29f00cb3150ce0a35cc90d59e6b5ab368e","chatgpt-subscription.json":"08f365952647594f5b07337666255f8510ef2e09bfb704530843b63121ed07f4","cloudflare-ai-gateway.json":"2ba4b7f1b0ba8919760c2e9cbd994270edd179bc9d291f271eede738afcbf269","cloudflare-workers-ai.json":"4bf0b488460c2e6cb8a6615bb2f87ca2a31cd9597eb249d5b58cba251330a99a","deepseek.json":"10a296fb3e898f7715c80890c8af0af4f5fd58f22dbcd6612fdc5d762157ccdc","fireworks.json":"c3dc21dc2e95428fc9a38e3840c05bbf90f94e4c25dee0eedf0b385b49ff65a4","github-copilot.json":"9ed67e5c0104ec237e9befcb9a50a18bd7d65e1539cd9f0638d2bc20bd82ef60","google-vertex.json":"40090c680538bc867f2624d986a449f361be4dfa6ba96d7a27402050f036e009","google.json":"c0f5a633e5e5a5044432db3e537f4bc674d4de18df09325c6349547fcc13cabe","groq.json":"910952ad9dad07856983459d63fce0148dba1203edd7b10d801a77c5824f3405","huggingface.json":"1b8604bd31a5e05fe43a40ec1ec6dfc1a51a28b0b020151ef057fab43f57c923","meta.json":"0c7e9a370a7005c5a89dc94f0f93bc67b8935c3f802de324f11af6ff56fff429","minimax-cn.json":"f962c20ee6a6a342820f778e9dc363a18a524bf11998f6e2c57f2989915d62e5","minimax.json":"17a432f80d0ea6dd26eade80a4314250d3a855678601728a5f70dd8fa0d21dd2","mistral.json":"10f33bff9adf1248f7e6848e5890c265399f1f94e5b42cfdc28c109d547af98d","moonshotai-cn.json":"bfb0641eee9587118da525607d86e55840de13310cd934785bc3bdcfeb6f88e3","moonshotai.json":"79ac5b6861a10d592e884c05a546fdd0b58fe383ce3453ecdb32d43926cba9dd","nvidia.json":"a75e963dc81779e3eec01c051b12277c15ec37c5b94ab51ece9e9ccb3b16407c","openai.json":"9104538118053eed57f90852332b6ad274a4e4792389bdbc9cfca1ae400c705a","opencode-go.json":"ba0f2ac7ff7c85db2123979b69f3e58cf5f2c1d89f29c8c7eda8a067d9809481","opencode.json":"ae373c624a66b824f543ef76fb5f1849b4910390952e6ae18b13bdb3e2d63b37","opengateway.json":"2d4275641f1b1154dfc6ffb320bedc1bcb1e33a0d12a4e9fba147ee3edec7d64","openrouter.json":"f150723ee331c1112708e0990663acc34e989c591858bbeef96b42d420f71951","qwen-token-plan-cn.json":"bd36a6d9cc2048deafacc85f7f0f2e51868c8b7aa09502e3e4e60e3e8b76f690","qwen-token-plan-individual.json":"35ffb0ba1a1ce3f68fc73262dd5e07fbcb5bf5911ad1e6e17bc0621e2894676a","qwen-token-plan.json":"ca27e49e62965221badead8e867b2007035c6b6a15a97c47219bd23d2c83c2b1","radius.json":"a8cf2f2cc7dae90d8bbfdd8a2f8a0e058e7923dbdb3ba2cdaed7dd1aecd25a2a","together.json":"bbd7fad86cacfefe3d3d61f6638f22e9b6f5d575722fd1112a16aafe0485c46d","typesafe.json":"a4429a2f696d5cc5273969af61a7310bda07d6bdcd27bf9ac9c76c534cc43716","venice.json":"a5f06e8297561de8cfcce397f9609a804ec912af007ba7fdbdb1951f2ee97009","vercel-ai-gateway.json":"aa1eabd3ec0d8d7a0e783cd514c085b465a28503515cea6477f4880349d63f5c","xai.json":"d7771a1450b21c1f6aee887ca6fea61b6e7b3fc13b4dee5cf72a71134fe623bc","xiaomi-token-plan-ams.json":"4dd8f838e21d7aa7caf3122d0b0b1e5a02a33bc012b96e6a75bd119334152d7a","xiaomi-token-plan-cn.json":"46414ff49973b95a0c14bd33e8992cc1938a50ce2c7cea9e2e5cc02de8f1df31","xiaomi-token-plan-sgp.json":"f5b3f66bf7bb7238592d4a9667cad983a008d7539a66e9896b02422622800935","xiaomi.json":"8b62c158d55d5a165f35cd72c1fc82ab89ff8e73f08960105fc41b822f236f69","zai-coding-cn.json":"2a7f59d15f588a97d218997883f2506dfc52d3ee320697d39f14213a050fc912","zai.json":"e9cc408e1756de8abc70148d63d89d11a63c65b7ef06ad0661cd1328e4209ba3"}}
+{"schemaVersion":6,"generatedAt":"2026-10-12T15:26:30.855Z","structureHash":"f696be8fbb6471faefafe7b9ae99f4c0db4391398bf4108f56024ed2712ebf88","files":{"alibaba-token-plan.json":"16b3c6c78d72c73ca34a1e79ce71c0cf36ba409d02e83a17396ce0949a1d5363","amazon-bedrock.json":"4a95e6bf974e5ca967d5c050df580262e13573e42b3186edb448fa11a302f09f","ant-ling.json":"628feab3ef6c7d80ce96f75999804e1d9f05fec3851e5302e30fff3b69db90f6","anthropic.json":"111384e9f5845e0247bd34edf2400ef7720fcbdac140b944cf8878192d8bd6ab","azure-openai-responses.json":"a3e52bd78f0220aa32bce519e13955b8e6e567860416343844cbe19902f4a682","bai.json":"7e6861aaf27d8af34e1771c6092602194fcec0a0046e6adfab9c3ee54d32b99f","baseten.json":"1fcdab8daf2881bd099eb08f9416f7df5bf39975937d2a63b841542bd032f2e6","cerebras.json":"3eccb58c5de3d0dc7ba49dc6e477ba29f00cb3150ce0a35cc90d59e6b5ab368e","chatgpt-subscription.json":"42b88c93d717b2a7469b71da7da5adf87347d0d9cc0f264b39117f0f940b51c0","cloudflare-ai-gateway.json":"5c8782fdbf2477f620b238da4344b0bcc0948b8c177461e63e7e5ba256f769c7","cloudflare-workers-ai.json":"f351e80493dea7b7a2c31dceb086ee804a88d67c5f8a3c823ea907991fe5d659","deepseek.json":"10a296fb3e898f7715c80890c8af0af4f5fd58f22dbcd6612fdc5d762157ccdc","fireworks.json":"c3dc21dc2e95428fc9a38e3840c05bbf90f94e4c25dee0eedf0b385b49ff65a4","github-copilot.json":"2c5a84983477a7c4f6c001088a1e043ee959ce58c99fea6eb843e0286228664b","google-vertex.json":"96ecc19bf20a706f99ae658b021a0ee5438146119e1e99de5fd824a01fcfd81b","google.json":"c0f5a633e5e5a5044432db3e537f4bc674d4de18df09325c6349547fcc13cabe","groq.json":"910952ad9dad07856983459d63fce0148dba1203edd7b10d801a77c5824f3405","huggingface.json":"6399e958790a9d90c21fb55d1cbef8569427a1ceb28de86dadeb3b4454ecfade","meta.json":"0c7e9a370a7005c5a89dc94f0f93bc67b8935c3f802de324f11af6ff56fff429","minimax-cn.json":"f962c20ee6a6a342820f778e9dc363a18a524bf11998f6e2c57f2989915d62e5","minimax.json":"17a432f80d0ea6dd26eade80a4314250d3a855678601728a5f70dd8fa0d21dd2","mistral.json":"27aa66c71a0504b53dc87ec194286fa7e70b99747fc8df9b709b23b3548afe50","moonshotai-cn.json":"18954b55dc5edecc174d8a07a2c5993416dd9d3ce52e411438035c16ee982e8e","moonshotai.json":"62d08fd5beead025a56d5f2e4227d8516b9c5034275b1b36d761a8625918f2b9","nvidia.json":"a75e963dc81779e3eec01c051b12277c15ec37c5b94ab51ece9e9ccb3b16407c","openai.json":"9104538118053eed57f90852332b6ad274a4e4792389bdbc9cfca1ae400c705a","opencode-go.json":"48ff011f3e171f977cfed2928272667e9361f13a508e5994f00f2241f6a23419","opencode.json":"882b039f64ef266da7b02d30aee9255c191e16f0600ef5494022bc1ef746f749","opengateway.json":"008c69b83d5fc98382e5463d77f701cdd87bb231c59830eabbbd453038d5a59f","openrouter.json":"4287f52f3e42a1873c09b72a9e6870c90718e0c71ed0b58c2f15da9e7271a529","qwen-token-plan-cn.json":"bd36a6d9cc2048deafacc85f7f0f2e51868c8b7aa09502e3e4e60e3e8b76f690","qwen-token-plan-individual.json":"35ffb0ba1a1ce3f68fc73262dd5e07fbcb5bf5911ad1e6e17bc0621e2894676a","qwen-token-plan.json":"ca27e49e62965221badead8e867b2007035c6b6a15a97c47219bd23d2c83c2b1","radius.json":"8214122385e8e4c4bc2e1d2a7d032f9e4c654da3bfd3ac8c5d4396e1b522e53a","together.json":"bbd7fad86cacfefe3d3d61f6638f22e9b6f5d575722fd1112a16aafe0485c46d","typesafe.json":"a4429a2f696d5cc5273969af61a7310bda07d6bdcd27bf9ac9c76c534cc43716","venice.json":"3604c88c46dd3e4151b833927c6f87bcc165d0999a4339b32db2ad74a9ff173f","vercel-ai-gateway.json":"b63765fc532a52b85b98d6b5afe8be3a3838b1907ae116cb25cf3d029bd70f0c","xai.json":"d7771a1450b21c1f6aee887ca6fea61b6e7b3fc13b4dee5cf72a71134fe623bc","xiaomi-token-plan-ams.json":"4dd8f838e21d7aa7caf3122d0b0b1e5a02a33bc012b96e6a75bd119334152d7a","xiaomi-token-plan-cn.json":"46414ff49973b95a0c14bd33e8992cc1938a50ce2c7cea9e2e5cc02de8f1df31","xiaomi-token-plan-sgp.json":"f5b3f66bf7bb7238592d4a9667cad983a008d7539a66e9896b02422622800935","xiaomi.json":"8b62c158d55d5a165f35cd72c1fc82ab89ff8e73f08960105fc41b822f236f69","zai-coding-cn.json":"2a7f59d15f588a97d218997883f2506dfc52d3ee320697d39f14213a050fc912","zai.json":"e9cc408e1756de8abc70148d63d89d11a63c65b7ef06ad0661cd1328e4209ba3"}}