@code-yeongyu/senpi-ai 2026.10.26-2 → 2026.10.27-2

package/dist/types.d.ts

@@ -569,10 +569,16 @@ export interface AssistantMessage {
     stopDetails?: AssistantStopDetails;
     deferred?: DeferredHandle;
     errorMessage?: string;
-    /** Redaction-safe cause retained when a session projects a provider limit as user-facing advice. */
+    /**
+     * Redaction-safe cause: a provider limit projected as user-facing advice, or a model id its route does not
+     * serve (`model_config`, never retried or fallen back).
+     */
     errorCause?: {
         type: "usage_limit";
         scope: "account" | "model";
+    } | {
+        type: "model_config";
+        model: string;
     };
     /** Structured provider failure family, minted only by a provider adapter from structured error metadata. */
     providerDiagnostic?: ProviderDiagnostic;
@@ -583,6 +589,11 @@ export interface AssistantMessage {
      * No model produced the failure, so retry and model fallback must not act on it.
      */
     failureSource?: "local";
+    /**
+     * Set by the model runtime on a failed response when the same credential (provider, endpoint and key) served a
+     * response moments before: an `auth` failure then means the provider refused this request, not the key.
+     */
+    credentialServedRecently?: true;
     rawStopReason?: string;
     /**
      * Provider indication of whether the model explicitly ended its turn.

package/dist/utils/assistant-capture-record.d.ts

@@ -0,0 +1,13 @@
+import type { AssistantMessage, AssistantMessageEvent } from "../types.ts";
+import type { AssistantCapture, CaptureHint, CaptureState } from "./assistant-capture.ts";
+type PublicBlock = AssistantMessage["content"][number];
+export declare function freezeCapture<T>(value: T): T;
+/** Only declared public fields survive; provider scratch and symbols never enter a seed. */
+export declare function publicBlock(block: PublicBlock): PublicBlock;
+/** Structural equality over plain data; any other object counts as changed, so a reused copy is never stale. */
+export declare function sameValue(left: unknown, right: unknown): boolean;
+/** A terminal replaced downstream: its usage and message, plus every scalar that differs from the source terminal. */
+export declare function terminalCapture(capture: AssistantCapture, terminal: AssistantMessage): AssistantCapture;
+export declare function buildCapture(state: CaptureState, event: AssistantMessageEvent, hint: CaptureHint): AssistantCapture | undefined;
+export {};
+//# sourceMappingURL=assistant-capture-record.d.ts.map

package/dist/utils/assistant-capture-record.js

@@ -0,0 +1,163 @@
+import { seedNextOffset } from "./assistant-seed-frontier.js";
+const NO_CHANGE = Object.freeze({});
+export function freezeCapture(value) {
+    const freeze = (part) => {
+        if (part === null || typeof part !== "object" || Object.isFrozen(part))
+            return;
+        for (const child of Object.values(part))
+            freeze(child);
+        Object.freeze(part);
+    };
+    const copy = structuredClone(value);
+    freeze(copy);
+    return copy;
+}
+/** Only declared public fields survive; provider scratch and symbols never enter a seed. */
+export function publicBlock(block) {
+    const fields = {
+        text: ["type", "text", "audience", "textSignature"],
+        thinking: ["type", "thinking", "thinkingSignature", "redacted", "startedAt", "endedAt"],
+        toolCall: ["type", "id", "name", "arguments", "incomplete", "errorMessage", "thoughtSignature", "namespace"],
+        providerNative: ["type", "subtype", "raw"],
+    };
+    return Object.fromEntries(fields[block.type].filter((key) => key in block).map((key) => [key, Reflect.get(block, key)]));
+}
+/** Structural equality over plain data; any other object counts as changed, so a reused copy is never stale. */
+export function sameValue(left, right) {
+    if (left === right)
+        return true;
+    if (!isPlainData(left) || !isPlainData(right) || Array.isArray(left) !== Array.isArray(right))
+        return false;
+    const keys = Object.keys(left);
+    return (keys.length === Object.keys(right).length &&
+        keys.every((key) => Object.hasOwn(right, key) && sameValue(Reflect.get(left, key), Reflect.get(right, key))));
+}
+function isPlainData(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === Array.prototype || prototype === null;
+}
+/** A terminal replaced downstream: its usage and message, plus every scalar that differs from the source terminal. */
+export function terminalCapture(capture, terminal) {
+    const metadata = { ...capture.metadata };
+    const previous = capture.message ?? {};
+    for (const key of new Set([...Object.keys(previous), ...Object.keys(terminal)])) {
+        if (key === "content" || key === "usage")
+            continue;
+        const value = Reflect.get(terminal, key);
+        if (!sameValue(value, Reflect.get(previous, key)))
+            metadata[key] = key in terminal ? value : null;
+    }
+    return Object.freeze({
+        usage: frozenUsage(terminal.usage),
+        metadata: freezeCapture(metadata),
+        message: freezeCapture({ ...terminal, content: terminal.content.map(publicBlock) }),
+        ...(capture.rewrittenFrom === undefined ? {} : { rewrittenFrom: capture.rewrittenFrom }),
+    });
+}
+export function buildCapture(state, event, hint) {
+    const message = event.type === "done" ? event.message : event.type === "error" ? event.error : event.partial;
+    const usage = usageCopy(state, message.usage);
+    if (!("contentIndex" in event)) {
+        return Object.freeze({
+            usage,
+            metadata: changedMetadata(state, message),
+            message: freezeCapture({ ...message, content: message.content.map(publicBlock) }),
+            ...(hint.rewrittenFrom === undefined ? {} : { rewrittenFrom: hint.rewrittenFrom }),
+        });
+    }
+    const index = hint.contentIndex ?? event.contentIndex;
+    const own = index === event.contentIndex ? {} : { contentIndex: index };
+    const carried = hint.carried;
+    if ("delta" in event) {
+        if (carried) {
+            const { parsedThrough } = carried;
+            return Object.freeze({
+                usage,
+                offset: carried.offset,
+                ...(parsedThrough === undefined ? {} : { parsedThrough }),
+            });
+        }
+        const position = state.positions.get(index) ?? { offset: 0, parsedThrough: 0 };
+        const offset = hint.offset ?? position.offset;
+        position.offset = offset + event.delta.length;
+        if (event.type === "toolcall_delta" && event.delta.length > 0) {
+            position.parsedThrough = hint.parsedThrough ?? Math.max(position.parsedThrough, position.offset);
+        }
+        state.positions.set(index, position);
+        return Object.freeze({
+            usage,
+            offset,
+            ...own,
+            ...(event.type === "toolcall_delta" ? { parsedThrough: position.parsedThrough } : {}),
+        });
+    }
+    const metadata = changedMetadata(state, message);
+    if (carried) {
+        const { usage: _usage, metadata: _metadata, message: _message, offset: _offset, ...facts } = carried;
+        return Object.freeze({ ...facts, usage, metadata });
+    }
+    const starts = event.type === "text_start" || event.type === "thinking_start" || event.type === "toolcall_start";
+    const source = event.type === "toolcall_end" ? event.toolCall : message.content[index];
+    // A start announced before its block is appended has no seed to freeze yet.
+    if (starts && source === undefined)
+        return undefined;
+    const block = freezeCapture(publicBlock(source));
+    if (!starts)
+        return Object.freeze({ usage, metadata, block, ...own });
+    const rawArgumentPrefix = hint.rawArgumentPrefix ?? "";
+    const coveredCodeUnits = block.type === "text"
+        ? block.text.length
+        : block.type === "thinking"
+            ? block.thinking.length
+            : rawArgumentPrefix.length;
+    const parsedThrough = hint.parsedThrough ?? 0;
+    const nextOffset = seedNextOffset(hint.offset ?? coveredCodeUnits, coveredCodeUnits);
+    state.positions.set(index, { offset: nextOffset, parsedThrough });
+    return Object.freeze({
+        usage,
+        metadata,
+        block,
+        coveredCodeUnits,
+        nextOffset,
+        ...own,
+        ...(block.type === "toolCall" ? { rawArgumentPrefix, parsedThrough } : {}),
+    });
+}
+function usageCopy(state, usage) {
+    if (state.usage !== undefined && sameValue(usage, state.usage))
+        return state.usage;
+    state.usage = frozenUsage(usage);
+    return state.usage;
+}
+function frozenUsage(usage) {
+    return Object.freeze({
+        ...usage,
+        cost: Object.freeze({ ...usage.cost }),
+        ...(usage.contextUsage ? { contextUsage: Object.freeze({ ...usage.contextUsage }) } : {}),
+    });
+}
+/** Scalar message fields changed since the last non-delta capture; the baseline moves only once its copy exists. */
+function changedMetadata(state, message) {
+    const changed = {};
+    for (const key of Object.keys(message)) {
+        if (key === "content" || key === "usage")
+            continue;
+        const value = Reflect.get(message, key);
+        if (!state.metadata.has(key) || state.metadata.get(key) !== value)
+            changed[key] = value;
+    }
+    for (const key of state.metadata.keys())
+        if (!(key in message))
+            changed[key] = null;
+    const frozen = Object.keys(changed).length === 0 ? NO_CHANGE : freezeCapture(changed);
+    for (const key of Object.keys(changed)) {
+        if (key in message)
+            state.metadata.set(key, Reflect.get(message, key));
+        else
+            state.metadata.delete(key);
+    }
+    return frozen;
+}
+//# sourceMappingURL=assistant-capture-record.js.map

package/dist/utils/assistant-capture.d.ts

@@ -1,4 +1,5 @@
 import type { AssistantMessage, AssistantMessageEvent, Usage } from "../types.ts";
+export { freezeCapture, publicBlock } from "./assistant-capture-record.ts";
 type PublicBlock = AssistantMessage["content"][number];
 export type AssistantProgress = {
     type: "message_block_state";
@@ -39,6 +40,8 @@ export interface AssistantCapture {
     readonly message?: AssistantMessage;
     readonly rawArgumentPrefix?: string;
     readonly coveredCodeUnits?: number;
+    /** Required on block starts: zero for replay, full seed length for continuation. */
+    readonly nextOffset?: number;
     readonly offset?: number;
     readonly parsedThrough?: number;
     /** The block's own index where the event's public `contentIndex` names another block; internal readers prefer it. */
@@ -51,6 +54,13 @@ export interface AssistantCapture {
      */
     readonly rewrittenFrom?: number;
 }
+export interface CaptureState {
+    positions: Map<number, CapturePosition>;
+    metadata: Map<string, unknown>;
+    usage?: Usage;
+    insertCopies: Map<number, PublicBlock>;
+    failedBlocks: Set<number>;
+}
 /** While held, every capture-enabled stream whose first push comes after it builds capture records. */
 export declare function subscribeAssistantCapture(): () => void;
 export declare function setAssistantReader(owner: object, reader: QueueReader): void;
@@ -90,12 +100,8 @@ export interface CapturePosition {
     offset: number;
     parsedThrough: number;
 }
-export declare function freezeCapture<T>(value: T): T;
-/** Only declared public fields survive; provider scratch and symbols never enter a seed. */
-export declare function publicBlock(block: PublicBlock): PublicBlock;
 export declare function dropAssistantCapture(event: object): void;
 export declare function carryAssistantCapture<T extends object>(source: object, target: T, terminal?: AssistantMessage): T;
 /** Never parses or traverses a block on a delta, including a no-growth delta. */
 export declare function captureAssistantEvent(owner: object, event: AssistantMessageEvent, hint?: CaptureHint): void;
-export {};
 //# sourceMappingURL=assistant-capture.d.ts.map

package/dist/utils/assistant-capture.js

@@ -1,3 +1,5 @@
+import { buildCapture, freezeCapture, publicBlock, sameValue, terminalCapture } from "./assistant-capture-record.js";
+export { freezeCapture, publicBlock } from "./assistant-capture-record.js";
 const captures = new WeakMap();
 const readers = new WeakMap();
 const writers = new WeakMap();
@@ -5,7 +7,6 @@ const writers = new WeakMap();
 const states = new WeakMap();
 const demanded = new WeakSet();
 const warned = new WeakSet();
-const NO_CHANGE = Object.freeze({});
 let subscribers = 0;
 let capturedAny = false;
 /** While held, every capture-enabled stream whose first push comes after it builds capture records. */
@@ -132,44 +133,6 @@ export function isAssistantProgress(event) {
         event.type === "message_block_metadata" ||
         event.type === "message_tool_arguments_reset");
 }
-export function freezeCapture(value) {
-    const freeze = (part) => {
-        if (part === null || typeof part !== "object" || Object.isFrozen(part))
-            return;
-        for (const child of Object.values(part))
-            freeze(child);
-        Object.freeze(part);
-    };
-    const copy = structuredClone(value);
-    freeze(copy);
-    return copy;
-}
-/** Only declared public fields survive; provider scratch and symbols never enter a seed. */
-export function publicBlock(block) {
-    const fields = {
-        text: ["type", "text", "audience", "textSignature"],
-        thinking: ["type", "thinking", "thinkingSignature", "redacted", "startedAt", "endedAt"],
-        toolCall: ["type", "id", "name", "arguments", "incomplete", "errorMessage", "thoughtSignature", "namespace"],
-        providerNative: ["type", "subtype", "raw"],
-    };
-    return Object.fromEntries(fields[block.type].filter((key) => key in block).map((key) => [key, Reflect.get(block, key)]));
-}
-/** Structural equality over plain data; any other object counts as changed, so a reused copy is never stale. */
-function sameValue(left, right) {
-    if (left === right)
-        return true;
-    if (!isPlainData(left) || !isPlainData(right) || Array.isArray(left) !== Array.isArray(right))
-        return false;
-    const keys = Object.keys(left);
-    return (keys.length === Object.keys(right).length &&
-        keys.every((key) => Object.hasOwn(right, key) && sameValue(Reflect.get(left, key), Reflect.get(right, key))));
-}
-function isPlainData(value) {
-    if (typeof value !== "object" || value === null)
-        return false;
-    const prototype = Object.getPrototypeOf(value);
-    return prototype === Object.prototype || prototype === Array.prototype || prototype === null;
-}
 export function dropAssistantCapture(event) {
     if (capturedAny)
         captures.delete(event);
@@ -186,24 +149,6 @@ export function carryAssistantCapture(source, target, terminal) {
     }
     return target;
 }
-/** A terminal replaced downstream: its usage and message, plus every scalar that differs from the source terminal. */
-function terminalCapture(capture, terminal) {
-    const metadata = { ...capture.metadata };
-    const previous = capture.message ?? {};
-    for (const key of new Set([...Object.keys(previous), ...Object.keys(terminal)])) {
-        if (key === "content" || key === "usage")
-            continue;
-        const value = Reflect.get(terminal, key);
-        if (!sameValue(value, Reflect.get(previous, key)))
-            metadata[key] = key in terminal ? value : null;
-    }
-    return Object.freeze({
-        usage: frozenUsage(terminal.usage),
-        metadata: freezeCapture(metadata),
-        message: freezeCapture({ ...terminal, content: terminal.content.map(publicBlock) }),
-        ...(capture.rewrittenFrom === undefined ? {} : { rewrittenFrom: capture.rewrittenFrom }),
-    });
-}
 /** Never parses or traverses a block on a delta, including a no-growth delta. */
 export function captureAssistantEvent(owner, event, hint = {}) {
     const state = activeState(owner);
@@ -222,106 +167,4 @@ export function captureAssistantEvent(owner, event, hint = {}) {
         dropCapture(owner, error, state, contentIndex);
     }
 }
-function buildCapture(state, event, hint) {
-    const message = event.type === "done" ? event.message : event.type === "error" ? event.error : event.partial;
-    const usage = usageCopy(state, message.usage);
-    if (!("contentIndex" in event)) {
-        return Object.freeze({
-            usage,
-            metadata: changedMetadata(state, message),
-            message: freezeCapture({ ...message, content: message.content.map(publicBlock) }),
-            ...(hint.rewrittenFrom === undefined ? {} : { rewrittenFrom: hint.rewrittenFrom }),
-        });
-    }
-    const index = hint.contentIndex ?? event.contentIndex;
-    const own = index === event.contentIndex ? {} : { contentIndex: index };
-    const carried = hint.carried;
-    if ("delta" in event) {
-        if (carried) {
-            const { parsedThrough } = carried;
-            return Object.freeze({
-                usage,
-                offset: carried.offset,
-                ...(parsedThrough === undefined ? {} : { parsedThrough }),
-            });
-        }
-        const position = state.positions.get(index) ?? { offset: 0, parsedThrough: 0 };
-        const offset = hint.offset ?? position.offset;
-        position.offset = offset + event.delta.length;
-        if (event.type === "toolcall_delta" && event.delta.length > 0) {
-            position.parsedThrough = hint.parsedThrough ?? Math.max(position.parsedThrough, position.offset);
-        }
-        state.positions.set(index, position);
-        return Object.freeze({
-            usage,
-            offset,
-            ...own,
-            ...(event.type === "toolcall_delta" ? { parsedThrough: position.parsedThrough } : {}),
-        });
-    }
-    const metadata = changedMetadata(state, message);
-    if (carried) {
-        const { usage: _usage, metadata: _metadata, message: _message, offset: _offset, ...facts } = carried;
-        return Object.freeze({ ...facts, usage, metadata });
-    }
-    const starts = event.type === "text_start" || event.type === "thinking_start" || event.type === "toolcall_start";
-    const source = event.type === "toolcall_end" ? event.toolCall : message.content[index];
-    // A start announced before its block is appended has no seed to freeze yet.
-    if (starts && source === undefined)
-        return undefined;
-    const block = freezeCapture(publicBlock(source));
-    if (!starts)
-        return Object.freeze({ usage, metadata, block, ...own });
-    const rawArgumentPrefix = hint.rawArgumentPrefix ?? "";
-    const coveredCodeUnits = block.type === "text"
-        ? block.text.length
-        : block.type === "thinking"
-            ? block.thinking.length
-            : rawArgumentPrefix.length;
-    const parsedThrough = hint.parsedThrough ?? 0;
-    state.positions.set(index, { offset: hint.offset ?? coveredCodeUnits, parsedThrough });
-    return Object.freeze({
-        usage,
-        metadata,
-        block,
-        coveredCodeUnits,
-        ...own,
-        ...(block.type === "toolCall" ? { rawArgumentPrefix, parsedThrough } : {}),
-    });
-}
-function usageCopy(state, usage) {
-    if (state.usage !== undefined && sameValue(usage, state.usage))
-        return state.usage;
-    state.usage = frozenUsage(usage);
-    return state.usage;
-}
-function frozenUsage(usage) {
-    return Object.freeze({
-        ...usage,
-        cost: Object.freeze({ ...usage.cost }),
-        ...(usage.contextUsage ? { contextUsage: Object.freeze({ ...usage.contextUsage }) } : {}),
-    });
-}
-/** Scalar message fields changed since the last non-delta capture; the baseline moves only once its copy exists. */
-function changedMetadata(state, message) {
-    const changed = {};
-    for (const key of Object.keys(message)) {
-        if (key === "content" || key === "usage")
-            continue;
-        const value = Reflect.get(message, key);
-        if (!state.metadata.has(key) || state.metadata.get(key) !== value)
-            changed[key] = value;
-    }
-    for (const key of state.metadata.keys())
-        if (!(key in message))
-            changed[key] = null;
-    const frozen = Object.keys(changed).length === 0 ? NO_CHANGE : freezeCapture(changed);
-    for (const key of Object.keys(changed)) {
-        if (key in message)
-            state.metadata.set(key, Reflect.get(message, key));
-        else
-            state.metadata.delete(key);
-    }
-    return frozen;
-}
 //# sourceMappingURL=assistant-capture.js.map

package/dist/utils/assistant-seed-frontier.d.ts

@@ -0,0 +1,7 @@
+export declare class SeedFrontierError extends Error {
+    readonly code: "missing_next_offset" | "invalid_next_offset";
+    constructor(nextOffset: number | undefined);
+}
+/** No inference at a consumer: only full replay or full continuation is supported. */
+export declare function seedNextOffset(nextOffset: number | undefined, seedLength: number): number;
+//# sourceMappingURL=assistant-seed-frontier.d.ts.map

package/dist/utils/assistant-seed-frontier.js

@@ -0,0 +1,14 @@
+export class SeedFrontierError extends Error {
+    constructor(nextOffset) {
+        super("Block seed requires nextOffset equal to zero or its full UTF-16 length");
+        this.name = "SeedFrontierError";
+        this.code = nextOffset === undefined ? "missing_next_offset" : "invalid_next_offset";
+    }
+}
+/** No inference at a consumer: only full replay or full continuation is supported. */
+export function seedNextOffset(nextOffset, seedLength) {
+    if (nextOffset === undefined || !Number.isSafeInteger(nextOffset) || (nextOffset !== 0 && nextOffset !== seedLength))
+        throw new SeedFrontierError(nextOffset);
+    return nextOffset;
+}
+//# sourceMappingURL=assistant-seed-frontier.js.map

package/dist/utils/event-stream.d.ts

@@ -40,6 +40,7 @@ export declare class AssistantMessageEventStream extends EventStream<AssistantMe
     });
     push(event: AssistantMessageEvent, hint?: CaptureHint): void;
     [Symbol.asyncIterator](): AsyncIterator<AssistantMessageEvent>;
+    end(result?: AssistantMessage): void;
 }
 /** Factory function for AssistantMessageEventStream (for use in extensions) */
 export declare function createAssistantMessageEventStream(): AssistantMessageEventStream;

package/dist/utils/event-stream.js

@@ -1,4 +1,5 @@
 import { captureAssistantEvent, dropAssistantCapture, enableAssistantCapture, setAssistantProgressWriter, setAssistantReader, } from "./assistant-capture.js";
+import { sanitizeProviderErrorMessage } from "./provider-error.js";
 class FifoQueue {
     constructor() {
         this.incoming = [];
@@ -188,6 +189,13 @@ export class AssistantMessageEventStream extends EventStream {
     push(event, hint) {
         if (this.done)
             return;
+        // Classify raw provider errors and redact before capture or publication (senpi#4282).
+        if ("partial" in event)
+            sanitizeProviderErrorMessage(event.partial);
+        if (event.type === "error")
+            sanitizeProviderErrorMessage(event.error);
+        if (event.type === "done")
+            sanitizeProviderErrorMessage(event.message);
         captureAssistantEvent(this, event, hint);
         super.push(event);
     }
@@ -200,6 +208,11 @@ export class AssistantMessageEventStream extends EventStream {
             return { value: entry.event, done: false };
         });
     }
+    end(result) {
+        if (result !== undefined)
+            sanitizeProviderErrorMessage(result);
+        super.end(result);
+    }
 }
 /** Factory function for AssistantMessageEventStream (for use in extensions) */
 export function createAssistantMessageEventStream() {

package/dist/utils/provider-error.d.ts

@@ -0,0 +1,12 @@
+import type { AssistantMessage } from "../types.ts";
+import { redactCredentialShapes, redactSecrets } from "./secret-redaction.ts";
+export { redactCredentialShapes, redactSecrets };
+/** True when provider text says the route does not serve the configured model id (senpi#4282). */
+export declare function isModelConfigError(errorMessage: string | undefined): boolean;
+/**
+ * The single point where a provider error body enters a message: classify a model configuration error on the RAW
+ * text first (carried as `errorCause`), then keep only the redacted text for every provider error. Idempotent;
+ * called for every message a provider stream publishes, so no partial, event or final result carries a raw body.
+ */
+export declare function sanitizeProviderErrorMessage(message: AssistantMessage): void;
+//# sourceMappingURL=provider-error.d.ts.map

package/dist/utils/provider-error.js

@@ -0,0 +1,28 @@
+import { redactCredentialShapes, redactSecrets } from "./secret-redaction.js";
+export { redactCredentialShapes, redactSecrets };
+// A route that does not serve a configured model id: the OpenAI-compatible `model_not_found` code and OpenAI's
+// "The model `<id>` does not exist" prose, a gateway's "unknown provider for model", Anthropic's not_found_error whose
+// message names the model ("model: <id>"; any other not_found_error is not one), and Google's "models/<id> is not found".
+// Every quantifier is bounded, so a long run never makes a match attempt expensive.
+const MODEL_CONFIG_ERROR = /\bmodel_not_found\b|\bunknown provider for model\b|\bthe model\s{1,8}[`'"]?[\w.:/-]{1,256}[`'"]?\s{1,8}does not exist\b|\bnot_found_error\b[^}]{0,120}?\bmodel:\s{0,8}[\w.:/-]|\bmodels\/[\w.:-]{1,256} is not found\b/i;
+/** True when provider text says the route does not serve the configured model id (senpi#4282). */
+export function isModelConfigError(errorMessage) {
+    return errorMessage !== undefined && MODEL_CONFIG_ERROR.test(errorMessage);
+}
+/**
+ * The single point where a provider error body enters a message: classify a model configuration error on the RAW
+ * text first (carried as `errorCause`), then keep only the redacted text for every provider error. Idempotent;
+ * called for every message a provider stream publishes, so no partial, event or final result carries a raw body.
+ */
+export function sanitizeProviderErrorMessage(message) {
+    const raw = message.errorMessage;
+    if (raw === undefined || raw.length === 0)
+        return;
+    if (message.stopReason === "error" && message.errorCause?.type !== "model_config" && isModelConfigError(raw)) {
+        message.errorCause = { type: "model_config", model: `${message.provider}/${message.model}` };
+    }
+    const redacted = redactSecrets(raw);
+    if (redacted !== raw)
+        message.errorMessage = redacted;
+}
+//# sourceMappingURL=provider-error.js.map

package/dist/utils/retry.js

@@ -389,6 +389,9 @@ export async function retryAssistantCall(produce, policy, signal, callbacks) {
  * before restarting the assistant turn.
  */
 export function isRetryableAssistantError(message) {
+    // A route that does not serve the model answers the same on every attempt, whatever status wraps it.
+    if (message.errorCause?.type === "model_config")
+        return false;
     if (message.stopReason === "error" &&
         message.diagnostics?.some((diagnostic) => diagnostic.type === OAUTH_REFRESH_UNAVAILABLE_DIAGNOSTIC)) {
         return true;

package/dist/utils/secret-classifier.d.ts

@@ -0,0 +1,28 @@
+/** Names whose whole value is a credential at any length; every other credential name needs a 16-character value. */
+export declare const STRICT_WORDS: Set<string>;
+export declare const COOKIE_WORDS: Set<string>;
+export declare const SCHEMES: Set<string>;
+export declare const COOKIE_ATTRIBUTES: Set<string>;
+/**
+ * The credential word a name ends with, after its normalization: numbered slots (OPENAI_API_KEY_2, token2,
+ * x-api-key-1) and a trailing qualifier (api_key_value, apiKeyId) still end with the word. "session" counts only as
+ * the whole name, so session_id stays readable; a word elsewhere in a name (token_type, primary_key_column) or inside
+ * a word (monkey, tokenizer, max_tokens) does not count.
+ */
+export declare function secretWord(text: string, start: number, end: number): string | undefined;
+/** Where the name ends a token: its last run of name characters (a URL path or escape before it is not the name). */
+export declare function nameStart(text: string, start: number, end: number): number;
+export declare function lowerToken(text: string, start: number, end: number, maxLength: number): string | undefined;
+export declare function isInert(text: string, start: number, end: number): boolean;
+/** A known key ends at its alphabet's boundary, not at the end of a URL or filename containing it. */
+export declare function credentialShapeEnd(text: string, start: number, end: number): number;
+/**
+ * Where the first credential-shaped run in [start, end) begins, or -1: a known key prefix or a JWT at the start of a
+ * word anywhere in the token (after "/", "+", "~", "-", "." or "%", so URL userinfo, paths and joined values count),
+ * including percent-encoded token punctuation, never inside a word ("tasks-..." is not "sk-...").
+ * After a credential has already been found, withinCredential also checks inside words: an adjoining key may have
+ * had its prefix consumed by the first key's alphabet. The caller retains the whole token in that ambiguous case.
+ * Constant work per character plus the JWT walks bounded above.
+ */
+export declare function credentialShapeStart(text: string, start: number, end: number, withinCredential?: boolean): number;
+//# sourceMappingURL=secret-classifier.d.ts.map