@code-yeongyu/senpi-ai 2026.8.14 → 2026.8.17

package/README.md

@@ -90,6 +90,7 @@ Unified LLM API with provider collections, automatic auth resolution, token and
 - **Qwen Token Plan** (separate Individual and existing catalogs, with a separate China provider)
 - **Xiaomi MiMo** (defaults to API billing endpoint, with separate Token Plan providers for `cn`/`ams`/`sgp` regions)
 - **Alibaba Token Plan** (Alibaba Cloud Model Studio prepaid Token Plan, OpenAI-compatible `ap-southeast-1` endpoint)
+- **Cursor** (Pro/Ultra/Teams subscription; native `cursor-agent` protocol with full chat + server-driven tool calling, per-account dynamic catalog, requires OAuth, see below)
 - **Any other OpenAI-compatible API**: local Ollama, vLLM, LM Studio, etc.
 
 ## Installation
@@ -1161,6 +1162,7 @@ Built-in API implementations live under `./api/<api-id>`:
 | `openai-completions` | `OpenAICompletionsOptions` |
 | `openai-responses` | `OpenAIResponsesOptions` |
 | `openai-codex-responses` | `OpenAICodexResponsesOptions` |
+| `cursor-agent` | `CursorAgentOptions` |
 | `azure-openai-responses` | `AzureOpenAIResponsesOptions` |
 | `google-generative-ai` | `GoogleOptions` |
 | `google-vertex` | `GoogleVertexOptions` |
@@ -1483,6 +1485,7 @@ Several providers support OAuth authentication instead of static API keys:
 - **OpenAI Codex** (ChatGPT Plus/Pro subscription, access to GPT-5.x Codex models)
 - **GitHub Copilot** (Copilot subscription)
 - **OpenRouter** (OAuth PKCE that mints a user-controlled API key)
+- **Cursor** (Pro/Ultra/Teams subscription; browser deep-link + poll flow. After login, the per-account model catalog is discovered through `GetUsableModels` and chat streams over the native `cursor-agent` protocol with in-band tool execution — hosts supply `CursorAgentOptions.execHandlers` to bridge Cursor's server-driven tool calls onto local tools)
 
 Each of these providers carries an `OAuthAuth` on `provider.auth.oauth` with three operations: `login(interaction)` uses the provider-neutral `AuthInteraction.prompt()`/`notify()` protocol and returns a credential, `refresh(credential, signal)` refreshes expiring credentials when applicable, and `toAuth(credential)` derives request auth (GitHub Copilot's per-account base URL comes from here). Provider login interactions and refresh calls always carry a concrete abort signal. Refresh is automatic: `models.getAuth(providerId)` and request paths refresh expired tokens under a credential-store lock, so concurrent requests and processes cannot double-refresh. OpenRouter's OAuth flow instead returns a permanent API key, so its refresh operation is a no-op.
 

package/dist/api/anthropic-messages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anthropic-messages.d.ts","sourceRoot":"","sources":["../../src/api/anthropic-messages.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAC1C,OAAO,KAAK,EAGX,+BAA+B,EAK/B,MAAM,yCAAyC,CAAC;AAEjD,OAAO,KAAK,EAKX,OAAO,EAGP,KAAK,EAGL,mBAAmB,EAEnB,cAAc,EACd,aAAa,EAOb,MAAM,aAAa,CAAC;AAkCrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AA6JlE,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAE1E,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,SAAS,CAAC;AAoEhE,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACtD;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,CAAC;CACnB;AA4zBD,eAAO,MAAM,MAAM,EAAE,cAAc,CAAC,oBAAoB,EAAE,gBAAgB,CA6ZzE,CAAC;AA0FF,eAAO,MAAM,YAAY,EAAE,cAAc,CAAC,oBAAoB,EAAE,mBAAmB,CA2ClF,CAAC;AAsIF,wBAAgB,mCAAmC,CAClD,KAAK,EAAE,KAAK,CAAC,oBAAoB,CAAC,EAClC,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACxB,+BAA+B,CAkBjC"}
+{"version":3,"file":"anthropic-messages.d.ts","sourceRoot":"","sources":["../../src/api/anthropic-messages.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAC1C,OAAO,KAAK,EAGX,+BAA+B,EAK/B,MAAM,yCAAyC,CAAC;AAEjD,OAAO,KAAK,EAKX,OAAO,EAGP,KAAK,EAGL,mBAAmB,EAEnB,cAAc,EACd,aAAa,EAOb,MAAM,aAAa,CAAC;AAmCrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AA6JlE,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAE1E,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,SAAS,CAAC;AAoEhE,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACtD;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,CAAC;CACnB;AA+1BD,eAAO,MAAM,MAAM,EAAE,cAAc,CAAC,oBAAoB,EAAE,gBAAgB,CA2ZzE,CAAC;AA0FF,eAAO,MAAM,YAAY,EAAE,cAAc,CAAC,oBAAoB,EAAE,mBAAmB,CAyClF,CAAC;AAyIF,wBAAgB,mCAAmC,CAClD,KAAK,EAAE,KAAK,CAAC,oBAAoB,CAAC,EAClC,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACxB,+BAA+B,CAkBjC"}

package/dist/api/anthropic-messages.js

@@ -6,6 +6,7 @@ import { splitDeferredTools } from "../utils/deferred-tools.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
 import { headersToRecord, providerHeadersToRecord } from "../utils/headers.js";
 import { parseJsonWithRepair, parseStreamingJson } from "../utils/json-parse.js";
+import { getPiUserAgent } from "../utils/pi-user-agent.js";
 import { getAnthropicCompat, isAnthropicApiBaseUrl } from "../utils/prompt-cache-ttl.js";
 import { getProviderEnvValue } from "../utils/provider-env.js";
 import { retryProviderRequest } from "../utils/provider-retry.js";
@@ -18,7 +19,7 @@ import { resolveRootObjectSchema } from "../utils/tool-schema-compat.js";
 import { demotedToolCallText, demotedToolResultText } from "../utils/unavailable-tool-text.js";
 import { sanitizeAnthropicToolPairs } from "./anthropic-tool-pairs.js";
 import { resolveCloudflareBaseUrl } from "./cloudflare.js";
-import { resolveJsonSchemaStrictSampling } from "./constrained-sampling.js";
+import { getJsonSchemaToolParameters, resolveJsonSchemaStrictSampling } from "./constrained-sampling.js";
 import { buildCopilotDynamicHeaders, hasCopilotVisionInput } from "./github-copilot-headers.js";
 import { ANTHROPIC_RESERVED_BODY_KEYS, adjustMaxTokensForThinking, buildBaseOptions, clampMaxTokensToContext, } from "./simple-options.js";
 import { transformMessages } from "./transform-messages.js";
@@ -197,8 +198,36 @@ function mergeHeaders(...headerSources) {
     }
     return merged;
 }
-function hasAuthorizationHeader(headers) {
-    return Object.keys(headers ?? {}).some((name) => name.toLowerCase() === "authorization");
+function mergeClientHeaders(model, ...headerSources) {
+    const merged = mergeHeaders(...headerSources);
+    if (model.provider === "kimi-coding") {
+        for (const name of Object.keys(merged)) {
+            if (name.toLowerCase() === "user-agent")
+                delete merged[name];
+        }
+        merged["User-Agent"] = getPiUserAgent();
+    }
+    return merged;
+}
+function hasHeader(headers, name) {
+    if (!headers)
+        return false;
+    const expected = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === expected && value !== null && value.trim().length > 0)
+            return true;
+    }
+    return false;
+}
+function assertRequestAuth(provider, apiKey, headers) {
+    if (apiKey)
+        return;
+    if (hasHeader(headers, "authorization") ||
+        hasHeader(headers, "x-api-key") ||
+        hasHeader(headers, "cf-aig-authorization")) {
+        return;
+    }
+    throw new Error(`No API key for provider: ${provider}`);
 }
 function isRecord(value) {
     return typeof value === "object" && value !== null;
@@ -901,9 +930,7 @@ export const stream = (model, context, options) => {
             else {
                 const apiKey = options?.apiKey;
                 const optionsHeaders = providerHeadersToRecord(options?.headers);
-                if (!apiKey && !hasAuthorizationHeader(optionsHeaders)) {
-                    throw new Error(`No API key for provider: ${model.provider}`);
-                }
+                assertRequestAuth(model.provider, apiKey, optionsHeaders);
                 let copilotDynamicHeaders;
                 if (model.provider === "github-copilot") {
                     const hasImages = hasCopilotVisionInput(context.messages);
@@ -1329,9 +1356,7 @@ function mapThinkingLevelToEffort(model, level) {
 }
 export const streamSimple = (model, context, options) => {
     const apiKey = options?.apiKey;
-    if (!apiKey && !hasAuthorizationHeader(providerHeadersToRecord(options?.headers))) {
-        throw new Error(`No API key for provider: ${model.provider}`);
-    }
+    assertRequestAuth(model.provider, apiKey, providerHeadersToRecord(options?.headers));
     const base = buildBaseOptions(model, context, options, options?.apiKey);
     if (!options?.reasoning) {
         return stream(model, context, { ...base, thinkingEnabled: false });
@@ -1396,7 +1421,7 @@ function createClient(model, apiKey, interleavedThinking, useFineGrainedToolStre
             baseURL: model.baseUrl,
             dangerouslyAllowBrowser: true,
             fetch,
-            defaultHeaders: sanitizeAdaptiveThinkingHeaders(model, mergeHeaders({
+            defaultHeaders: sanitizeAdaptiveThinkingHeaders(model, mergeClientHeaders(model, {
                 accept: "application/json",
                 "anthropic-dangerous-direct-browser-access": "true",
                 ...(betaFeatures.length > 0 ? { "anthropic-beta": betaFeatures.join(",") } : {}),
@@ -1412,7 +1437,7 @@ function createClient(model, apiKey, interleavedThinking, useFineGrainedToolStre
             baseURL: model.baseUrl,
             dangerouslyAllowBrowser: true,
             fetch,
-            defaultHeaders: sanitizeAdaptiveThinkingHeaders(model, mergeHeaders({
+            defaultHeaders: sanitizeAdaptiveThinkingHeaders(model, mergeClientHeaders(model, {
                 accept: "application/json",
                 "anthropic-dangerous-direct-browser-access": "true",
                 "anthropic-beta": ["claude-code-20250219", "oauth-2025-04-20", ...betaFeatures].join(","),
@@ -1430,7 +1455,7 @@ function createClient(model, apiKey, interleavedThinking, useFineGrainedToolStre
         baseURL: model.baseUrl,
         dangerouslyAllowBrowser: true,
         fetch,
-        defaultHeaders: sanitizeAdaptiveThinkingHeaders(model, mergeHeaders({
+        defaultHeaders: sanitizeAdaptiveThinkingHeaders(model, mergeClientHeaders(model, {
             accept: "application/json",
             "anthropic-dangerous-direct-browser-access": "true",
             ...(betaFeatures.length > 0 ? { "anthropic-beta": betaFeatures.join(",") } : {}),
@@ -1845,9 +1870,10 @@ function convertTools(tools, isOAuthToken, supportsEagerToolInputStreaming, supp
         return [];
     return tools.map((tool, index) => {
         const strict = resolveJsonSchemaStrictSampling(tool, supportsStrictTools);
+        const parameters = getJsonSchemaToolParameters(tool, strict);
         // A root union carries no top-level properties, so reading them directly
         // would advertise the tool to the model as taking no arguments at all.
-        const schema = resolveRootObjectSchema(tool.parameters);
+        const schema = resolveRootObjectSchema(parameters);
         const legacyInputSchema = {
             type: "object",
             properties: schema.properties ?? {},
@@ -1855,7 +1881,7 @@ function convertTools(tools, isOAuthToken, supportsEagerToolInputStreaming, supp
         };
         const inputSchema = strict === true
             ? {
-                ...tool.parameters,
+                ...parameters,
                 ...legacyInputSchema,
             }
             : legacyInputSchema;