@columenlabs/lumen-ai 0.1.206 → 0.1.208

package/README.md

@@ -94,8 +94,8 @@ const routes = assistantRoutes(assistant, {
 app.all('/api/assistant/*', (c) => routes(c.req.raw));
 ```
 
-- **Providers.** A tier runs any model in `models` (Claude's and OpenAI's by default, `CLAUDE_MODELS`, `OPENAI_MODELS`): Claude through Anthropic's Messages API, OpenAI through the Responses API, with the same tools, drafts, Stop and caps. A hand-off may cross providers. The advisor and prompt caching marks are Claude's only.
-- **Keys.** Each provider has its own keys (`?provider=anthropic|openai` on the key routes). An admin pastes the shared key everyone uses (`PUT /key`); it is tested with one free call before it is kept, then sealed, and no route returns it. A person may add their own (`PUT /my-key`), with one monthly cap on their own keys (`PUT /my-key/cap`).
+- **Providers.** A tier runs any model in `models` (Claude's and OpenAI's by default, `CLAUDE_MODELS`, `OPENAI_MODELS`): Claude through Anthropic's Messages API, OpenAI through the Responses API, with the same tools, drafts, Stop and caps. xAI's Grok models (`XAI_MODELS`) are opt in: an app that lists them gets an xAI row in Model providers (an API key, `xai-…`); they run on the same Responses client at `XAI_BASE_URL` (`https://api.x.ai/v1`). xAI has no public sign-in for other apps, so Grok takes a key only. A hand-off may cross providers. The advisor and prompt caching marks are Claude's only.
+- **Keys.** Each provider has its own keys (`?provider=anthropic|openai|xai` on the key routes). An admin pastes the shared key everyone uses (`PUT /key`); it is tested with one free call before it is kept, then sealed, and no route returns it. A person may add their own (`PUT /my-key`), with one monthly cap on their own keys (`PUT /my-key/cap`).
 - **ChatGPT sign-in.** In place of their own OpenAI key a person may sign in with their ChatGPT plan (`POST /my-signin`, then `POST /my-signin/finish {url}`): the sign-in opens in a new tab and ends on `http://127.0.0.1:1455/auth/callback`, a page that does not load, whose address the person pastes back. The tokens are sealed as their own key and refreshed before they run out; answers on the plan count tokens and no dollars.
 - **Who pays.** The person's pick (the shared keys by default) while it has a key for the tier's provider and money left this month under its cap (an admin sets the shared keys' cap per person, `PUT /app`), else the other; with neither the panel says why.
 - **Tools.** Each group is Off, Read, Read + draft or Read + write per person. A tool is a read when its MCP `readOnlyHint` is set. On Read + draft a write only drafts a card, and runs as the person when they press Save, after access is checked again. A group with `readOnly: true` (read tools only) is offered Off or Read alone. Read + write is offered only for a group with `writes: true`: its writes run at once, and with `undo` set each one's line in the chat has Undo, which calls `undo(caller, { tool, args, result })`; the model is told what was undone. Cards drafted one after another show as one stack with Save all. Use `mcpServerTools` (an SDK `McpServer`), `mcpFetchTools` (a server served as a fetch handler, any SDK), `remoteMcpTools` or `plainTools`.

package/dist/agent/agent.js

@@ -18,7 +18,7 @@ import { generateText } from 'ai';
 import { CONNECTOR_GROUP, checkConnectorUrl, connectorGroup, connectorId, connectorSource, } from './connectors.js';
 import { aiModel, cachedTurn, planFallback, turnSettings } from './models.js';
 import { screenMapOf, screenNews, screenOutcomesOf, screenRules, screenTool, } from './screen.js';
-import { LAZY_AT, TOOL_SEARCH, lazyTools } from './search.js';
+import { LAZY_AT, TOOL_SEARCH, lazyTools, usedTools } from './search.js';
 import { chunkEvents, itemsOf } from './stream.js';
 import { openAiTools, } from './tools.js';
 import { UsageMeter } from './usage.js';
@@ -515,7 +515,7 @@ export class LumenAgent extends Think {
             ];
             if (plan.first && !core.includes(plan.first))
                 core.push(plan.first);
-            lazy = lazyTools(tools, core, (n) => groups.get(n) ?? 'other');
+            lazy = lazyTools(tools, core, (n) => groups.get(n) ?? 'other', usedTools(ctx.messages));
             tools[TOOL_SEARCH] = lazy.search;
             system = `${system}\n\n${lazy.catalog}`;
             this.#turn.system = system;

package/dist/agent/models.d.ts

@@ -1,6 +1,6 @@
 import type { AssistantEffort } from '@columenlabs/lumen-ui-types/assistant';
 import type { JSONValue, LanguageModel, ModelMessage, SystemModelMessage } from 'ai';
-import type { ModelDef } from '../assistant/models.js';
+import { type ModelDef } from '../assistant/models.js';
 /** The key a model runs on. `plan`: an OpenAI access token from a ChatGPT plan sign-in. */
 export interface ModelKey {
     apiKey: string;

package/dist/agent/models.js

@@ -5,6 +5,7 @@
  */
 import { createAnthropic } from '@ai-sdk/anthropic';
 import { createOpenAI } from '@ai-sdk/openai';
+import { XAI_BASE_URL } from '../assistant/models.js';
 /**
  * A ChatGPT plan sign-in takes function tools only inside one namespace and no output cap, and a
  * forced call is the one tool offered with any call required (developers.openai.com/siwc, Preview
@@ -84,6 +85,12 @@ function textOf(content) {
 export function aiModel(model, key, o = {}) {
     if (model.provider === 'anthropic')
         return createAnthropic({ apiKey: key.apiKey, ...(o.fetch ? { fetch: o.fetch } : {}) })(model.id);
+    if (model.provider === 'xai')
+        return createOpenAI({
+            apiKey: key.apiKey,
+            baseURL: XAI_BASE_URL,
+            ...(o.fetch ? { fetch: o.fetch } : {}),
+        }).responses(model.id);
     const f = key.plan ? planFetch(o.fetch, o.name) : o.fetch;
     return createOpenAI({ apiKey: key.apiKey, ...(f ? { fetch: f } : {}) }).responses(model.id);
 }

package/dist/agent/search.d.ts

@@ -18,8 +18,15 @@ export interface LazyTools {
 }
 /** How well a tool's name and description match the query's words. */
 export declare function toolScore(query: string, name: string, description?: string): number;
+/**
+ * The tools a chat already used or found in earlier turns: each turn starts with only its core
+ * tools on, so a reply such as "yes" to a card offered last turn would call a tool that is off
+ * (AI_NoSuchToolError). Read from the history's tool calls and `tool_search` results.
+ */
+export declare function usedTools(messages: readonly unknown[]): string[];
 /**
  * A search over `tools` whose finds stay on for the rest of the turn. `core` names are always on;
- * `groupOf` names each tool's group for the catalog.
+ * `groupOf` names each tool's group for the catalog; `start` names tools already on (those the
+ * chat used or found in earlier turns, `usedTools`), at most `FOUND_MAX` of the latest.
  */
-export declare function lazyTools(tools: ToolSet, core: string[], groupOf: (name: string) => string): LazyTools;
+export declare function lazyTools(tools: ToolSet, core: string[], groupOf: (name: string) => string, start?: readonly string[]): LazyTools;

package/dist/agent/search.js

@@ -32,12 +32,38 @@ export function toolScore(query, name, description = '') {
     }
     return score;
 }
+/**
+ * The tools a chat already used or found in earlier turns: each turn starts with only its core
+ * tools on, so a reply such as "yes" to a card offered last turn would call a tool that is off
+ * (AI_NoSuchToolError). Read from the history's tool calls and `tool_search` results.
+ */
+export function usedTools(messages) {
+    const out = new Set();
+    for (const m of messages) {
+        const content = m.content;
+        if (!Array.isArray(content))
+            continue;
+        for (const part of content) {
+            if (part.type === 'tool-call' && part.toolName)
+                out.add(part.toolName);
+            if (part.type === 'tool-result' && part.toolName === TOOL_SEARCH) {
+                const o = part.output;
+                const v = (o && typeof o === 'object' && 'value' in o ? o.value : o);
+                for (const f of v?.found ?? [])
+                    if (typeof f?.name === 'string')
+                        out.add(f.name);
+            }
+        }
+    }
+    return [...out];
+}
 /**
  * A search over `tools` whose finds stay on for the rest of the turn. `core` names are always on;
- * `groupOf` names each tool's group for the catalog.
+ * `groupOf` names each tool's group for the catalog; `start` names tools already on (those the
+ * chat used or found in earlier turns, `usedTools`), at most `FOUND_MAX` of the latest.
  */
-export function lazyTools(tools, core, groupOf) {
-    const found = new Set();
+export function lazyTools(tools, core, groupOf, start = []) {
+    const found = new Set(start.filter((n) => n in tools && !core.includes(n) && n !== TOOL_SEARCH).slice(-FOUND_MAX));
     const about = (n) => {
         const d = tools[n]?.description;
         return typeof d === 'string' ? d : '';

package/dist/assistant/engine.d.ts

@@ -202,6 +202,7 @@ export declare class Assistant {
     forRequest(): Assistant;
     private anthropic;
     private openai;
+    private xai;
     private clients;
     /** The providers the app's models run on, in the order the models list them. */
     get providers(): AssistantProvider[];
@@ -274,7 +275,7 @@ export declare class Assistant {
     private askedFor;
     /** Swaps the history for a short summary. False with nothing to compact. */
     /**
-     * One plain answer from OpenAI, metered on `s`: no tools, no chat. Streamed and read from the raw
+     * One plain answer from OpenAI (or xAI, on the same API), metered on `s`: no tools, no chat. Streamed and read from the raw
      * events like the chat loop, because a ChatGPT plan sign-in answers only streamed calls, takes no
      * output cap and may send its words only as deltas.
      */

package/dist/assistant/engine.js

@@ -14,7 +14,7 @@ import OpenAI from 'openai';
 import { aiModel, turnSettings } from '../agent/models.js';
 import { bearings } from './bearings.js';
 import { CHATGPT_REDIRECT, SigninError, finishChatgpt, startChatgpt, testChatgpt, } from './chatgpt.js';
-import { ALL_MODELS, DEFAULT_OUT, Meter, PROVIDERS, effortParams, } from './models.js';
+import { ALL_MODELS, DEFAULT_OUT, Meter, PROVIDERS, XAI_BASE_URL, effortParams, } from './models.js';
 import { DEFAULT_CAP, State, keyDocName, keyState, planDocName, waitText, } from './state.js';
 import { Docs } from './store.js';
 import { toolName, withDeadline } from './tools.js';
@@ -162,6 +162,10 @@ export class Assistant {
         // A plan sign-in's calls are not retried: a usage limit is final for now.
         return new OpenAI({ apiKey, maxRetries: plan ? 0 : 1, ...(f ? { fetch: f } : {}) });
     }
+    xai(apiKey) {
+        const f = this.o.fetch;
+        return new OpenAI({ apiKey, baseURL: XAI_BASE_URL, maxRetries: 1, ...(f ? { fetch: f } : {}) });
+    }
     clients(paying) {
         const { keys, plans } = paying;
         return {
@@ -169,6 +173,7 @@ export class Assistant {
             ...(keys.openai
                 ? { openai: this.openai(keys.openai, !!plans.openai), openaiPlan: !!plans.openai }
                 : {}),
+            ...(keys.xai ? { xai: this.xai(keys.xai) } : {}),
         };
     }
     /** The providers the app's models run on, in the order the models list them. */
@@ -815,13 +820,15 @@ export class Assistant {
     }
     /** Swaps the history for a short summary. False with nothing to compact. */
     /**
-     * One plain answer from OpenAI, metered on `s`: no tools, no chat. Streamed and read from the raw
+     * One plain answer from OpenAI (or xAI, on the same API), metered on `s`: no tools, no chat. Streamed and read from the raw
      * events like the chat loop, because a ChatGPT plan sign-in answers only streamed calls, takes no
      * output cap and may send its words only as deltas.
      */
     async openaiOnce(clients, s, instructions, input, max, signal, images) {
-        const client = clients.openai;
-        const plan = !!clients.openaiPlan;
+        // xAI's API is OpenAI's Responses API at another address.
+        const xai = s.model.provider === 'xai';
+        const client = (xai ? clients.xai : clients.openai);
+        const plan = !xai && !!clients.openaiPlan;
         let text = '';
         let done;
         try {
@@ -900,7 +907,8 @@ export class Assistant {
         const max = Math.min(o.maxTokens ?? 1000, 8000);
         let text = '';
         try {
-            if (s.model.provider === 'openai' && clients.openai) {
+            if ((s.model.provider === 'openai' && clients.openai) ||
+                (s.model.provider === 'xai' && clients.xai)) {
                 text = await this.openaiOnce(clients, s, o.system, o.prompt, max, o.signal, o.images);
             }
             else if (clients.anthropic) {
@@ -1025,6 +1033,8 @@ export class Assistant {
         try {
             if (provider === 'openai')
                 await this.openai(apiKey).models.retrieve(model.id);
+            else if (provider === 'xai')
+                await this.xai(apiKey).models.retrieve(model.id);
             else
                 await this.anthropic(apiKey).models.retrieve(model.id);
             return { ok: true, detail: `${label} took the key.`, at };

package/dist/assistant/models.d.ts

@@ -20,6 +20,14 @@ export interface ModelDef {
 export declare const CLAUDE_MODELS: ModelDef[];
 /** OpenAI models, smallest first (list prices from OpenAI's pricing page, October 2026). */
 export declare const OPENAI_MODELS: ModelDef[];
+/**
+ * xAI's Grok models, smallest first (list prices from docs.x.ai/developers/pricing, October 2026,
+ * under 200k tokens of context). xAI's API is OpenAI-compatible (`XAI_BASE_URL`), so they run on the
+ * same Responses client as OpenAI's. Not in `ALL_MODELS`: an app opts in by listing them.
+ */
+export declare const XAI_MODELS: ModelDef[];
+/** xAI's OpenAI-compatible API. */
+export declare const XAI_BASE_URL = "https://api.x.ai/v1";
 /** Every model the kit knows: what a tier may run unless the app lists its own. */
 export declare const ALL_MODELS: ModelDef[];
 /** How Settings names each provider, how its keys start and where a person makes one. */

package/dist/assistant/models.js

@@ -43,6 +43,26 @@ export const OPENAI_MODELS = [
     out: o,
     read: r,
 }));
+/**
+ * xAI's Grok models, smallest first (list prices from docs.x.ai/developers/pricing, October 2026,
+ * under 200k tokens of context). xAI's API is OpenAI-compatible (`XAI_BASE_URL`), so they run on the
+ * same Responses client as OpenAI's. Not in `ALL_MODELS`: an app opts in by listing them.
+ */
+export const XAI_MODELS = [
+    ['grok-4.3', 'Grok 4.3', 1.25, 2.5, 0.2],
+    ['grok-4.6', 'Grok 4.6', 2, 6, 0.5],
+    ['grok-4.7', 'Grok 4.7', 2, 6, 0.5],
+].map(([id, label, i, o, r]) => ({
+    id: id,
+    label: label,
+    provider: 'xai',
+    group: 'xAI',
+    in: i,
+    out: o,
+    read: r,
+}));
+/** xAI's OpenAI-compatible API. */
+export const XAI_BASE_URL = 'https://api.x.ai/v1';
 /** Every model the kit knows: what a tier may run unless the app lists its own. */
 export const ALL_MODELS = [...CLAUDE_MODELS, ...OPENAI_MODELS];
 /** How Settings names each provider, how its keys start and where a person makes one. */
@@ -58,6 +78,11 @@ export const PROVIDERS = {
         keysUrl: 'https://platform.openai.com/api-keys',
         signin: 'chatgpt',
     },
+    xai: {
+        label: 'xAI',
+        prefix: 'xai-',
+        keysUrl: 'https://console.x.ai/team/default/api-keys',
+    },
 };
 /** Output tokens per model call when a tier sets none. */
 export const DEFAULT_OUT = 16_000;

package/dist/assistant/state.d.ts

@@ -193,8 +193,8 @@ export declare class State {
     addSpend(id: string, payer: AssistantPayer, parts: UsagePart[]): Promise<void>;
     /** The payer's key of each provider, those set, and which are plan sign-ins. */
     keysOf(id: string, payer: AssistantPayer): Promise<{
-        keys: Partial<Record<"anthropic" | "openai", string>>;
-        plans: Partial<Record<"anthropic" | "openai", boolean>>;
+        keys: Partial<Record<"anthropic" | "openai" | "xai", string>>;
+        plans: Partial<Record<"anthropic" | "openai" | "xai", boolean>>;
     }>;
     /** Who pays the person's next answer on `provider`'s model, or why nobody can. */
     paying(id: string, provider: AssistantProvider): Promise<{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@columenlabs/lumen-ai",
-  "version": "0.1.206",
+  "version": "0.1.208",
   "description": "Lumen's assistant and agent parts: a chat assistant's server (Claude tiers, tools over MCP, the web, hand off, spend caps), serving an MCP server from a Worker, read-only tool sets and metered tool calls.",
   "license": "MIT",
   "type": "module",
@@ -52,8 +52,8 @@
     "@ai-sdk/openai": "4.0.108",
     "@anthropic-ai/sdk": "0.133.0",
     "@cloudflare/think": "0.23.0",
-    "@columenlabs/lumen-ops": "0.1.206",
-    "@columenlabs/lumen-ui-types": "0.1.206",
+    "@columenlabs/lumen-ops": "0.1.208",
+    "@columenlabs/lumen-ui-types": "0.1.208",
     "agents": "0.32.0",
     "ai": "7.0.162",
     "just-bash": "3.6.0",