@gajae-code/ai 0.11.6 → 0.11.8

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## [Unreleased]
 
+## [0.11.8] - 2026-07-23
+
+### Fixed
+
+- OpenAI Responses / Codex native history replay no longer submits missing resident-image placeholders as `input_image.image_url`. Invalid values (including `[Session resident imageUrl blob missing: …]`) are dropped, or retained as `file_id`-only parts when a non-empty `file_id` is present, so a single unavailable historical image cannot brick `/retry` (#2924).
+- Raised the first-event stream timeout floor to five minutes for `alibaba-token-plan` models using the OpenAI Completions and Responses APIs, while preserving caller and environment overrides and the existing inter-event idle timeout.
+- OAuth refresh peer-rotation recovery now runs before failure classification instead of only on the definitive-failure path, and the definitive matcher recognizes the "grant is invalid" phrasing. Providers whose invalid-grant response does not contain the literal `invalid_grant` (e.g. Kimi's 400 "The provided authorization grant is invalid") previously had rotation races misclassified as transient, temp-blocking a healthy credential for five minutes on every race; with Kimi's ~12-minute access tokens and multiple processes sharing the credential store this surfaced as repeated logouts. Genuine revocations are now disabled with a cause instead of looping temp-blocks.
+- Anthropic 400 `Invalid \`signature\` in \`thinking\` block` responses now trigger the one-shot thinking replay repair instead of failing the turn. The existing repair matcher only recognized the "latest assistant message ... cannot be modified" wording, so the signature-validation variant — which can cite a `thinking`/`redacted_thinking` block anywhere in the replayed history (e.g. after compaction/pruning rewrote an earlier turn) — was treated as a fatal request error. The retry now rebuilds the request with thinking blocks dropped from every replayed assistant message (`repairAllAssistantThinking`), while the latest-message mutation variant keeps the targeted latest-only repair.
+
+### Changed
+
+- Raw tool-argument rejection hooks can now select from bounded, authority-controlled correction codes. Unknown or extension-supplied values retain the byte-for-byte generic rejection instead of reaching model-visible validation errors.
+
+## [0.11.7] - 2026-07-22
+
+### Changed
+
+- Replaced the `alibaba-coding-plan` provider with first-class `alibaba-token-plan` support. The `/login` OAuth list, provider descriptor, model manager, models.dev descriptor, and bundled `models.json` now target the maintained Alibaba Token Plan endpoint (`https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1`, env `ALIBABA_TOKEN_PLAN_API_KEY`) and validate logins against `deepseek-v4-pro`. The retired `alibaba-coding-plan` provider pointed at `coding-intl.dashscope.aliyuncs.com`, which rejected real token-plan keys with 401 and was the only Alibaba entry exposed in `/login`.
+
 ## [0.11.4] - 2026-07-20
 
 ### Added
@@ -32,6 +51,9 @@
 ### Fixed
 
 - Fixed frequent `Request blocked (code=invalid_prompt)` failures on gpt-5.6 (Sol/Terra/Luna) subagent, default-agent, and compaction turns (ref openai/codex#32028, oh-my-pi#5184). Leaked Harmony control-token markers (e.g. `<|channel|>analysis`) were only neutralized on the replayed-history payload path, so markers in assistant reasoning summaries, live-converted message/tool-output text, and user-authored content reached the OpenAI Responses and OpenAI-codex-responses transports verbatim and wedged the session (the poisoned item was re-sent every turn). Both transports now neutralize reserved control tokens across the entire outgoing `input` array at the request boundary via an idempotent zero-width-space insertion that keeps the text human-readable.
+### Fixed
+
+- Fixed Fable 5 adaptive thinking being billed but never displayed: model discovery now classifies `claude-fable-*` as `anthropic-adaptive` (was cached as `budget`, sending `enabled`+`budget_tokens` that Fable answers with signature-only thinking), and `supportsAdaptiveThinkingDisplay` opts Fable into `display: "summarized"` on both Anthropic Messages and Bedrock Converse transports (#2791).
 
 ## [0.10.0] - 2026-07-12
 ### Fixed

package/dist/types/auth-broker/client.d.ts

@@ -1,5 +1,5 @@
 import type { AuthCredential } from "../auth-storage";
-import type { CredentialDisableResponse, CredentialIfAbsentUploadResponse, CredentialRefreshResponse, CredentialUploadResponse, HealthzResponse, SnapshotResponse, SnapshotStreamEvent, UsageResponse } from "./types";
+import type { CredentialDisableResponse, CredentialIfAbsentUploadResponse, CredentialRefreshRequest, CredentialRefreshResponse, CredentialUploadResponse, HealthzResponse, SnapshotResponse, SnapshotStreamEvent, UsageResponse } from "./types";
 export interface AuthBrokerClientOptions {
     /** Base URL (e.g. `https://broker.tailnet:8765`). Trailing slashes are trimmed. */
     url: string;
@@ -61,6 +61,7 @@ export declare class AuthBrokerClient {
     }): AsyncGenerator<SnapshotStreamEvent>;
     fetchUsage(signal?: AbortSignal): Promise<UsageResponse>;
     refreshCredential(id: number, signal?: AbortSignal): Promise<CredentialRefreshResponse>;
+    refreshMCPCredential(id: number, body: CredentialRefreshRequest, signal?: AbortSignal): Promise<CredentialRefreshResponse>;
     disableCredential(id: number, cause: string, signal?: AbortSignal): Promise<CredentialDisableResponse>;
     uploadCredential(provider: string, credential: AuthCredential, signal?: AbortSignal): Promise<CredentialUploadResponse>;
     uploadCredentialIfAbsent(provider: string, credential: AuthCredential, signal?: AbortSignal): Promise<CredentialIfAbsentUploadResponse>;

package/dist/types/auth-broker/remote-store.d.ts

@@ -1,4 +1,4 @@
-import { type AuthCredential, type AuthCredentialIfAbsentResult, type AuthCredentialStore, type OAuthCredential, type StoredAuthCredential } from "../auth-storage";
+import { type AuthCredential, type AuthCredentialIfAbsentResult, type AuthCredentialStore, type MCPOAuthRefreshClient, type OAuthCredential, type StoredAuthCredential } from "../auth-storage";
 import type { Provider } from "../types";
 import type { UsageReport } from "../usage";
 import type { OAuthCredentials } from "../utils/oauth/types";
@@ -78,6 +78,7 @@ export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
      * the `refresh` slot.
      */
     refreshOAuthCredential(_provider: Provider, credentialId: number, _credential: OAuthCredential, signal?: AbortSignal): Promise<OAuthCredentials>;
+    refreshMCPOAuthCredential(credentialId: number, credential: OAuthCredential, client: MCPOAuthRefreshClient, signal?: AbortSignal): Promise<OAuthCredential>;
     /**
      * Store-level hook consumed by `AuthStorage.fetchUsageReports()` — proxies
      * to the broker's `/v1/usage` endpoint. The broker's egress IP isn't

package/dist/types/auth-broker/types.d.ts

@@ -5,7 +5,7 @@
  * clients use `access` tokens directly and call back to the broker when a
  * credential expires or a 401 surfaces on a supposedly-fresh credential.
  */
-import type { AuthCredential, AuthCredentialIfAbsentReason, AuthCredentialSnapshot, AuthCredentialSnapshotEntry } from "../auth-storage";
+import type { AuthCredential, AuthCredentialIfAbsentReason, AuthCredentialSnapshot, AuthCredentialSnapshotEntry, MCPOAuthRefreshClient } from "../auth-storage";
 import type { UsageReport } from "../usage";
 /** GET /v1/healthz response body. */
 export interface HealthzResponse {
@@ -36,6 +36,8 @@ export interface UsageResponse {
 export interface CredentialRefreshResponse {
     entry: AuthCredentialSnapshotEntry;
 }
+/** Optional MCP client metadata; the broker still selects the stored token endpoint. */
+export type CredentialRefreshRequest = MCPOAuthRefreshClient;
 /** POST /v1/credential/:id/disable request body. */
 export interface CredentialDisableRequest {
     cause: string;

package/dist/types/auth-broker/wire-schemas.d.ts

@@ -11,6 +11,10 @@
  * `hasOnlyFields` allowlist for the same effect.
  */
 import * as z from "zod/v4";
+export declare const mcpOAuthBindingSchema: z.ZodObject<{
+    resourceOrigin: z.ZodString;
+    tokenEndpoint: z.ZodString;
+}, z.core.$strict>;
 /** Real OAuth credential (broker-side) — refresh token is the actual upstream value. */
 export declare const oauthCredentialSchema: z.ZodObject<{
     type: z.ZodLiteral<"oauth">;
@@ -21,6 +25,10 @@ export declare const oauthCredentialSchema: z.ZodObject<{
     projectId: z.ZodOptional<z.ZodString>;
     email: z.ZodOptional<z.ZodString>;
     accountId: z.ZodOptional<z.ZodString>;
+    mcpBinding: z.ZodOptional<z.ZodObject<{
+        resourceOrigin: z.ZodString;
+        tokenEndpoint: z.ZodString;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 /** OAuth credential as it appears in broker snapshots — refresh replaced with sentinel. */
 export declare const remoteOauthCredentialSchema: z.ZodObject<{
@@ -31,6 +39,10 @@ export declare const remoteOauthCredentialSchema: z.ZodObject<{
     projectId: z.ZodOptional<z.ZodString>;
     email: z.ZodOptional<z.ZodString>;
     accountId: z.ZodOptional<z.ZodString>;
+    mcpBinding: z.ZodOptional<z.ZodObject<{
+        resourceOrigin: z.ZodString;
+        tokenEndpoint: z.ZodString;
+    }, z.core.$strict>>;
     refresh: z.ZodLiteral<"__remote__">;
 }, z.core.$strict>;
 export declare const apiKeyCredentialSchema: z.ZodObject<{
@@ -47,6 +59,10 @@ export declare const writableAuthCredentialSchema: z.ZodDiscriminatedUnion<[z.Zo
     projectId: z.ZodOptional<z.ZodString>;
     email: z.ZodOptional<z.ZodString>;
     accountId: z.ZodOptional<z.ZodString>;
+    mcpBinding: z.ZodOptional<z.ZodObject<{
+        resourceOrigin: z.ZodString;
+        tokenEndpoint: z.ZodString;
+    }, z.core.$strict>>;
 }, z.core.$strict>, z.ZodObject<{
     type: z.ZodLiteral<"api_key">;
     key: z.ZodString;
@@ -60,6 +76,10 @@ export declare const snapshotCredentialSchema: z.ZodDiscriminatedUnion<[z.ZodObj
     projectId: z.ZodOptional<z.ZodString>;
     email: z.ZodOptional<z.ZodString>;
     accountId: z.ZodOptional<z.ZodString>;
+    mcpBinding: z.ZodOptional<z.ZodObject<{
+        resourceOrigin: z.ZodString;
+        tokenEndpoint: z.ZodString;
+    }, z.core.$strict>>;
     refresh: z.ZodLiteral<"__remote__">;
 }, z.core.$strict>, z.ZodObject<{
     type: z.ZodLiteral<"api_key">;
@@ -76,6 +96,10 @@ export declare const credentialSnapshotEntrySchema: z.ZodObject<{
         projectId: z.ZodOptional<z.ZodString>;
         email: z.ZodOptional<z.ZodString>;
         accountId: z.ZodOptional<z.ZodString>;
+        mcpBinding: z.ZodOptional<z.ZodObject<{
+            resourceOrigin: z.ZodString;
+            tokenEndpoint: z.ZodString;
+        }, z.core.$strict>>;
         refresh: z.ZodLiteral<"__remote__">;
     }, z.core.$strict>, z.ZodObject<{
         type: z.ZodLiteral<"api_key">;
@@ -94,6 +118,10 @@ export declare const snapshotEntrySchema: z.ZodObject<{
         projectId: z.ZodOptional<z.ZodString>;
         email: z.ZodOptional<z.ZodString>;
         accountId: z.ZodOptional<z.ZodString>;
+        mcpBinding: z.ZodOptional<z.ZodObject<{
+            resourceOrigin: z.ZodString;
+            tokenEndpoint: z.ZodString;
+        }, z.core.$strict>>;
         refresh: z.ZodLiteral<"__remote__">;
     }, z.core.$strict>, z.ZodObject<{
         type: z.ZodLiteral<"api_key">;
@@ -129,6 +157,10 @@ export declare const snapshotResponseSchema: z.ZodObject<{
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;
@@ -160,6 +192,10 @@ export declare const snapshotStreamSnapshotEventSchema: z.ZodObject<{
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;
@@ -192,6 +228,10 @@ export declare const snapshotStreamEntryEventSchema: z.ZodObject<{
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;
@@ -236,6 +276,10 @@ export declare const snapshotStreamEventSchema: z.ZodDiscriminatedUnion<[z.ZodOb
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;
@@ -266,6 +310,10 @@ export declare const snapshotStreamEventSchema: z.ZodDiscriminatedUnion<[z.ZodOb
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;
@@ -348,6 +396,10 @@ export declare const usageResponseSchema: z.ZodObject<{
         raw: z.ZodOptional<z.ZodUnknown>;
     }, z.core.$strip>>;
 }, z.core.$strict>;
+export declare const credentialRefreshRequestSchema: z.ZodObject<{
+    clientId: z.ZodOptional<z.ZodString>;
+    clientSecret: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
 export declare const credentialRefreshResponseSchema: z.ZodObject<{
     entry: z.ZodObject<{
         id: z.ZodNumber;
@@ -360,6 +412,10 @@ export declare const credentialRefreshResponseSchema: z.ZodObject<{
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;
@@ -385,6 +441,10 @@ export declare const credentialUploadRequestSchema: z.ZodObject<{
         projectId: z.ZodOptional<z.ZodString>;
         email: z.ZodOptional<z.ZodString>;
         accountId: z.ZodOptional<z.ZodString>;
+        mcpBinding: z.ZodOptional<z.ZodObject<{
+            resourceOrigin: z.ZodString;
+            tokenEndpoint: z.ZodString;
+        }, z.core.$strict>>;
     }, z.core.$strict>, z.ZodObject<{
         type: z.ZodLiteral<"api_key">;
         key: z.ZodString;
@@ -402,6 +462,10 @@ export declare const credentialUploadResponseSchema: z.ZodObject<{
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;
@@ -433,6 +497,10 @@ export declare const credentialIfAbsentUploadResponseSchema: z.ZodObject<{
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;

package/dist/types/auth-storage.d.ts

@@ -15,10 +15,26 @@ export type ApiKeyCredential = {
     type: "api_key";
     key: string;
 };
+export interface MCPOAuthBinding {
+    /** Exact HTTP(S) origin of the MCP resource endpoint. */
+    resourceOrigin: string;
+    /** Exact canonical HTTP(S) token endpoint used to create and refresh the credential. */
+    tokenEndpoint: string;
+}
+export declare function resolveMCPOAuthResourceOrigin(value: string): string | undefined;
+export declare function resolveMCPOAuthTokenEndpoint(value: string): string | undefined;
+export declare function isCanonicalMCPOAuthBinding(binding: MCPOAuthBinding): boolean;
+export declare function assertCanonicalMCPOAuthBinding(binding: MCPOAuthBinding | undefined): asserts binding is MCPOAuthBinding;
 export type OAuthCredential = {
     type: "oauth";
+    /** Present only for credentials created by runtime MCP OAuth. */
+    mcpBinding?: MCPOAuthBinding;
 } & OAuthCredentials;
 export type AuthCredential = ApiKeyCredential | OAuthCredential;
+export interface MCPOAuthRefreshClient {
+    clientId?: string;
+    clientSecret?: string;
+}
 export type AuthCredentialEntry = AuthCredential | AuthCredential[];
 export type AuthStorageData = Record<string, AuthCredentialEntry>;
 /**
@@ -161,6 +177,8 @@ export interface AuthCredentialStore {
      * for `timeoutMs * (maxRetries + 1)`.
      */
     refreshOAuthCredential?(provider: Provider, credentialId: number, credential: OAuthCredential, signal?: AbortSignal): Promise<OAuthCredentials>;
+    /** Broker-backed MCP refresh using the broker's stored token endpoint and refresh secret. */
+    refreshMCPOAuthCredential?(credentialId: number, credential: OAuthCredential, client: MCPOAuthRefreshClient, signal?: AbortSignal): Promise<OAuthCredential>;
     /**
      * Optional async pre-read hook invoked after AuthStorage selects a stored
      * credential but before it returns that credential for an outbound request.
@@ -597,7 +615,7 @@ export declare class AuthStorage {
      * refresh attempt, which is required for providers that rotate refresh tokens
      * on every successful refresh.
      */
-    refreshCredentialById(id: number, signal?: AbortSignal): Promise<AuthCredentialSnapshotEntry>;
+    refreshCredentialById(id: number, signal?: AbortSignal, mcpClient?: MCPOAuthRefreshClient): Promise<AuthCredentialSnapshotEntry>;
     /**
      * Force-refresh the OAuth credential with the given id, bypassing the
      * not-yet-expired guard. Used by the auth-broker server to honour
@@ -607,6 +625,8 @@ export declare class AuthStorage {
      * Throws when no OAuth credential with that id is loaded.
      */
     forceRefreshCredentialById(id: number, signal?: AbortSignal): Promise<AuthCredentialSnapshotEntry>;
+    /** Force-refresh the first OAuth credential stored for a provider. */
+    forceRefreshOAuthCredential(provider: string, expected: OAuthCredential, client?: MCPOAuthRefreshClient, signal?: AbortSignal): Promise<OAuthCredential>;
     /**
      * Disable the credential with the given id and emit a
      * {@link CredentialDisabledEvent}. Used by the auth-broker server to honour

package/dist/types/provider-models/openai-compat.d.ts

@@ -116,11 +116,11 @@ export interface KiloModelManagerConfig {
     baseUrl?: string;
 }
 export declare function kiloModelManagerOptions(config?: KiloModelManagerConfig): ModelManagerOptions<"openai-completions">;
-export interface AlibabaCodingPlanModelManagerConfig {
+export interface AlibabaTokenPlanModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;
 }
-export declare function alibabaCodingPlanModelManagerOptions(config?: AlibabaCodingPlanModelManagerConfig): ModelManagerOptions<"openai-completions">;
+export declare function alibabaTokenPlanModelManagerOptions(config?: AlibabaTokenPlanModelManagerConfig): ModelManagerOptions<"openai-completions">;
 export interface VercelAiGatewayModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;

package/dist/types/providers/anthropic.d.ts

@@ -42,6 +42,14 @@ type AnthropicCacheControl = {
 export declare function clearAnthropicFastModeFallback(providerSessionState: Map<string, ProviderSessionState> | undefined): void;
 export declare function isAnthropicFastModeUnsupportedError(error: unknown): boolean;
 export declare function isAnthropicThinkingBlockMutationError(error: unknown): boolean;
+/**
+ * 400 shape where a replayed `thinking`/`redacted_thinking` block fails signature
+ * validation, e.g. `messages.5.content.24: Invalid \`signature\` in \`thinking\` block`.
+ * Unlike the latest-assistant mutation error above, the cited block can sit anywhere
+ * in the replayed history, so recovery must repair every assistant message rather
+ * than only the latest one.
+ */
+export declare function isAnthropicThinkingSignatureInvalidError(error: unknown): boolean;
 export declare const claudeCodeVersion = "2.1.63";
 export declare const claudeToolPrefix: string;
 export declare const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
@@ -184,6 +192,7 @@ export declare function buildAnthropicClientOptions(args: AnthropicClientOptions
 export declare function normalizeCacheControlTtlOrdering(params: MessageCreateParamsStreaming): void;
 export declare function convertAnthropicMessages(messages: Message[], model: Model<"anthropic-messages">, isOAuthToken: boolean, options?: {
     repairLatestAssistantThinking?: boolean;
+    repairAllAssistantThinking?: boolean;
 }): MessageParam[];
 /**
  * Normalize a JSON Schema node for Anthropic tool `input_schema`.

package/dist/types/providers/transform-messages.d.ts

@@ -11,4 +11,5 @@ import type { Api, AssistantMessage, Message, Model } from "../types";
  */
 export declare function transformMessages<TApi extends Api>(messages: Message[], model: Model<TApi>, normalizeToolCallId?: (id: string, model: Model<TApi>, source: AssistantMessage) => string, options?: {
     repairLatestAssistantThinking?: boolean;
+    repairAllAssistantThinking?: boolean;
 }): Message[];

package/dist/types/types.d.ts

@@ -51,7 +51,7 @@ export interface ThinkingConfig {
     /** Provider-specific transport used to encode the selected effort. */
     mode: ThinkingControlMode;
 }
-export type KnownProvider = "alibaba-coding-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio";
+export type KnownProvider = "alibaba-token-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio";
 export type Provider = KnownProvider | string;
 import type { Effort } from "./model-thinking";
 /** Token budgets for each thinking level (token-based providers only) */
@@ -519,6 +519,7 @@ export type TSchema = ZodType | TJsonSchema;
 export type Static<S> = S extends ZodType ? z.infer<S> : S extends {
     static: infer T;
 } ? T : unknown;
+export type RawArgumentRejectionCode = "ask-intent-review-requires-positive-round" | "ask-intent-contract-requires-non-empty-authority" | "ask-deep-interview-metadata-requires-deep-interview-gate";
 export type RawArgumentValidationResult = {
     outcome: "passthrough";
 } | {
@@ -526,6 +527,7 @@ export type RawArgumentValidationResult = {
     arguments: ToolCall["arguments"];
 } | {
     outcome: "reject";
+    code?: RawArgumentRejectionCode;
 };
 export interface Tool<TParameters extends TSchema = TSchema> {
     name: string;

package/dist/types/utils/oauth/alibaba-token-plan.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Alibaba Token Plan login flow.
+ *
+ * Alibaba Token Plan provides OpenAI-compatible models via
+ * https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1.
+ *
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open browser to Alibaba Cloud Model Studio console
+ * 2. User copies their API key
+ * 3. User pastes the API key into the CLI
+ */
+import type { OAuthController } from "./types";
+/**
+ * Login to Alibaba Token Plan.
+ *
+ * Opens browser to API keys page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginAlibabaTokenPlan(options: OAuthController): Promise<string>;

package/dist/types/utils/oauth/types.d.ts

@@ -7,7 +7,7 @@ export type OAuthCredentials = {
     email?: string;
     accountId?: string;
 };
-export type OAuthProvider = "alibaba-coding-plan" | "anthropic" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "zai";
+export type OAuthProvider = "alibaba-token-plan" | "anthropic" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "zai";
 export type OAuthProviderId = OAuthProvider | (string & {});
 export type OAuthPrompt = {
     message: string;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.11.6",
+	"version": "0.11.8",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,7 +40,7 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/utils": "0.11.6",
+		"@gajae-code/utils": "0.11.8",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-broker/client.ts

@@ -12,6 +12,7 @@ import type {
 	CredentialDisableRequest,
 	CredentialDisableResponse,
 	CredentialIfAbsentUploadResponse,
+	CredentialRefreshRequest,
 	CredentialRefreshResponse,
 	CredentialUploadRequest,
 	CredentialUploadResponse,
@@ -242,6 +243,18 @@ export class AuthBrokerClient {
 		}) as Promise<CredentialRefreshResponse>;
 	}
 
+	async refreshMCPCredential(
+		id: number,
+		body: CredentialRefreshRequest,
+		signal?: AbortSignal,
+	): Promise<CredentialRefreshResponse> {
+		return this.#request("POST", `/v1/credential/${id}/refresh`, {
+			body,
+			schema: credentialRefreshResponseSchema,
+			signal,
+		}) as Promise<CredentialRefreshResponse>;
+	}
+
 	async disableCredential(id: number, cause: string, signal?: AbortSignal): Promise<CredentialDisableResponse> {
 		const body: CredentialDisableRequest = { cause };
 		return this.#request("POST", `/v1/credential/${id}/disable`, {

package/src/auth-broker/refresher.ts

@@ -96,6 +96,7 @@ export class AuthBrokerRefresher {
 			const targets: number[] = [];
 			for (const entry of snapshot.credentials) {
 				if (entry.credential.type !== "oauth") continue;
+				if (entry.credential.mcpBinding) continue;
 				const expires = entry.credential.expires;
 				if (typeof expires !== "number" || !Number.isFinite(expires)) continue;
 				if (expires > deadline) continue;

package/src/auth-broker/remote-store.ts

@@ -14,6 +14,8 @@ import {
 	type AuthCredentialIfAbsentResult,
 	type AuthCredentialSnapshotEntry,
 	type AuthCredentialStore,
+	assertCanonicalMCPOAuthBinding,
+	type MCPOAuthRefreshClient,
 	type OAuthCredential,
 	REMOTE_REFRESH_SENTINEL,
 	type StoredAuthCredential,
@@ -512,6 +514,29 @@ export class RemoteAuthCredentialStore implements AuthCredentialStore {
 		};
 	}
 
+	async refreshMCPOAuthCredential(
+		credentialId: number,
+		credential: OAuthCredential,
+		client: MCPOAuthRefreshClient,
+		signal?: AbortSignal,
+	): Promise<OAuthCredential> {
+		const { entry } = await this.#client.refreshMCPCredential(credentialId, client, signal);
+		if (entry.credential.type !== "oauth") {
+			throw new Error(`Broker returned non-OAuth credential for id=${credentialId}`);
+		}
+		assertCanonicalMCPOAuthBinding(credential.mcpBinding);
+		assertCanonicalMCPOAuthBinding(entry.credential.mcpBinding);
+		if (
+			entry.credential.mcpBinding.resourceOrigin !== credential.mcpBinding.resourceOrigin ||
+			entry.credential.mcpBinding.tokenEndpoint !== credential.mcpBinding.tokenEndpoint
+		) {
+			throw new Error("Broker returned mismatched MCP OAuth credential binding");
+		}
+		this.#applyCredentialEntry(entry);
+		this.#maybeRefreshSnapshot("MCP credential refresh");
+		return entry.credential;
+	}
+
 	/**
 	 * Store-level hook consumed by `AuthStorage.fetchUsageReports()` — proxies
 	 * to the broker's `/v1/usage` endpoint. The broker's egress IP isn't

package/src/auth-broker/server.ts

@@ -16,6 +16,7 @@ import { AuthBrokerRefresher, type AuthBrokerRefresherSchedule } from "./refresh
 import type {
 	CredentialDisableResponse,
 	CredentialIfAbsentUploadResponse,
+	CredentialRefreshRequest,
 	CredentialRefreshResponse,
 	CredentialUploadResponse,
 	HealthzResponse,
@@ -33,7 +34,11 @@ import {
 	DEFAULT_SERVER_IDLE_TIMEOUT_S,
 	DEFAULT_STREAM_KEEPALIVE_MS,
 } from "./types";
-import { credentialDisableRequestSchema, credentialUploadRequestSchema } from "./wire-schemas";
+import {
+	credentialDisableRequestSchema,
+	credentialRefreshRequestSchema,
+	credentialUploadRequestSchema,
+} from "./wire-schemas";
 
 export interface AuthBrokerServerOptions {
 	/** Underlying credential storage (wraps the local SQLite store on the broker). */
@@ -561,7 +566,10 @@ export function startAuthBroker(opts: AuthBrokerServerOptions): AuthBrokerServer
 				if (refreshMatch) {
 					const id = Number.parseInt(refreshMatch[1], 10);
 					try {
-						const entry = await opts.storage.refreshCredentialById(id, req.signal);
+						const parsed = await parseBody(req, credentialRefreshRequestSchema, { allowEmpty: true });
+						if (!parsed.ok) return parsed.response;
+						const refreshRequest: CredentialRefreshRequest = parsed.data;
+						const entry = await opts.storage.refreshCredentialById(id, req.signal, refreshRequest);
 						const body: CredentialRefreshResponse = { entry };
 						logger.info("auth-broker credential refreshed", {
 							id,

package/src/auth-broker/types.ts

@@ -11,6 +11,7 @@ import type {
 	AuthCredentialIfAbsentReason,
 	AuthCredentialSnapshot,
 	AuthCredentialSnapshotEntry,
+	MCPOAuthRefreshClient,
 } from "../auth-storage";
 import type { UsageReport } from "../usage";
 
@@ -49,6 +50,9 @@ export interface CredentialRefreshResponse {
 	entry: AuthCredentialSnapshotEntry;
 }
 
+/** Optional MCP client metadata; the broker still selects the stored token endpoint. */
+export type CredentialRefreshRequest = MCPOAuthRefreshClient;
+
 /** POST /v1/credential/:id/disable request body. */
 export interface CredentialDisableRequest {
 	cause: string;

package/src/auth-broker/wire-schemas.ts

@@ -11,11 +11,19 @@
  * `hasOnlyFields` allowlist for the same effect.
  */
 import * as z from "zod/v4";
-import { REMOTE_REFRESH_SENTINEL } from "../auth-storage";
+import { isCanonicalMCPOAuthBinding, REMOTE_REFRESH_SENTINEL } from "../auth-storage";
 import { usageReportSchema } from "../usage";
 
 // ─── Credential payloads ───────────────────────────────────────────────────
 
+export const mcpOAuthBindingSchema = z
+	.object({
+		resourceOrigin: z.string().min(1),
+		tokenEndpoint: z.string().min(1),
+	})
+	.strict()
+	.refine(isCanonicalMCPOAuthBinding, { message: "MCP OAuth binding must use canonical HTTP(S) URLs" });
+
 /** Real OAuth credential (broker-side) — refresh token is the actual upstream value. */
 export const oauthCredentialSchema = z
 	.object({
@@ -37,6 +45,7 @@ export const oauthCredentialSchema = z
 		projectId: z.string().optional(),
 		email: z.string().optional(),
 		accountId: z.string().optional(),
+		mcpBinding: mcpOAuthBindingSchema.optional(),
 	})
 	.strict();
 
@@ -164,6 +173,13 @@ export const usageResponseSchema = z
 
 // ─── Refresh ───────────────────────────────────────────────────────────────
 
+export const credentialRefreshRequestSchema = z
+	.object({
+		clientId: z.string().optional(),
+		clientSecret: z.string().optional(),
+	})
+	.strict();
+
 export const credentialRefreshResponseSchema = z
 	.object({
 		entry: credentialSnapshotEntrySchema,