@gajae-code/ai 0.12.7 → 0.12.10

package/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 ## [Unreleased]
 
+## [0.12.10] - 2026-08-03
+
+## [0.12.9] - 2026-08-03
+### Added
+
+- Anthropic OAuth can now pair by pasting the authorization code Anthropic displays (`https://platform.claude.com/oauth/code/callback`) instead of waiting on `http://localhost:54545/callback`, so a browser with no network route back to the machine running gjc can complete the login. Opt in per login with `OAuthLoginOptions.manualCode`; the loopback flow stays the default and is unchanged. Callback flows can now opt out of binding a local listener entirely (`OAuthCallbackFlowOptions.skipCallbackServer`), which fails fast when no manual code handler is supplied instead of idling until the five-minute timeout. The hosted redirect is a hard-coded constant with no env or config override, so it cannot be repointed at an attacker-controlled collector.
+
+### Fixed
+
+- Composer shell-policy failures now expose a stable structured marker plus provider-specific recovery guidance, while retaining recognition of prefix-only errors from older sessions. Cursor Composer requests use a native `read`/`grep`/`write`/`delete` discipline prompt rather than the generic hashline-tool vocabulary.
+- Alibaba Token Plan streams now allow 600 seconds for the first semantic event, matching observed long-context TTFT above the previous 300-second cutoff. The outer lazy watchdog and both OpenAI transports share one provider fallback; OpenAI Completions also applies it before response headers, and Alibaba SDK connection timeouts from that pre-stream phase are normalized to the typed first-event failure so session retry policy does not replay the request as an unknown timeout.
+- A plain `forbidden` failure no longer mutates credential state. `classifyFallbackTrigger` still returns the same `auth` class for HTTP 401 and 403, but now carries an `authDisposition` refinement of `"credential"` or `"forbidden"`. The refinement reads every code field (`openaiErrorCode`, `anthropicErrorType`, `providerCode`) and orders by specificity: a concrete credential fault wins, a `forbidden` in any field is otherwise terminal (so `{status: 401, providerCode: "forbidden"}` does not rotate), and the status decides only when no auth code is present. `transportFailureFacts` also reads `anthropicErrorType` back from its own key so re-normalizing already-built facts no longer drops it. `streamSimple` consults the disposition at both auth-capture exits — the error-event path and the thrown-error path, the latter unwrapping a nested `error.transportFailure` carrier that the shared `transportFailureFacts` extractor does not dereference — so a forbidden failure never reaches `onAuthError`, and `createAssistantAuthError` now preserves the structured transport facts on the callback error instead of reducing it to a status. The auth gateway's managed-failure bookkeeping likewise stops invalidating a credential on a forbidden response. Previously a single 403 could block an otherwise-healthy credential, and in a multi-credential pool could cycle through and block every row.
+- `AuthStorage` gains `hasRuntimeCredentialSelector()` and `getSessionCredentialRowId()`. The first reports the `--credential` runtime pin, which lives in a different map from the `--api-key` override and previously had no accessor, so callers that must not rotate away from a pinned credential could not see it. The second returns the opaque stored row id for a session's current credential — never an email, account, project, or key material.
+
+## [0.12.8] - 2026-08-02
+### Added
+
+- Added read-only OpenCodex provider discovery with runtime-port resolution, identity-checked health probing, cached `/api/models` catalogs, raw wire model ids, and `/login opencodex` status reprobes without credential persistence.
+- Added the Alibaba Token Plan `deepseek-v4-flash-0731` model with its 1M context, 384K output limit, OpenAI Completions routing, and documented low/high/max reasoning efforts.
+
+### Changed
+
+- OpenAI-compatible discovery and OpenAI Completions/Responses transports now preserve query-bearing endpoint routing, including repeated query parameters. Model resolution records whether a provider discovery result was fetched so consumers can distinguish current discovery evidence from cached data.
+
+### Fixed
+
+- Closed the two remaining ingress holes behind bare `Request Blocked` failures on OpenAI codex models. (1) The chatgpt.com/backend-api pre-model gate rejects with an HTTP 400 bare-`detail` body (`{"detail": "Request blocked."}`) carrying no `error.*` envelope and no `code=invalid_prompt`, so `parseCodexError` surfaced an unexplained message, `isInvalidPromptError` and the codex non-retryable classification missed it, and the session-level `invalid_prompt` circuit breaker never attempted a repaired resend. `parseCodexError` now reads top-level `detail` (string or `{message}`) bodies and classifies a leading `Request blocked` message without an explicit provider code as `invalid_prompt`, surfacing `Request blocked (code=invalid_prompt)` so every existing invalid_prompt contract engages. (2) Outgoing tool definitions (descriptions and JSON-schema strings) bypassed every request-boundary sanitizer on both the OpenAI Responses and OpenAI-codex-responses transports, so a `<|channel|>`-quoting MCP/skill tool description poisoned every request on the session in a way no history repair could fix. Both `convertTools` paths now neutralize reserved control tokens across the whole tool payload via the shared idempotent zero-width-space insertion (ref openai/codex#35838).
+
+### Fixed
+
+- Updated GPT-5.6 Sol, Terra, and Luna to current OpenAI Standard pricing, including Responses API cache-write attribution and full-request long-context pricing above 272K input tokens.
+
 ## [0.12.7] - 2026-07-31
 
 ## [0.12.6] - 2026-07-31

package/dist/types/auth-storage.d.ts

@@ -10,7 +10,7 @@
 import { Database } from "bun:sqlite";
 import type { Provider } from "./types";
 import type { CredentialRankingStrategy, UsageLogger, UsageProvider, UsageReport } from "./usage";
-import type { OAuthController, OAuthCredentials, OAuthProviderId } from "./utils/oauth/types";
+import type { OAuthController, OAuthCredentials, OAuthLoginOptions, OAuthProviderId } from "./utils/oauth/types";
 export type ApiKeyCredential = {
     type: "api_key";
     key: string;
@@ -290,8 +290,9 @@ export type AuthStorageOptions = {
      * Resolve a config value (API key, header value, etc.) to an actual value.
      * - coding-agent injects its resolveConfigValue (supports "!command" syntax via pi-natives)
      * - Default: checks environment variable first, then treats as literal
+     * `cacheScope` changes whenever the provider credential configuration changes.
      */
-    configValueResolver?: (config: string) => Promise<string | undefined>;
+    configValueResolver?: (config: string, cacheScope?: string) => Promise<string | undefined>;
     /**
      * Optional callback fired when AuthStorage automatically disables a
      * credential because something detected it as no longer usable — today
@@ -389,6 +390,9 @@ export declare class AuthStorage {
      */
     close(): void;
     getGeneration(): number;
+    getProviderConfigurationGeneration(provider: string): number;
+    getProviderOAuthRefreshGeneration(provider: string): number;
+    getProviderEvidenceGeneration(provider: string, resolvedApiKey?: string): string;
     onGenerationChanged(listener: (generation: number) => void): () => void;
     offGenerationChanged(listener: (generation: number) => void): void;
     /**
@@ -430,6 +434,29 @@ export declare class AuthStorage {
     removeRuntimeApiKey(provider: string): void;
     /** Whether a provider is currently authenticated by a runtime API-key override. */
     hasRuntimeApiKey(provider: string): boolean;
+    /**
+     * Whether credential selection for a provider is pinned to one stored row by
+     * a runtime selector (`--credential`).
+     *
+     * Distinct from {@link AuthStorage.hasRuntimeApiKey}: that reports the
+     * `--api-key` override, which lives in a different map and is mutually
+     * exclusive with a selector. Callers that must not rotate away from a pinned
+     * credential have to consult BOTH.
+     */
+    hasRuntimeCredentialSelector(provider: string): boolean;
+    /**
+     * Opaque stored row id of the credential this session is currently using.
+     *
+     * Deliberately non-identifying: the persisted primary key, never an email,
+     * account id, project id, or key material. Callers that need to correlate a
+     * credential across a session boundary use this instead of projecting
+     * personal metadata.
+     *
+     * Returns `undefined` when the session has not been routed to a stored
+     * credential yet, or when it authenticated through an env key or fallback
+     * resolver rather than a stored row.
+     */
+    getSessionCredentialRowId(provider: string, sessionId?: string): number | undefined;
     /**
      * Register a per-provider API key sourced from user configuration
      * (e.g. `models.yml` `providers.<name>.apiKey`). Higher priority than
@@ -482,11 +509,11 @@ export declare class AuthStorage {
      * Check if credentials exist for a provider in storage.
      */
     has(provider: string): boolean;
+    hasAuth(provider: string): boolean;
     /**
-     * Check if any form of auth is configured for a provider.
-     * Unlike getApiKey(), this doesn't refresh OAuth tokens.
+     * Check whether configured auth is currently usable without resolving credentials.
      */
-    hasAuth(provider: string): boolean;
+    hasUsableAuth(provider: string): boolean;
     /**
      * Check if OAuth credentials are configured for a provider.
      */
@@ -521,7 +548,7 @@ export declare class AuthStorage {
             message: string;
             placeholder?: string;
         }) => Promise<string>;
-    }): Promise<void>;
+    }, options?: OAuthLoginOptions): Promise<void>;
     /**
      * Logout from a provider.
      */

package/dist/types/index.d.ts

@@ -24,6 +24,7 @@ export * from "./providers/mock";
 export * from "./providers/ollama";
 export * from "./providers/openai-codex-responses";
 export * from "./providers/openai-completions";
+export * from "./providers/openai-opencodex-responses";
 export * from "./providers/openai-responses";
 export * from "./providers/synthetic";
 export * from "./rate-limit-utils";
@@ -45,7 +46,7 @@ export * from "./utils/event-stream";
 export * from "./utils/fallback-transport";
 export * from "./utils/h2-fetch";
 export * from "./utils/oauth";
-export type { OAuthCredentials, OAuthProvider, OAuthProviderId, OAuthProviderInfo, } from "./utils/oauth/types";
+export type { OAuthCredentials, OAuthLoginOptions, OAuthProvider, OAuthProviderId, OAuthProviderInfo, } from "./utils/oauth/types";
 export * from "./utils/overflow";
 export * from "./utils/retry";
 export * from "./utils/schema";

package/dist/types/model-manager.d.ts

@@ -44,6 +44,8 @@ export interface ModelManagerOptions<TApi extends Api = Api, TModelsDevPayload =
 export interface ModelResolutionResult<TApi extends Api = Api> {
     models: Model<TApi>[];
     stale: boolean;
+    /** Whether this resolution successfully fetched dynamic models. */
+    fetched: boolean;
 }
 /**
  * Stateful facade over provider model resolution.

package/dist/types/model-pricing.d.ts

@@ -0,0 +1,3 @@
+import type { Api, Model, ModelCost } from "./types";
+export declare function getOpenAIModelCost<TApi extends Api>(model: Model<TApi>, inputTokens: number): ModelCost | undefined;
+export declare function applyOpenAIModelPricing<TApi extends Api>(model: Model<TApi>): void;

package/dist/types/provider-models/special.d.ts

@@ -1,4 +1,5 @@
 import type { ModelManagerOptions } from "../model-manager";
+export declare function openCodexModelManagerOptions(): ModelManagerOptions<"openai-responses">;
 export interface OpenAICodexModelManagerConfig {
     accessToken?: string;
     accountId?: string;

package/dist/types/providers/composer-discipline.d.ts

@@ -1,26 +1,32 @@
+export declare function isComposerHarnessModel(modelId: string): boolean;
+/** Stable text contract for a local shell rejection caused by Composer file-I/O discipline. */
+export declare const COMPOSER_BASH_POLICY_ERROR_PREFIX = "Composer bash policy blocked repository file I/O.";
+export declare const COMPOSER_BASH_POLICY_ERROR_CODE = "composer-bash-policy:repository-file-io";
+export type ComposerBashPolicyToolSurface = "generic" | "cursor";
 /**
- * Anchor/edit discipline for composer-harness models (xai grok-composer-*,
- * cursor composer-*).
- *
- * Composer models are trained on a proprietary coding-agent harness
- * (Cursor / Grok Build) and carry habits that break this agent's hashline
- * edit workflow when driven through a generic provider. Observed in live
- * sessions with grok-composer-2.5-fast:
- *
- *  - they print files with shell commands (`sed -n`, `cat`, `grep -n`) or
- *    python heredocs whose output carries NO line anchors, then FABRICATE the
- *    2-char anchor hash the edit tool requires (e.g. guessed "617hp" where
- *    the file had "617ca" → "Edit rejected: N anchors do not match");
- *  - they mutate files out-of-band via python heredocs (pathlib write_text /
- *    str.replace), which invalidates every previously seen anchor and defeats
- *    the read-cache snapshot that powers stale-anchor recovery;
- *  - they arithmetically renumber anchors after their own edits instead of
- *    copying them from the latest tool output;
- *  - they leak reasoning prose into heredoc bodies, producing shell/python
- *    syntax errors.
- *
- * This prompt is the per-request countermeasure, pinned ahead of the host
- * system prompt on openai-completions, openai-responses, and cursor RPC paths.
+ * Format the model-visible policy rejection with a stable marker and the tool
+ * vocabulary the model actually receives on this provider surface.
  */
-export declare function isComposerHarnessModel(modelId: string): boolean;
+export declare function formatComposerBashPolicyError(surface?: ComposerBashPolicyToolSurface): string;
+/**
+ * Matches both the structured current error and the original prefix so a
+ * resumed session can recover after an upgrade without string-version skew.
+ */
+export declare function isComposerBashPolicyBlockedError(text: string): boolean;
+/**
+ * Matches only errors emitted directly by the current policy implementation.
+ * Live recovery must use this strict form so failed shell output that merely
+ * quotes a policy error cannot masquerade as the policy gate itself.
+ */
+export declare function isCurrentComposerBashPolicyBlockedError(text: string): boolean;
+/** One bounded, tool-enabled retry instruction for generic Composer agent loops. */
+export declare const COMPOSER_BASH_POLICY_RECOVERY_PROMPT: string;
+/** One bounded, tool-enabled retry instruction for Cursor's native remote tool surface. */
+export declare const CURSOR_COMPOSER_BASH_POLICY_RECOVERY_PROMPT: string;
 export declare const COMPOSER_EDIT_DISCIPLINE_PROMPT = "File-editing discipline for this Composer harness (this OVERRIDES contrary habits from your training):\n\n- Discover file names ONLY with the find tool; search file contents ONLY with the search tool; read file bodies or line ranges ONLY with the read tool. NEVER inspect repository files through shell commands (ls, find, fd, cat, sed, awk, grep, rg, head, tail, less, more) or scripts \u2014 that output carries no hashline anchors and bypasses the agent's safety limits.\n- Modify files ONLY with the edit/write tools. NEVER mutate files through shell redirection, tee, sed -i, perl -pi, inline python/node/bun scripts, or other out-of-band writes \u2014 those writes invalidate every known anchor and break edit recovery.\n- A line anchor (e.g. \"42sr\") is a line number plus a 2-char content hash. You CANNOT compute the hash yourself: copy anchors verbatim from the MOST RECENT read/search/edit output of that exact file. NEVER guess, renumber, or arithmetically shift an anchor.\n- After ANY edit to a file (including your own), anchors you saw earlier are stale. Re-read the edited region, or copy the fresh anchors printed in the edit result, before issuing the next edit.\n- If an edit is rejected with \"anchors do not match\", the rejection message prints the current lines WITH fresh anchors. Retry using exactly those printed anchors.\n- Tool-call arguments must be the exact JSON/schema object requested by the tool. Do not include Markdown, commentary, analysis text, or invented fields inside tool arguments.\n- Use bash only for terminal operations such as tests, builds, package scripts, and git commands. A shell command string must contain only the command itself; NEVER interleave reasoning or commentary into command strings or heredocs.";
+/**
+ * Cursor executes a different native tool vocabulary from the generic agent
+ * loop. Keep this prompt separate so Composer is never told to call `edit`,
+ * `find`, or `search` when those names are unavailable remotely.
+ */
+export declare const CURSOR_COMPOSER_EDIT_DISCIPLINE_PROMPT: string;

package/dist/types/providers/openai-opencodex-responses.d.ts

@@ -0,0 +1,10 @@
+import type { Model } from "../types";
+export declare const OPENCODEX_DEFAULT_PORT = 10100;
+export declare const OPENCODEX_PROBE_TIMEOUT_MS = 750;
+export declare const OPENCODEX_MODEL_CACHE_TTL_MS: number;
+export interface OpenCodexEndpoint {
+    baseUrl: string;
+}
+export declare function resolveOpenCodexEndpoint(signal?: AbortSignal): Promise<OpenCodexEndpoint | undefined>;
+export declare function fetchOpenCodexModels(): Promise<readonly Model<"openai-responses">[] | null>;
+export declare function checkOpenCodexStatus(onProgress?: (message: string) => void): Promise<void>;

package/dist/types/providers/openai-responses-shared.d.ts

@@ -96,6 +96,7 @@ export declare function populateResponsesUsageFromResponse(output: AssistantMess
     total_tokens?: number | null;
     input_tokens_details?: {
         cached_tokens?: number | null;
+        cache_write_tokens?: number | null;
     } | null;
     output_tokens_details?: {
         reasoning_tokens?: number | null;

package/dist/types/providers/register-builtins.d.ts

@@ -20,8 +20,8 @@ export declare function setBedrockProviderModule(module: BedrockProviderModule):
 /**
  * Resolves the first-event timeout fallback for the outer lazy-stream watchdog.
  * A configured wrapper-specific fallback (from `LazyStreamLimits`) always wins;
- * otherwise providers known to have slow first events get a five-minute floor
- * matching their inner provider-level override. Returns `undefined` for
+ * otherwise providers known to have slow first events use the same centralized
+ * fallback as their inner provider-level watchdog. Returns `undefined` for
  * providers that should use the shared default.
  */
 export declare function resolveLazyStreamFirstEventFallbackMs(provider: string, configuredFallbackMs?: number): number | undefined;

package/dist/types/types.d.ts

@@ -51,7 +51,7 @@ export interface ThinkingConfig {
     /** Provider-specific transport used to encode the selected effort. */
     mode: ThinkingControlMode;
 }
-export type KnownProvider = "alibaba-token-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "opengateway" | "bizrouter" | "mara" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio";
+export type KnownProvider = "alibaba-token-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "opencodex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "opengateway" | "bizrouter" | "mara" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio";
 export type Provider = KnownProvider | string;
 import type { Effort } from "./model-thinking";
 /** Token budgets for each thinking level (token-based providers only) */
@@ -827,6 +827,17 @@ export interface ModelRequestTransform {
     /** Extra request body fields merged after provider defaults; protected core request keys are ignored. */
     extraBody?: Record<string, unknown>;
 }
+export interface ModelCost {
+    input: number;
+    output: number;
+    cacheRead: number;
+    cacheWrite: number;
+}
+export interface LongContextPricing {
+    /** Input-token count above which the long-context rates apply to the full request. */
+    threshold: number;
+    cost: ModelCost;
+}
 export interface Model<TApi extends Api = any> {
     id: string;
     name: string;
@@ -843,12 +854,9 @@ export interface Model<TApi extends Api = any> {
      * provider/id heuristics.
      */
     output?: ("text" | "image")[];
-    cost: {
-        input: number;
-        output: number;
-        cacheRead: number;
-        cacheWrite: number;
-    };
+    cost: ModelCost;
+    /** Optional long-context rates selected from the request's total input-token count. */
+    longContextPricing?: LongContextPricing;
     /** Premium Copilot requests charged per user-initiated request (defaults to 1). */
     premiumMultiplier?: number;
     contextWindow: number;

package/dist/types/utils/fallback-transport.d.ts

@@ -1,7 +1,23 @@
 export type FallbackTriggerClass = "rate_limit" | "quota" | "auth" | "server" | "unknown" | "other";
+/**
+ * Refinement of an `auth` trigger.
+ *
+ * The transport deliberately collapses HTTP 401 and 403 into a single `auth`
+ * class, but the two demand opposite handling: a credential problem may be
+ * recoverable by trying a different stored credential, whereas a plain
+ * `forbidden` is an authorization or configuration defect that rotation would
+ * only hide — it would cycle and block every otherwise-healthy credential.
+ *
+ * This is a refinement rather than a new {@link FallbackTriggerClass} member so
+ * every existing `trigger.class === "auth"` consumer keeps compiling and keeps
+ * its current behavior until it explicitly opts into the distinction.
+ */
+export type AuthDisposition = "credential" | "forbidden";
 export interface FallbackTrigger {
     class: FallbackTriggerClass;
     retryAfterMs?: number;
+    /** Present only when `class === "auth"`. */
+    authDisposition?: AuthDisposition;
 }
 /** Stable code for streams that time out before producing semantic progress. */
 export declare const STREAM_FIRST_EVENT_TIMEOUT_PROVIDER_CODE = "stream_first_event_timeout";
@@ -66,3 +82,10 @@ export declare function transportFailureFacts(error: unknown, capturedResponse?:
 }): TransportFailureFacts | undefined;
 /** Classifies only typed upstream transport facts without consuming response bodies. */
 export declare function classifyFallbackTrigger(errorOrFacts: TransportFailureFacts | FallbackTriggerInput | unknown): FallbackTrigger;
+/**
+ * True when a failure is an `auth` failure that must NOT rotate credentials.
+ *
+ * Callers that mutate credential state on auth failures should consult this
+ * first so a plain `forbidden` cannot block otherwise-healthy credentials.
+ */
+export declare function isForbiddenAuthFailure(errorOrFacts: TransportFailureFacts | FallbackTriggerInput | unknown): boolean;

package/dist/types/utils/oauth/anthropic.d.ts

@@ -3,9 +3,28 @@
  */
 import { OAuthCallbackFlow } from "./callback-server";
 import type { OAuthController, OAuthCredentials } from "./types";
+/**
+ * Redirect target for the paste-a-code login. Anthropic renders the
+ * authorization code on this page instead of redirecting into this machine, so
+ * a gjc running over SSH, in a container, or on a headless box can be paired
+ * from a browser that has no route back to `localhost:54545`.
+ *
+ * Deliberately a hard-coded constant rather than an env/config override: this
+ * is where the authorization code is delivered, so making it injectable would
+ * turn any writable environment into an auth-code exfiltration channel.
+ */
+export declare const ANTHROPIC_MANUAL_REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
+export interface AnthropicOAuthFlowOptions {
+    /**
+     * Pair by pasting the code Anthropic displays instead of waiting on a local
+     * `localhost:54545` callback. Use when the browser completing the login has
+     * no network route back to the machine running gjc.
+     */
+    manualCode?: boolean;
+}
 export declare class AnthropicOAuthFlow extends OAuthCallbackFlow {
     #private;
-    constructor(ctrl: OAuthController);
+    constructor(ctrl: OAuthController, options?: AnthropicOAuthFlowOptions);
     generateAuthUrl(state: string, redirectUri: string): Promise<{
         url: string;
         instructions?: string;
@@ -15,7 +34,7 @@ export declare class AnthropicOAuthFlow extends OAuthCallbackFlow {
 /**
  * Login with Anthropic OAuth
  */
-export declare function loginAnthropic(ctrl: OAuthController): Promise<OAuthCredentials>;
+export declare function loginAnthropic(ctrl: OAuthController, options?: AnthropicOAuthFlowOptions): Promise<OAuthCredentials>;
 /**
  * Refresh Anthropic OAuth token
  */

package/dist/types/utils/oauth/callback-server.d.ts

@@ -11,6 +11,13 @@ export interface OAuthCallbackFlowOptions {
     callbackBindHostname?: string;
     /** Exact redirect URI advertised to the provider; disables port fallback. */
     redirectUri?: string;
+    /**
+     * Do not bind a local listener at all. The provider redirects somewhere this
+     * process cannot observe (a hosted "copy this code" page, a custom protocol),
+     * so the code arrives by paste instead. Requires both `redirectUri` and an
+     * `onManualCodeInput` handler on the controller.
+     */
+    skipCallbackServer?: boolean;
 }
 /**
  * Abstract base class for OAuth flows with local callback servers.

package/dist/types/utils/oauth/types.d.ts

@@ -7,7 +7,7 @@ export type OAuthCredentials = {
     email?: string;
     accountId?: string;
 };
-export type OAuthProvider = "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "zai";
+export type OAuthProvider = "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "opencodex" | "zai";
 export type OAuthProviderId = OAuthProvider | (string & {});
 export type OAuthPrompt = {
     message: string;
@@ -23,6 +23,17 @@ export interface OAuthProviderInfo {
     name: string;
     available: boolean;
 }
+/** Per-login switches that change how the authorization code is delivered. */
+export interface OAuthLoginOptions {
+    /**
+     * Pair by pasting the authorization code the provider displays instead of
+     * waiting on a local loopback callback. Set when the browser completing the
+     * login has no network route back to the machine running gjc (SSH, remote
+     * container, headless host). Providers without a paste-a-code redirect
+     * ignore it.
+     */
+    manualCode?: boolean;
+}
 export interface OAuthController {
     onAuth?(info: OAuthAuthInfo): void;
     onProgress?(message: string): void;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.12.7",
+	"version": "0.12.10",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,7 +40,7 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/utils": "0.12.7",
+		"@gajae-code/utils": "0.12.10",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-gateway/server.ts

@@ -279,6 +279,12 @@ async function markManagedGatewayCredentialFailure(
 ): Promise<void> {
 	const trigger = classifyFallbackTrigger(error);
 	try {
+		if (trigger.class === "auth" && trigger.authDisposition === "forbidden") {
+			// A plain `forbidden` is an authorization or configuration defect.
+			// Blocking the credential here would hide it and would cycle through
+			// every otherwise-healthy row in a multi-credential pool.
+			return;
+		}
 		if (trigger.class === "auth") {
 			await storage.invalidateCredentialMatching(model.provider, apiKey, signal);
 		} else if (trigger.class === "quota" || trigger.class === "rate_limit") {