@gajae-code/ai 0.13.1 → 0.13.3

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## [Unreleased]
 
+## [0.13.3] - 2026-08-15
+
+### Added
+
+- Added first-class direct xAI `grok-4.6` catalog support over the existing xAI OAuth/subscription transport. Grok 4.5 exposes `low` through `high` reasoning effort and Grok 4.6 exposes `low` through `xhigh`.
+- Added a native TypeScript Kiro (Amazon Q Developer / CodeWhisperer) provider: AWS SSO OIDC device-code login, bearer-token transport to the CodeWhisperer streaming endpoint over `application/vnd.amazon.eventstream`, and a `kiro` model-manager descriptor for Claude 3.7 Sonnet (#4304).
+- Added the authoritative OpenRouter `meta/muse-spark-1.2` catalog fallback with a 1,048,576-token context window and `minimal` through `xhigh` reasoning effort, so stale or credential-limited catalog generation still closes the Muse Spark preset alias deterministically.
+
+### Fixed
+- Validate Synthetic API key via models endpoint, not retired Kimi probe (#4385).
+- Tool-call arguments that spell printable non-ASCII text as `\uXXXX` escapes are now flagged on the raw wire (`escapedNonAsciiArguments`) by the Anthropic, OpenAI Responses, and OpenAI Completions streams — after JSON decode the defect is unobservable, and a mistyped hex nibble silently becomes a different character (#4515).
+
+## [0.13.2] - 2026-08-13
+
+### Fixed
+
+- `clear_thinking`-emptied Anthropic thinking blocks now drop stale signatures before replay, preventing the next request from failing with `Invalid signature in thinking block` after a provider-side reasoning clear (#4247, reported by @probepark).
+
 ## [0.13.1] - 2026-08-11
 
 ### Fixed

package/dist/types/provider-models/special.d.ts

@@ -21,3 +21,6 @@ export declare function glmZcodeModelManagerOptions(_config?: GlmZcodeModelManag
 export interface JetBrainsJunieModelManagerConfig {
 }
 export declare function jetbrainsJunieModelManagerOptions(_config?: JetBrainsJunieModelManagerConfig): ModelManagerOptions<"anthropic-messages">;
+export interface KiroModelManagerConfig {
+}
+export declare function kiroModelManagerOptions(_config?: KiroModelManagerConfig): ModelManagerOptions<"kiro-codewhisperer-stream">;

package/dist/types/providers/kiro-codewhisperer.d.ts

@@ -0,0 +1,8 @@
+import type { StreamFunction, StreamOptions } from "../types";
+export interface KiroCodeWhispererOptions extends StreamOptions {
+    /** AWS region for the CodeWhisperer streaming endpoint. */
+    region?: string;
+    /** Profile ARN for enterprise IAM Identity Center accounts. */
+    profileArn?: string;
+}
+export declare const streamKiroCodeWhisperer: StreamFunction<"kiro-codewhisperer-stream">;

package/dist/types/providers/mock.d.ts

@@ -62,6 +62,8 @@ export type MockContent = string | {
     arguments: Record<string, unknown> | string;
     /** Simulate a provider-flagged truncated call (cut off mid-arguments). */
     incompleteArguments?: boolean;
+    /** Simulate a provider-flagged `\uXXXX`-escaped-arguments call. */
+    escapedNonAsciiArguments?: boolean;
 };
 /** One scripted response. */
 export interface MockResponse {

package/dist/types/providers/register-builtins.d.ts

@@ -55,4 +55,5 @@ export declare const streamOpenAIResponses: (model: Model<"openai-responses">, c
 export declare const streamCursor: (model: Model<"cursor-agent">, context: Context, options: OptionsForApi<"cursor-agent">) => EventStreamImpl;
 export declare const streamOllama: (model: Model<"ollama-chat">, context: Context, options: OptionsForApi<"ollama-chat">) => EventStreamImpl;
 export declare const streamBedrock: (model: Model<"bedrock-converse-stream">, context: Context, options: OptionsForApi<"bedrock-converse-stream">) => EventStreamImpl;
+export declare const streamKiroCodeWhisperer: (model: Model<"kiro-codewhisperer-stream">, context: Context, options: OptionsForApi<"kiro-codewhisperer-stream">) => EventStreamImpl;
 export {};

package/dist/types/types.d.ts

@@ -7,6 +7,7 @@ import type { DeleteArgs, DeleteResult, DiagnosticsArgs, DiagnosticsResult, Grep
 import type { GoogleOptions } from "./providers/google";
 import type { GoogleGeminiCliOptions } from "./providers/google-gemini-cli";
 import type { GoogleVertexOptions } from "./providers/google-vertex";
+import type { KiroCodeWhispererOptions } from "./providers/kiro-codewhisperer";
 import type { OllamaChatOptions } from "./providers/ollama";
 import type { OpenAICodexResponsesOptions } from "./providers/openai-codex-responses";
 import type { OpenAICompletionsOptions } from "./providers/openai-completions";
@@ -14,7 +15,7 @@ import type { OpenAIResponsesOptions } from "./providers/openai-responses";
 import type { AssistantMessageEventStream } from "./utils/event-stream";
 import type { FallbackAttemptToken, TransportFailureFacts } from "./utils/fallback-transport";
 export type { AssistantMessageEventStream } from "./utils/event-stream";
-export type KnownApi = "openai-completions" | "openai-responses" | "openai-codex-responses" | "azure-openai-responses" | "anthropic-messages" | "bedrock-converse-stream" | "google-generative-ai" | "google-gemini-cli" | "google-vertex" | "ollama-chat" | "cursor-agent";
+export type KnownApi = "openai-completions" | "openai-responses" | "openai-codex-responses" | "azure-openai-responses" | "anthropic-messages" | "bedrock-converse-stream" | "google-generative-ai" | "google-gemini-cli" | "google-vertex" | "ollama-chat" | "cursor-agent" | "kiro-codewhisperer-stream";
 export type Api = KnownApi | (string & {});
 export interface ApiOptionsMap {
     "anthropic-messages": AnthropicOptions;
@@ -28,6 +29,7 @@ export interface ApiOptionsMap {
     "google-vertex": GoogleVertexOptions;
     "ollama-chat": OllamaChatOptions;
     "cursor-agent": CursorOptions;
+    "kiro-codewhisperer-stream": KiroCodeWhispererOptions;
 }
 export type OptionsForApi<TApi extends Api> = StreamOptions | (TApi extends keyof ApiOptionsMap ? ApiOptionsMap[TApi] : never);
 /** Canonical thinking transport used by a model. */
@@ -51,7 +53,7 @@ export interface ThinkingConfig {
     /** Provider-specific transport used to encode the selected effort. */
     mode: ThinkingControlMode;
 }
-export declare const KNOWN_PROVIDERS: readonly ["alibaba-token-plan", "amazon-bedrock", "azure-openai", "anthropic", "google", "google-gemini-cli", "google-antigravity", "google-vertex", "openai", "openai-codex", "opencodex", "kimi-code", "minimax-code", "minimax-code-cn", "github-copilot", "fireworks", "firepass", "fugu", "gitlab-duo", "cursor", "jetbrains-junie", "deepseek", "deepinfra", "xai", "groq", "cerebras", "openrouter", "kilo", "vercel-ai-gateway", "zai", "glm-zcode", "mistral", "minimax", "opencode-go", "opencode-zen", "opengateway", "bizrouter", "mara", "synthetic", "cloudflare-ai-gateway", "huggingface", "litellm", "moonshot", "nvidia", "nanogpt", "ollama", "ollama-cloud", "qianfan", "qwen-portal", "together", "venice", "vllm", "xiaomi", "xiaomi-token-plan-sgp", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "zenmux", "lm-studio"];
+export declare const KNOWN_PROVIDERS: readonly ["alibaba-token-plan", "amazon-bedrock", "kiro", "azure-openai", "anthropic", "google", "google-gemini-cli", "google-antigravity", "google-vertex", "openai", "openai-codex", "opencodex", "kimi-code", "minimax-code", "minimax-code-cn", "github-copilot", "fireworks", "firepass", "fugu", "gitlab-duo", "cursor", "jetbrains-junie", "deepseek", "deepinfra", "xai", "groq", "cerebras", "openrouter", "kilo", "vercel-ai-gateway", "zai", "glm-zcode", "mistral", "minimax", "opencode-go", "opencode-zen", "opengateway", "bizrouter", "mara", "synthetic", "cloudflare-ai-gateway", "huggingface", "litellm", "moonshot", "nvidia", "nanogpt", "ollama", "ollama-cloud", "qianfan", "qwen-portal", "together", "venice", "vllm", "xiaomi", "xiaomi-token-plan-sgp", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "zenmux", "lm-studio"];
 export type KnownProvider = (typeof KNOWN_PROVIDERS)[number];
 export declare function isKnownProvider(provider: string): provider is KnownProvider;
 export type Provider = KnownProvider | string;
@@ -381,6 +383,16 @@ export interface ToolCall {
      * rejects the call with a retryable error instead.
      */
     incompleteArguments?: boolean;
+    /**
+     * Set when the provider saw the argument JSON spell a printable non-ASCII
+     * character as a `\uXXXX` escape instead of literal UTF-8. Hand-written hex
+     * is where models mistype digits, and a mistyped nibble decodes to a
+     * different but equally valid character, so the decoded arguments cannot be
+     * verified or repaired after parsing. The agent loop treats such a turn as a
+     * sampling accident: managed runs discard and re-request it, and execution
+     * rejects the call rather than running on silently corrupted text.
+     */
+    escapedNonAsciiArguments?: boolean;
 }
 export interface Usage {
     /** Non-cached input tokens (matches the bucket the provider bills as new input). */

package/dist/types/utils/json-parse.d.ts

@@ -1,4 +1,23 @@
 export declare function repairJson(json: string): string;
+/**
+ * First unnecessary `\uXXXX` escape in a JSON document, or `undefined` when the
+ * document contains none.
+ *
+ * "Unnecessary" means the escape encodes a character JSON can carry literally:
+ * any non-ASCII printable character. Control characters (< U+0020) MUST be
+ * escaped, and an unpaired surrogate CANNOT be written literally, so neither
+ * counts. A `\\uXXXX` sequence is a literal backslash followed by `u` — the
+ * intended source syntax when the model is writing code or a nested JSON
+ * document — and is skipped, which is why this scans the raw text with the same
+ * string/escape state machine as {@link repairJson} instead of using a regex.
+ *
+ * Models that spell non-ASCII text as hand-written hex instead of literal UTF-8
+ * mistype the digits, and every mistyped nibble silently decodes to a different
+ * but perfectly valid character (`\uc7a5` vs `\uc7a4`). The resulting arguments
+ * parse cleanly and cannot be repaired after the fact, so the escape itself is
+ * the only observable evidence that the payload is untrustworthy.
+ */
+export declare function findUnnecessaryUnicodeEscape(json: string): string | undefined;
 export declare function parseJsonWithRepair<T>(json: string): T;
 /**
  * Attempts to parse potentially incomplete JSON during streaming.

package/dist/types/utils/oauth/kiro.d.ts

@@ -0,0 +1,71 @@
+import type { OAuthCredentials } from "./types";
+interface StartDeviceAuthorizationResponse {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete?: string;
+    interval: number;
+    expiresIn: number;
+}
+interface CreateTokenSuccess {
+    accessToken: string;
+    tokenType: string;
+    expiresIn: number;
+    refreshToken?: string;
+}
+interface ClientRegistration {
+    clientId: string;
+    clientSecret: string;
+    expiresAt: number;
+}
+/**
+ * Register a public SSO OIDC client. Registration responses include an expiry
+ * timestamp (`clientSecretExpiresAt`); we cache until then to avoid re-registering
+ * on every login attempt.
+ *
+ * The SSO OIDC `RegisterClient` endpoint is public (no authentication required).
+ */
+export declare function registerClient(region: string, startUrl: string, signal?: AbortSignal): Promise<ClientRegistration>;
+/** Drop cached client registration — used by tests. */
+export declare function clearClientRegistrationCache(): void;
+/**
+ * Start device authorization. The SSO OIDC `StartDeviceAuthorization` endpoint
+ * is public (requires registered clientId/clientSecret, not SigV4).
+ */
+export declare function startDeviceAuthorization(region: string, startUrl: string, registration: ClientRegistration, signal?: AbortSignal): Promise<StartDeviceAuthorizationResponse>;
+/**
+ * Poll `CreateToken` until the user completes authorization or the device code
+ * expires. Handles `authorization_pending` (continue polling) and `slow_down`
+ * (increase interval) per the published SSO OIDC model.
+ */
+export declare function pollForToken(region: string, registration: ClientRegistration, deviceCode: string, intervalSeconds: number, expiresInSeconds: number, signal?: AbortSignal): Promise<CreateTokenSuccess>;
+/**
+ * Refresh an expired access token using the stored refresh token via
+ * `CreateToken` with `grantType: "refresh_token"`.
+ *
+ * Rotation is published behavior: the response includes a new `refreshToken`.
+ * If the server does not return a new one, the old refresh token is retained.
+ */
+export declare function refreshKiroToken(credentials: OAuthCredentials): Promise<OAuthCredentials>;
+export interface KiroLoginOptions {
+    onAuth: (url: string, instructions?: string) => void;
+    onPrompt: (prompt: {
+        message: string;
+        placeholder?: string;
+        allowEmpty?: boolean;
+    }) => Promise<string>;
+    onProgress?: (message: string) => void;
+    signal?: AbortSignal;
+    /** Override for tests. */
+    fetchImpl?: typeof globalThis.fetch;
+}
+export declare function loginKiro(options: KiroLoginOptions): Promise<OAuthCredentials>;
+/**
+ * Attempt to import a cached SSO access token from `~/.aws/sso/cache/`.
+ * Returns the token if a valid (non-expired) one exists, otherwise undefined.
+ *
+ * This reuses the documented AWS CLI SSO cache location, not any third-party
+ * credential store.
+ */
+export declare function importSsoCacheToken(): OAuthCredentials | undefined;
+export {};

package/dist/types/utils/oauth/types.d.ts

@@ -7,7 +7,7 @@ export type OAuthCredentials = {
     email?: string;
     accountId?: string;
 };
-export type OAuthProvider = "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "opencodex" | "zai";
+export type OAuthProvider = "kiro" | "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "opencodex" | "zai";
 export type OAuthProviderId = OAuthProvider | (string & {});
 export type OAuthPrompt = {
     message: string;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.13.1",
+	"version": "0.13.3",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,7 +40,7 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/utils": "0.13.1",
+		"@gajae-code/utils": "0.13.3",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/model-thinking.ts

@@ -58,6 +58,8 @@ const GPT_5_6_PLUS_EFFORTS: readonly Effort[] = [Effort.Low, Effort.Medium, Effo
 const GPT_5_5_DEFAULT_EFFORT = Effort.XHigh;
 const KIMI_K3_EFFORTS: readonly Effort[] = [Effort.Low, Effort.High, Effort.Max];
 const DEEPSEEK_V4_FLASH_0731_EFFORTS: readonly Effort[] = [Effort.Low, Effort.High, Effort.Max];
+const GROK_4_5_EFFORTS: readonly Effort[] = [Effort.Low, Effort.Medium, Effort.High];
+const GROK_4_6_EFFORTS: readonly Effort[] = [Effort.Low, Effort.Medium, Effort.High, Effort.XHigh];
 
 const GPT_5_1_CODEX_MINI_EFFORTS: readonly Effort[] = [Effort.Medium, Effort.High];
 const CLOUDFLARE_AI_GATEWAY_BASE_URL = "https://gateway.ai.cloudflare.com/v1/<account>/<gateway>/anthropic";
@@ -206,10 +208,16 @@ export function refreshModelThinking<TApi extends Api>(model: ApiModel<TApi>): A
 export function applyGeneratedModelPolicies(models: ApiModel<Api>[]): void {
 	for (let index = 0; index < models.length; index++) {
 		const source = models[index]!;
+		if (source.provider === "xai" && (source.id === "grok-4.5" || source.id === "grok-4.6")) {
+			source.reasoning = true;
+		}
 		if (source.provider === "alibaba-token-plan" && source.id === "deepseek-v4-flash-0731") {
 			source.reasoning = true;
 			source.name = "DeepSeek V4 Flash 0731";
 		}
+		if (source.id.split("/").at(-1)?.toLowerCase() === "muse-spark-1.2") {
+			source.reasoning = true;
+		}
 		const model = refreshModelThinking(source);
 		applyGeneratedModelPolicy(model);
 		models[index] = model;
@@ -471,6 +479,9 @@ function applyGeneratedModelPolicy(model: ApiModel<Api>): void {
 			requiresReasoningContentForToolCalls: true,
 		};
 	}
+	if (model.provider === "xai" && (model.id === "grok-4.5" || model.id === "grok-4.6")) {
+		model.maxTokens = Math.min(model.maxTokens, 64_000);
+	}
 	// MiniMax-M3's official Token Plan routes expose a 1M context window.
 	// Scope the correction to the four first-class regional MiniMax routes
 	// (canonical id plus the Anthropic Token Plan `[1m]` id); unrelated
@@ -664,6 +675,12 @@ function expandEffortRange(thinking: ThinkingConfig): readonly Effort[] {
 }
 
 function inferSupportedEfforts<TApi extends Api>(parsedModel: ParsedModel, model: ApiModel<TApi>): readonly Effort[] {
+	if (model.provider === "xai" && model.id === "grok-4.5") {
+		return GROK_4_5_EFFORTS;
+	}
+	if (model.provider === "xai" && model.id === "grok-4.6") {
+		return GROK_4_6_EFFORTS;
+	}
 	if (model.provider === "kimi-code" && model.id === "k3") {
 		return KIMI_K3_EFFORTS;
 	}
@@ -730,6 +747,13 @@ function inferAnthropicSupportedEfforts<TApi extends Api>(
 }
 
 function inferFallbackEfforts<TApi extends Api>(model: ApiModel<TApi>): readonly Effort[] {
+	// Meta documents Muse Spark 1.2 as accepting the full minimal..xhigh
+	// reasoning range. Keep that capability provider-independent so runtime
+	// model discovery/merge cannot downgrade the bundled OpenRouter entry to
+	// the generic openai-completions ceiling of `high`.
+	if (model.id.split("/").at(-1)?.toLowerCase() === "muse-spark-1.2") {
+		return DEFAULT_REASONING_EFFORTS_WITH_XHIGH;
+	}
 	if (model.api === "anthropic-messages") {
 		return DEFAULT_REASONING_EFFORTS_WITH_XHIGH;
 	}