@gajae-code/ai 0.14.2 → 0.15.0

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [0.15.0] - 2026-08-22
+- A failed dynamic-model refresh no longer blanks a legacy cache row in an unbound provider context. `resolveProviderModels` only reused the last-known rows when the latest cache row was provenance-bound to the current discovery context, so a provider that supplies no `cacheDynamicModelProvenance` (e.g. the Codex family) lost every cached model on a refresh failure AND had its row overwritten with an empty snapshot — the stale-while-error fallback the surrounding code documents never applied to it. Legacy rows now serve through a failed refresh whenever the request context is unbound; bound contexts still fail closed on foreign rows.
+- Added OpenRouter as an API-key login provider in `/login` (`openrouter`). Pasting an `sk-or-v1-...` key validates against `https://openrouter.ai/api/v1` (`openrouter/auto` chat completion probe) and stores a reusable `OPENROUTER_API_KEY` credential, closing the gap where OpenRouter had catalog/env support but no interactive login entry point.
+- Fixed `/logout` (and `gjc accounts logout`) silently ignoring stored API-key credentials. Removal-target enumeration and hard removal were both scoped to `credential_type = 'oauth'` rows, so API-key logins (OpenCode Go/Zen, Cursor, Venice, DeepSeek, …) could never be removed and the flow answered `API-key credentials are not managed here`. Removal targets now include every stored row, `removeAuthCredentialsHard` accepts non-OAuth rows, and the interactive/CLI logout removes stored credentials of either kind.
+- The auth-broker presentation sidecar default is now derived when a `RemoteAuthCredentialStore` is constructed instead of once at module import (#4786). The trusted config root has been call-time state since #4761/#4772, so the import-time constant kept pointing at the home in effect when the module first loaded; a process whose home was established or changed after load read and wrote one logical profile through two different roots — the same split that made user-scope skills and MCP disappear, one layer out, with credential-coherence impact since `<configRoot>/.env` is one of the files `$credentialEnv` treats as trusted. Explicit `presentationPath` options are unchanged, and the E2E `testauth.db` helper derives its path at use time for the same reason.
+- OpenAI Responses-family providers (`openai-responses`, `azure-openai-responses`, `openai-codex-responses`) now batch consecutive tool results so every `function_call_output`/`custom_tool_call_output` of one assistant tool-call turn stays contiguous before a single collected image user message, instead of emitting a standalone image user message after each individual output (#4807). The interleaved form made an OpenAI Responses→Anthropic Messages proxy (e.g. `cliproxyapi`) see a `tool_use` without its `tool_result` in the immediately following user message, and every replay of the poisoned tail failed with a deterministic HTTP 400. Call-id pairing, result arrival order (including reverse order), custom-tool outputs, text-only runs, and single-result shapes are unchanged; non-vision models still degrade to the image placeholder. Each result's image group inside the collected message is labeled with its `call_id` so parallel results keep image-to-call attribution.
+- OpenAI-family idle watchdog floors now key on the Grok model as well as the provider: Grok model ids served through any OpenAI-compatible host (openrouter `x-ai/grok-*`, kilo, litellm, zenmux, venice …) get the same 300-second idle window as native xAI and Grok Build, so a long Grok reasoning gap no longer surfaces as `OpenAI completions stream stalled while waiting for the next event` under the 120-second shared default (#4797). Env overrides still win; non-Grok models are unchanged.
+- Codex stale-continuation recovery now also recognizes prose anchor references — `Previous response with id 'resp_1' not found.`, `The previous response 'resp_1' has expired.`, `Unknown previous response 'resp_1'.` — when the specific stale code is masked to `invalid_request_error` by codex-lb (the same masking already handled for `codex_previous_response_stale`) or omitted entirely (#4802). The #4752 matcher required the compact `previous_response_id` field token, so these shapes reached users as fatal `invalid_request_error` events. Prose matching is tempered against sub-field tokens (tool/function/custom-tool call, call/message/item id, output item): a fault naming something INSIDE the previous response (`Unknown item in previous response.`) is a deterministic history fault and stays fatal, since replaying full context re-sends the same offending item. Retry semantics are unchanged and remain one-shot with full context, gated on the failed request actually having carried an anchor.
+- GLM ZCode OAuth now refreshes its authenticated `/v1/models` catalog automatically, so newly available GLM models are selectable without waiting for the bundled catalog to catch up. Discovery preserves bundled model metadata, sanitizes and bounds every remote display name, rejects catalog entries whose model IDs cannot be handled safely (control-bearing, blank, or overlong IDs are dropped, never renamed — model-selector identity is rendered verbatim), uses the same trusted `ZCODE_PLAN_ANTHROPIC_BASE_URL` decision as model requests, and refreshes legacy static-only cache rows once when live discovery becomes available.
+- Codex stale-continuation recovery now classifies anchor rejections by provider message as well as by error code, so a provider event shaped `{"type":"error","error":{"type":"invalid_request_error","code":"invalid_request_error","message":"Invalid `previous_response_id`."}}` clears `previous_response_id` and the websocket append state and retries exactly once with full conversation context instead of terminating the active session (#4752). Previously only the `previous_response_not_found` and `codex_previous_response_stale` codes (#731) were recognized, and this shape reached users as a fatal `Codex error event: Invalid \`previous_response_id\`. (code=invalid_request_error)`. Three properties bound the new retry: `invalid_request_error` stays in the non-retryable code set so a generic invalid-request failure that does not implicate the anchor remains fatal; classification reads a new `CodexProviderStreamError.providerMessage` (the raw provider text) rather than the display message, because the display message appends `(code=…)` metadata that would otherwise supply a stale qualifier the provider never sent; and the matcher requires the canonical `previous_response_id` field token, so deterministic history faults such as `Previous response's tool call ID is malformed.` stay fatal instead of replaying full context. Recovery additionally requires that the failed request actually carried an anchor (`sentPreviousResponseId`, tracked from the dispatched websocket request), so a rejection naming the field on an anchor-free request — `Invalid request: previous_response_id is required` on a first turn or after an append reset — stays fatal instead of clearing valid session metadata and resending an identical non-retryable body. Recovery is one-shot per turn (`previousResponseRecoveryAttempted`) — once the anchor is cleared the replay carries no anchor, so a repeated rejection surfaces rather than consuming the five-attempt provider retry budget on full-context replays.
+- Anthropic streaming now distinguishes a tool call that merely passed through an incomplete JSON fragment from one orphaned by a duplicate content-block index. Membership in the truncation set alone is not evidence that a terminal `tool_use` call is incomplete, so normally completed calls remain executable while genuine orphaned calls stay blocked.
+- OpenAI-family streams now give xAI Grok and the Grok Build (`grok-cli-responses`) wrapper the same 300-second default idle window as Anthropic, so long Grok reasoning gaps no longer surface as `OpenAI responses stream stalled while waiting for the next event` under the 120-second OpenAI default. Env overrides still win. The observed stall was `grok-build/grok-4.6` on `openai-responses`; keying only `xai` would have left that path on 120s because `streamGrokCli` keeps `model.provider === "grok-build"`.
+- `getCachedUsageReport` now surfaces provider-level cached usage reports for stored API-key credentials, not only OAuth rows. `checkCredentials` fetches and caches usage for API-key providers (for example `zai`, whose login flow stores an API key by design), but the display lookup rejected every non-OAuth row, so `/usage` and account listings could never show usage data that had been successfully fetched and cached. The lookup builds the same cache identity `checkCredentials` writes, and the returned observation stays redacted — credential bytes never appear in the cached report.
+- Anthropic clients now set an SDK request `timeout` derived from the first-event window (`resolveAnthropicSdkRequestTimeoutMs`; 300s by default for Anthropic, floored at the env/default first-event window, disabled by an explicit `streamFirstEventTimeoutMs: 0`). The Anthropic first-event watchdog deliberately arms only after response headers arrive, so a connection that silently died before headers — the exact failure mode of recent Anthropic stream instability right after a completed tool call — was previously bounded only by the SDK's 10-minute default per attempt multiplied by its internal retry budget, observable as an endless "Working…" spinner for up to an hour with no error, no retry indicator, and no automatic recovery. This mirrors the existing `resolveOpenAISdkRequestTimeoutMs` stalled-before-headers bound on the OpenAI family.
+- Anthropic `input_json_delta` and Codex `function_call`/`custom_tool_call` argument increments now fail the turn closed for every non-string value instead of continuing with missing, default, or silently altered tool arguments. Primitive thinking/text/signature anomalies still degrade to an empty string, and each stream emits at most one payload-free diagnostic per increment type naming only the envelope (`deltaType`/`eventType` and `receivedType`).
+- Anthropic-compatible and Codex stream handlers now coerce non-string prose, thinking, and signature increments to an empty string before emitting `*_delta` events, so a Z.AI or Codex thinking delta that arrives as `undefined` or a numeric token count cannot produce a non-string `delta` that managed snapshot staging rejects as `event.delta`. Executable tool-argument fragments remain fail-closed for every non-string shape. Anthropic `signature_delta` likewise appends only string signatures, so a numeric or missing signature cannot pollute `thinkingSignature` as `"1"` / `"[object Object]"`.
+- Added the `ask-round-zero-metadata-requires-full-topology-fields` raw-argument rejection code so the ask tool's Round-0 deep-interview validator can name the omitted topology fields and their correction; previously the incomplete-object failure surfaced only as generic zod issues with a full payload echo (#4649).
+- oMLX OpenAI-compatible completions now send `chat_template_kwargs.reasoning_effort` with `enable_thinking` when `thinkingFormat` is `qwen-chat-template`. Discovered oMLX models are treated as reasoning models with `low`/`medium`/`high` effort so local Qwen presets can differentiate roles without swapping weights.
+- Fixed a resume-breaking HTTP 400 on `google-gemini-cli`/`google-antigravity` replay: assistant thinking blocks whose `thinkingSignature` is missing, empty (persistence clears oversized signatures to `""`), or invalid no longer emit an unsigned `{"thought": true}` part. Cloud Code Assist maps such parts to Anthropic `thinking` blocks and rejects the whole request with `messages.N.content.0.thinking.signature: Field required`, permanently bricking resumed sessions (#4630). Unsigned thinking now degrades to plain text — the same treatment cross-model reasoning already gets — while validly signed thinking still replays natively as a thought part with its `thoughtSignature`.
+- `validateApiKeyAgainstModelsEndpoint` no longer accepts an API key on HTTP status alone. A 200 whose body is not JSON or carries no recognizable model list (OpenAI-compatible `data` array, gateway `models` array, or a bare array) now fails closed with an actionable error — previously a captive portal or broken gateway answering 200 with an HTML page silently validated and stored the key. Affects every provider using `kind: "models-endpoint"` (Synthetic, DeepSeek, DeepInfra, Fireworks, BizRouter, NanoGPT, OpenGateway, ZenMux, Fugu). Upstream bodies echoed into validation errors are now bounded to 200 characters on both validators.
+- `ToolCall.escapedNonAsciiArguments` doc updated: the agent loop resamples unconditionally then rejects terminally, with a single bounded after-budget exception for tools that enumerated display fields (`displaySafeEscapedArgFields`) whose non-ASCII content is benign typographic punctuation. The scanner itself is unchanged and still flags every non-ASCII escape (#4627).
+- The auth-gateway `/v1/chat/completions` request schema now accepts explicit `null` for unset optional fields and for message `content`. Clients that serialize an omitted option as `null` (Aside, LangChain, LiteLLM, Vercel AI SDK style serializers) — a shape api.openai.com accepts — were rejected with a zod `invalid_union` 400 before a single token streamed, surfacing in client UIs as a generic connection failure. `null` is now collapsed to `undefined` at the schema boundary (and to `""` for required `system`/`developer`/`user` content), so every downstream consumer keeps the existing `T | undefined` shape.
+
 ## [0.14.2] - 2026-08-20
 
 ### Fixed
@@ -15,6 +38,9 @@
 - Fixed a resume-breaking HTTP 400 on `google-gemini-cli`/`google-antigravity` replay: assistant thinking blocks whose `thinkingSignature` is missing, empty (persistence clears oversized signatures to `""`), or invalid no longer emit an unsigned `{"thought": true}` part. Cloud Code Assist maps such parts to Anthropic `thinking` blocks and rejects the whole request with `messages.N.content.0.thinking.signature: Field required`, permanently bricking resumed sessions (#4630). Unsigned thinking now degrades to plain text — the same treatment cross-model reasoning already gets — while validly signed thinking still replays natively as a thought part with its `thoughtSignature`.
 - `validateApiKeyAgainstModelsEndpoint` no longer accepts an API key on HTTP status alone. A 200 whose body is not JSON or carries no recognizable model list (OpenAI-compatible `data` array, gateway `models` array, or a bare array) now fails closed with an actionable error — previously a captive portal or broken gateway answering 200 with an HTML page silently validated and stored the key. Affects every provider using `kind: "models-endpoint"` (Synthetic, DeepSeek, DeepInfra, Fireworks, BizRouter, NanoGPT, OpenGateway, ZenMux, Fugu). Upstream bodies echoed into validation errors are now bounded to 200 characters on both validators.
 
+- OpenAI Codex requests now sanitize OS-derived `User-Agent` components, preventing non-ASCII Android kernel release names from being rejected as invalid HTTP headers.
+- Kimi OAuth requests now sanitize OS-derived `X-Msh-Device-Name`/`X-Msh-Device-Model`/`X-Msh-Os-Version` header values, preventing non-ASCII hostnames and kernel release names (e.g. Android `Minimal™` builds) from being rejected as invalid HTTP headers. `getKimiCommonHeaders` now memoizes a pure `buildKimiCommonHeaders()` builder.
+
 ## [0.14.0] - 2026-08-17
 - Cursor native tool calls (shell/read/write/… oneof variants) now convert their protobuf payloads into plain JSON-safe data before attaching them as toolCall `arguments`: `$typeName` markers are stripped, safe-range bigints become numbers (decimal strings beyond `Number.MAX_SAFE_INTEGER`), byte arrays become base64 strings, and cycles/functions collapse to null. Raw protobuf-es payloads carry `bigint` fields (`fileSize`, `durationMs`, `fileOutputThresholdBytes`, …) that defeat `JSON.stringify`, which broke managed snapshot staging, JSONL transcript persistence, and provider replay — the issue #4578 local-snapshot producer defect class fixed at its producer boundary.
 - Generic OpenAI-compatible `/v1/models` discovery now reads served context-window and output-limit metadata instead of defaulting every dynamically listed model to the unknown-window sentinel. `max_model_len` (vLLM/SGLang/oMLX), `context_length`, `context_window`, `max_context_length` (LM Studio), and `max_position_embeddings` populate `contextWindow` in that precedence order, while `max_tokens`/`max_output_tokens` populate `maxTokens`; total-window fields never leak into the output-token ceiling. Malformed values (non-finite, zero, negative, non-numeric) are rejected per-field with fallback to the next candidate, so a `1e400`-style catalog entry can no longer poison compaction thresholds or compact-input budgets.

package/dist/types/auth-storage.d.ts

@@ -584,9 +584,9 @@ export declare class AuthStorage {
     resolveOAuthPinTarget(provider: string, selector: AuthCredentialSelector): OAuthPinTarget;
     /** Return all local inventory rows, including soft-disabled metadata, without payloads. */
     listCredentialInventory(provider?: string): CredentialInventoryRecord[];
-    /** Return local OAuth hard-removal action targets, including disabled rows. */
+    /** Return local credential hard-removal action targets, including disabled rows. */
     listCredentialRemovalTargets(provider?: string): CredentialRemovalTarget[];
-    /** Remove selected local OAuth rows atomically; conflict leaves all rows intact. */
+    /** Remove selected local credential rows atomically; conflict leaves all rows intact. */
     removeAuthCredentialsHard(provider: string, targets: readonly CredentialRemovalTarget[]): AuthCredentialHardRemovalResult;
     /**
      * Remove a runtime credential selector.

package/dist/types/model-cache.d.ts

@@ -19,4 +19,6 @@ interface CacheEntry<TApi extends Api = Api> {
 export declare function closeModelCache(dbPath?: string): boolean;
 export declare function readModelCache<TApi extends Api>(providerId: string, ttlMs: number, now: () => number, dbPath?: string): CacheEntry<TApi> | null;
 export declare function writeModelCache<TApi extends Api>(providerId: string, updatedAt: number, models: Model<TApi>[], authoritative: boolean, staticFingerprint: string, dbPath?: string, dynamicModelIds?: readonly string[], dynamicModelProvenance?: string): void;
+export declare function insertModelCacheIfAbsent<TApi extends Api>(providerId: string, updatedAt: number, models: Model<TApi>[], authoritative: boolean, staticFingerprint: string, dbPath?: string, dynamicModelIds?: readonly string[], dynamicModelProvenance?: string): boolean;
+export declare function updateModelCacheIfUnchanged<TApi extends Api>(providerId: string, expectedUpdatedAt: number, expectedDynamicModelIds: readonly string[] | undefined, expectedDynamicModelProvenance: string | undefined, expectedModels: readonly Model<TApi>[], updatedAt: number, models: Model<TApi>[], authoritative: boolean, staticFingerprint: string, dbPath?: string, dynamicModelIds?: readonly string[], dynamicModelProvenance?: string): boolean;
 export {};

package/dist/types/provider-models/special.d.ts

@@ -16,8 +16,10 @@ export interface ZaiModelManagerConfig {
 }
 export declare function zaiModelManagerOptions(_config?: ZaiModelManagerConfig): ModelManagerOptions<"anthropic-messages">;
 export interface GlmZcodeModelManagerConfig {
+    apiKey?: string;
+    baseUrl?: string;
 }
-export declare function glmZcodeModelManagerOptions(_config?: GlmZcodeModelManagerConfig): ModelManagerOptions<"anthropic-messages">;
+export declare function glmZcodeModelManagerOptions(config?: GlmZcodeModelManagerConfig): ModelManagerOptions<"anthropic-messages">;
 export interface JetBrainsJunieModelManagerConfig {
 }
 export declare function jetbrainsJunieModelManagerOptions(_config?: JetBrainsJunieModelManagerConfig): ModelManagerOptions<"anthropic-messages">;

package/dist/types/providers/anthropic.d.ts

@@ -217,6 +217,7 @@ export type AnthropicClientOptionsResult = {
     fetch?: AnthropicSdkClientOptions["fetch"];
     fetchOptions?: AnthropicSdkClientOptions["fetchOptions"];
 };
+export declare function resolveGlmZcodeAnthropicBaseUrl(): string;
 export declare function isProviderRetryableError(error: unknown, provider?: string): boolean;
 export type AnthropicUsageLike = {
     cache_creation?: {

package/dist/types/providers/cursor/exec-modern.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Proto builders for the modern Cursor CLI exec frames (`ExecServerMessage`
+ * 27-31, 36-38, 40-55).
+ *
+ * Split out of `cursor.ts` because these are pure `create(...)` shapes with no
+ * transport, stream, or block-state coupling: the dispatcher decides *which*
+ * answer a frame gets, this module knows *what* that answer looks like on the
+ * wire. Every builder returns a result whose oneof case is set — an
+ * `ExecClientMessage` carrying a result with an unset oneof is a fake success
+ * the server reads as "the tool ran and produced nothing".
+ */
+import type { ToolResultMessage } from "../../types";
+import { type ExecuteHookRequest, type ExecuteHookResult, type McpStateExecResult, type McpToolDefinition, type PiBashExecResult, type PiEditExecResult, type PiFindExecResult, type PiGrepExecResult, type PiLsExecResult, type PiReadExecResult, type PiTruncation, type PiWriteExecResult } from "./gen/agent_pb";
+/**
+ * The pure arg translation lives in `../cursor-pi-args` so the legacy pi shim
+ * can share it without pulling this module's protobuf graph into the bundled
+ * virtual registry. Re-exported here because this is where the frame builders
+ * and their translation are consumed together.
+ */
+export { omitUndefinedArgs, piEscapeRegexLiteral, piGrepSkip, piJoinPath, piLimit, piLsPath, piReadDisplayPath, piReadPath, piReadPathHasRange, piTimeout, } from "../cursor-pi-args";
+/** Flatten a tool result's content into the single `output` string the Pi frames carry. */
+export declare function piOutputText(toolResult: ToolResultMessage): string;
+/**
+ * Translate a local tool's truncation summary into `PiTruncation`.
+ *
+ * Two shapes reach here. `read`/`grep` set `details.truncation`
+ * (`TruncationResult`), which carries an explicit `truncated` boolean. `bash`
+ * sets `details.meta.truncation` (`TruncationMeta`), which has **no** such
+ * flag — its presence *is* the signal, and requiring the boolean silently
+ * dropped every Bash truncation, handing Cursor clipped output with no notice
+ * that it was clipped.
+ *
+ * Returns `undefined` when nothing was truncated: the field is `optional` on
+ * every Pi success message, and emitting a zeroed `PiTruncation` would tell the
+ * server the output was trimmed to nothing.
+ */
+export declare function piTruncation(toolResult: ToolResultMessage): PiTruncation | undefined;
+export declare function buildPiReadResult(toolResult: ToolResultMessage): PiReadExecResult;
+export declare function buildPiReadError(error: string): PiReadExecResult;
+export declare function buildPiBashResult(toolResult: ToolResultMessage): PiBashExecResult;
+export declare function buildPiBashError(error: string): PiBashExecResult;
+/**
+ * `PiEditExecSuccess` requires `diff` and `patch` alongside `output`. The local
+ * `edit` tool reports them under `details`; when it does not, the strings stay
+ * empty rather than being faked from the output text.
+ */
+export declare function buildPiEditResult(toolResult: ToolResultMessage): PiEditExecResult;
+export declare function buildPiEditError(error: string): PiEditExecResult;
+/**
+ * A refusal is not an execution failure: `PiEditExecResult` models them as
+ * separate variants, and answering a denied call with `error` reads as "the
+ * edit ran and broke", which invites a retry of an operation that was never
+ * permitted.
+ */
+export declare function buildPiEditRejected(reason: string): PiEditExecResult;
+export declare function buildPiWriteResult(toolResult: ToolResultMessage): PiWriteExecResult;
+export declare function buildPiWriteError(error: string): PiWriteExecResult;
+/** Same variant split as {@link buildPiEditRejected}. */
+export declare function buildPiWriteRejected(reason: string): PiWriteExecResult;
+export declare function buildPiGrepResult(toolResult: ToolResultMessage): PiGrepExecResult;
+export declare function buildPiGrepError(error: string): PiGrepExecResult;
+export declare function buildPiFindResult(toolResult: ToolResultMessage): PiFindExecResult;
+export declare function buildPiFindError(error: string): PiFindExecResult;
+export declare function buildPiLsResult(toolResult: ToolResultMessage): PiLsExecResult;
+export declare function buildPiLsError(error: string): PiLsExecResult;
+/**
+ * Answer `mcpStateExecArgs` (frame 36) from the catalog already advertised in
+ * `RequestContext.tools`.
+ *
+ * This client hosts no MCP servers of its own: every forwarded tool is a local
+ * pi-agent tool published under a synthetic `providerIdentifier`. Regrouping
+ * the same list keeps the server's view of "which servers exist and what do
+ * they expose" consistent with what it was told at context time, instead of
+ * claiming zero servers while tool calls for them keep arriving.
+ *
+ * `serverIdentifiers` filters the answer when the server asks about specific
+ * servers. `kickOnly` is a restart request — there is nothing to restart, so it
+ * is answered with the same state rather than an error.
+ */
+export declare function buildMcpStateResult(tools: McpToolDefinition[], serverIdentifiers: readonly string[]): McpStateExecResult;
+/**
+ * Build the neutral response for a hook query: the matching response case with
+ * every field unset.
+ *
+ * This client runs no Cursor hooks, and every field of every response variant
+ * is `optional` — so an empty response of the right case means "no hook had
+ * anything to say", which is exactly true. It is NOT the unset-oneof fake
+ * success: the case itself is set, only the payload is empty.
+ *
+ * `ExecuteHookRequest` and `ExecuteHookResponse` are parallel oneofs whose case
+ * names line up, but the two unions are unrelated to the compiler: a `switch`
+ * is what makes each pairing individually type-checked, and it forces a
+ * deliberate branch when a future regen adds a request case.
+ *
+ * Returns `null` for a request case this build does not model, which the
+ * dispatcher answers with `ExecClientThrow` rather than guessing a case.
+ */
+export declare function buildNeutralHookResult(request: ExecuteHookRequest | undefined): ExecuteHookResult | null;