@gajae-code/ai 0.15.2 → 0.15.3

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [0.15.3] - 2026-08-27
+
+### Fixed
+
+- Valid JSON `\uXXXX` tool arguments now execute as their canonical decoded strings instead of entering the escaped-non-ASCII resample loop. Provider adapters retain guard metadata only for malformed JSON, duplicate/deep evidence, and unpaired UTF-16 surrogates, so those cases remain fail-closed while standard escaped Hangul, emoji surrogate pairs, and printable ASCII no longer consume retries or terminate managed runs.
+- Explicit positive `maxTokens` values declared for custom `models.yml` models
+  and model overrides now reach the provider request across the shared stream
+  mapping (`max_tokens`, `max_completion_tokens`, and `max_output_tokens`).
+  Built-in and discovered metadata retain the conservative 32,000-token default,
+  while positive per-request overrides keep precedence; `compat.extraBody` is
+  not required to alter the wire budget.
+- `/login vllm` no longer stores the `vllm-local` no-auth sentinel as a persisted API key. `AuthStorage.getApiKey()` resolves stored `api_key` credentials before environment variables, so a stored sentinel from an empty login could outrank a real `VLLM_API_KEY` env var and reach normal inference. `/login vllm` now requires a real API key (empty input throws `vLLM API key is required; local no-auth servers are discovered automatically`); local no-auth servers remain discovered automatically via the descriptor's `allowUnauthenticated` flag and need no login.
+- `classifyContextOverflow` no longer misclassifies Anthropic context overflow as a terminal request error. Anthropic reports overflow inside a generic `invalid_request_error` envelope (`{"type":"invalid_request_error","message":"prompt is too long: 1158066 tokens > 1000000 maximum"}`), and that envelope type was listed as an authoritative non-overflow code, so it vetoed classification before the `prompt is too long` match could run. Overflow was then treated as a terminal 4xx and auto-compaction never ran. The envelope is now separated from cause-naming codes (auth, quota, rate limit), which keep full veto authority. To preserve the existing hostile-prose defense, only Anthropic's self-verifying measured form (`<used> tokens > <limit> maximum`, where the reported usage actually exceeds the reported maximum) can override the envelope; loose prose such as `too many tokens` still cannot flip a typed transport classification.
+- The OpenAI↔Anthropic compatibility shim (Kimi Code, Synthetic) no longer drops the model's `thinking` metadata when routing an OpenAI-compatible model through the Anthropic Messages API. The shim rebuilt the Anthropic model descriptor field-by-field and omitted `thinking`, so a reasoning-capable model such as `kimi-code/k3` failed every effort-qualified request with `Model kimi-code/k3 is missing thinking metadata` (`getSupportedEfforts` throws when a reasoning model lacks thinking metadata). The descriptor now copies `model.thinking` through, restoring effort validation and the effort→`budget_tokens` mapping for the Anthropic-format route.
+
 ## [0.15.2] - 2026-08-25
 
 ### Changed
@@ -17,7 +32,9 @@
 
 ### Fixed
 
+- Exact ID-selected stored literal API keys can now authorize existing model-cache provenance without resolving or exposing secret bytes; command-backed rows, stored environment references, OAuth, runtime overrides, and config overrides remain ineligible, while an explicitly selected stored row keeps precedence over provider environment fallback.
 - Tool-call parsing now preserves bounded, payload-free raw `\uXXXX` position/scalar evidence across provider adapters. Printable ASCII escapes are included because a one-nibble mutation can move an intended non-ASCII scalar into ASCII before decoded-value validation. Process-keyed scalar/path tags, raw and decoded offsets, value ordinals, duplicate-key/depth rejection, total-position accounting, and a process-local integrity tag make partial, altered, malformed, or overflowed evidence explicitly fail-closed without retaining recoverable argument characters or field names (#4927).
+- Hid the non-callable `google-antigravity/gemini-3.7-flash-{low,medium,high}` selectors from bundled, dynamic, and cached catalogs after live Cloud Code Assist calls returned HTTP 404; `google-antigravity/gemini-3.7-flash-tiered` remains available and callable.
 - Ollama Cloud discovery now keeps curated output limits authoritative and gives unknown models a bounded 32,000-token fallback capped by their discovered context window. This replaces the truncation-prone 8,192 fallback without treating the server context length as a verified 131,072-token output capability or sending unbounded `num_predict` requests. Hosted cold starts and long prefills also receive a 300-second first-event window while explicit timeout overrides keep precedence (#4921).
 - Direct model selections now retry zero-token empty OpenAI-compatible responses.
 - OpenAI-compatible chat streams now replay an exact `finish_reason: "network_error"` only when no text, reasoning, refusal, or tool-call delta has been exposed. Retries honor `streamMaxRetries`, exponential backoff, caller cancellation, and managed-fallback ownership; failed-attempt usage, cost, response IDs, and partial chunks are discarded while terminal error wording remains compatible (#4918).

package/README.md

@@ -1074,7 +1074,7 @@ The quickest way to authenticate:
 ```bash
 bunx @gajae-code/ai login              # interactive provider selection
 bunx @gajae-code/ai login anthropic    # login to specific provider
-bunx @gajae-code/ai login vllm         # store vLLM API key (or placeholder for local no-auth)
+bunx @gajae-code/ai login vllm         # store vLLM API key (local no-auth servers are discovered automatically)
 bunx @gajae-code/ai login xai          # sign in with xAI/Grok OAuth
 bunx @gajae-code/ai list               # list available providers
 ```

package/dist/types/auth-storage.d.ts

@@ -580,6 +580,8 @@ export declare class AuthStorage {
     hasSessionCredentialAuto(provider: string, scopeId?: string): boolean;
     /** Resolve the effective selector precedence for a provider/scope. */
     resolveEffectiveCredentialSelector(provider: string, scopeId?: string, explicitSelector?: AuthCredentialSelector): AuthCredentialSelector | undefined;
+    /** @internal Return cache provenance for an exact stored literal API-key row without resolving its value. */
+    getStoredLiteralApiKeyEvidenceGeneration(provider: string, selector: AuthCredentialSelector): string | undefined;
     /** Validate and canonicalize an OAuth-only selector for account pinning. */
     resolveOAuthPinTarget(provider: string, selector: AuthCredentialSelector): OAuthPinTarget;
     /** Return all local inventory rows, including soft-disabled metadata, without payloads. */

package/dist/types/model-retirements.d.ts

@@ -1,4 +1,4 @@
-export declare const RETIRED_MODEL_KEYS: readonly ["google-antigravity/gemini-3.1-pro-high"];
+export declare const RETIRED_MODEL_KEYS: readonly ["google-antigravity/gemini-3.1-pro-high", "google-antigravity/gemini-3.7-flash-high", "google-antigravity/gemini-3.7-flash-low", "google-antigravity/gemini-3.7-flash-medium"];
 export declare function isRetiredModelKey(provider: string, modelId: string): boolean;
 export declare function isRetiredModel(model: {
     provider: string;

package/dist/types/stream.d.ts

@@ -41,3 +41,4 @@ export declare function completeSimple<TApi extends Api>(model: Model<TApi>, con
 export declare const OUTPUT_FALLBACK_BUFFER = 4000;
 export declare const ANTHROPIC_THINKING: Record<Effort, number>;
 export declare function mapAnthropicToolChoice(choice?: ToolChoice): AnthropicOptions["toolChoice"];
+export declare function resolveDefaultRequestMaxTokens<TApi extends Api>(model: Model<TApi>, requested?: number): number;

package/dist/types/types.d.ts

@@ -405,11 +405,12 @@ export interface ToolCall {
      * Such a payload parses cleanly but
      * is unverifiable: one mistyped hex digit decodes to a different, equally
      * valid character, so the text can be silently wrong with no in-band evidence.
-     * The agent loop resamples the turn unconditionally a bounded number of
-     * times and then rejects the call instead of executing it. The single
-     * bounded after-budget exception is a tool that enumerated its display
-     * fields (`displaySafeEscapedArgFields`) whose non-ASCII content is benign
-     * typographic punctuation — rendered question text, never executable
+     * The agent loop resamples the turn a bounded number of times and then
+     * rejects the call instead of executing it. The single bounded exception
+     * is a tool that enumerated its display-only fields
+     * (`displaySafeEscapedArgFields`): when every escaped scalar corroborates
+     * a decoded non-ASCII character inside those fields, the call executes
+     * with a warning instead — rendered question text, never executable
      * content, ids, or durable metadata.
      * Escapes that are required (control characters) or unavoidable (lone
      * surrogates) never set this.
@@ -972,6 +973,8 @@ export interface ModelRequestTransform {
     /** Extra request body fields merged after provider defaults; protected core request keys are ignored. */
     extraBody?: Record<string, unknown>;
 }
+/** Provenance used when resolving a model's default request output budget. */
+export type ModelMaxTokensSource = "configured" | "discovered";
 export interface ModelCost {
     input: number;
     output: number;
@@ -1006,6 +1009,8 @@ export interface Model<TApi extends Api = any> {
     premiumMultiplier?: number;
     contextWindow: number;
     maxTokens: number;
+    /** Explicit models.yml/model-override authority; absent keeps the safe transport default. */
+    maxTokensSource?: ModelMaxTokensSource;
     headers?: Record<string, string>;
     /**
      * Streaming transport override. When `"pi-native"`, `streamSimple` routes

package/dist/types/utils/json-parse.d.ts

@@ -64,7 +64,15 @@ export declare function findUnnecessaryUnicodeEscape(json: string): string | und
  * intentionally omitted to preserve `questions.question`-style field matching.
  */
 export declare function collectUnicodeEscapeEvidence(json: string): UnicodeEscapeEvidence | undefined;
-/** Attach bounded raw evidence while preserving the existing call-level guard flag. */
+/**
+ * Return evidence only when decoded tool arguments are unsafe to execute.
+ *
+ * Valid JSON escapes and literal UTF-8 have the same canonical decoded value.
+ * Malformed JSON, duplicate/deep evidence, and unpaired UTF-16 surrogates keep
+ * the existing fail-closed path.
+ */
+export declare function collectUnsafeUnicodeEscapeEvidence(json: string): UnicodeEscapeEvidence | undefined;
+/** Attach unsafe raw evidence while preserving the existing call-level guard flag. */
 export declare function captureUnicodeEscapeEvidence(target: UnicodeEscapeEvidenceTarget, json: string): boolean;
 /** Attach evidence as transient, non-enumerable metadata excluded from serialization. */
 export declare function attachUnicodeEscapeEvidence(target: UnicodeEscapeEvidenceTarget, evidence: UnicodeEscapeEvidence): void;

package/dist/types/utils/oauth/vllm.d.ts

@@ -10,7 +10,7 @@ import type { OAuthController } from "./types";
 /**
  * Login to vLLM.
  *
- * Opens vLLM OpenAI-compatible auth docs, prompts for an optional token,
- * and returns a stored key value.
+ * Opens vLLM OpenAI-compatible auth docs, prompts for a bearer token,
+ * and returns a stored key value. Local no-auth servers need no login.
  */
 export declare function loginVllm(options: OAuthController): Promise<string>;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.15.2",
+	"version": "0.15.3",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,8 +40,8 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/natives": "0.15.2",
-		"@gajae-code/utils": "0.15.2",
+		"@gajae-code/natives": "0.15.3",
+		"@gajae-code/utils": "0.15.3",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-storage.ts

@@ -1359,6 +1359,24 @@ export class AuthStorage {
 	getProviderEvidenceGeneration(provider: string, resolvedApiKey?: string): string {
 		const storageProvider = resolveOAuthStorageProvider(provider);
 		const evidenceApiKey = resolvedApiKey;
+		const storedLiteral =
+			evidenceApiKey === undefined ||
+			this.#runtimeOverrides.has(storageProvider) ||
+			this.#configOverrides.has(storageProvider)
+				? undefined
+				: this.#getCredentialsForProvider(storageProvider).find(
+						(credential): credential is Extract<AuthCredential, { type: "api_key" }> =>
+							credential.type === "api_key" &&
+							credential.key === evidenceApiKey &&
+							!credential.key.startsWith("!") &&
+							process.env[credential.key] === undefined,
+					);
+		if (storedLiteral) {
+			return crypto
+				.createHash("sha256")
+				.update(`stored-literal\u0000${storageProvider}\u0000${storedLiteral.key}`)
+				.digest("hex");
+		}
 		let selectedCredential: ({ index: number } & StoredCredential) | undefined;
 		try {
 			selectedCredential = this.#resolveSelectedStoredCredential(provider, undefined, undefined);
@@ -1588,6 +1606,18 @@ export class AuthStorage {
 		);
 	}
 
+	/** @internal Return cache provenance for an exact stored literal API-key row without resolving its value. */
+	getStoredLiteralApiKeyEvidenceGeneration(provider: string, selector: AuthCredentialSelector): string | undefined {
+		if (selector.kind !== "id") return undefined;
+		const storageProvider = resolveOAuthStorageProvider(provider);
+		if (this.#runtimeOverrides.has(storageProvider) || this.#configOverrides.has(storageProvider)) return undefined;
+		const selected = this.#findCredentialBySelector(storageProvider, selector);
+		if (selected?.credential.type !== "api_key") return undefined;
+		const key = selected.credential.key;
+		if (!key || key.startsWith("!") || process.env[key] !== undefined) return undefined;
+		return this.getProviderEvidenceGeneration(storageProvider, key);
+	}
+
 	/** Validate and canonicalize an OAuth-only selector for account pinning. */
 	resolveOAuthPinTarget(provider: string, selector: AuthCredentialSelector): OAuthPinTarget {
 		const storageProvider = resolveOAuthStorageProvider(provider);

package/src/model-retirements.d.ts

@@ -1,4 +1,4 @@
-export declare const RETIRED_MODEL_KEYS: readonly ["google-antigravity/gemini-3.1-pro-high"];
+export declare const RETIRED_MODEL_KEYS: readonly ["google-antigravity/gemini-3.1-pro-high", "google-antigravity/gemini-3.7-flash-high", "google-antigravity/gemini-3.7-flash-low", "google-antigravity/gemini-3.7-flash-medium"];
 export declare function isRetiredModelKey(provider: string, modelId: string): boolean;
 export declare function isRetiredModel(model: {
     provider: string;

package/src/model-retirements.ts

@@ -1,6 +1,12 @@
-// Retired from advertised catalogs because Cloud Code Assist rejects live calls
-// with HTTP 400. The callable high-thinking path is gemini-3.1-pro-low:high.
-export const RETIRED_MODEL_KEYS = ["google-antigravity/gemini-3.1-pro-high"] as const;
+// Retired from advertised catalogs because Cloud Code Assist rejects live calls.
+// Keep the callable alternatives visible: gemini-3.1-pro-low:high and
+// gemini-3.7-flash-tiered.
+export const RETIRED_MODEL_KEYS = [
+	"google-antigravity/gemini-3.1-pro-high",
+	"google-antigravity/gemini-3.7-flash-high",
+	"google-antigravity/gemini-3.7-flash-low",
+	"google-antigravity/gemini-3.7-flash-medium",
+] as const;
 
 const RETIRED_MODEL_KEY_SET = new Set<string>(RETIRED_MODEL_KEYS);
 

package/src/models.json

@@ -15785,31 +15785,6 @@
 				"maxLevel": "high"
 			}
 		},
-		"gemini-3.7-flash-high": {
-			"id": "gemini-3.7-flash-high",
-			"name": "Gemini 3.7 Flash (High) (Antigravity)",
-			"api": "google-gemini-cli",
-			"provider": "google-antigravity",
-			"baseUrl": "https://daily-cloudcode-pa.sandbox.googleapis.com",
-			"reasoning": true,
-			"input": [
-				"text",
-				"image"
-			],
-			"cost": {
-				"input": 0,
-				"output": 0,
-				"cacheRead": 0,
-				"cacheWrite": 0
-			},
-			"contextWindow": 1048576,
-			"maxTokens": 65536,
-			"thinking": {
-				"mode": "google-level",
-				"minLevel": "low",
-				"maxLevel": "high"
-			}
-		},
 		"gemini-3.6-flash-low": {
 			"id": "gemini-3.6-flash-low",
 			"name": "Gemini 3.6 Flash (Low) (Antigravity)",
@@ -15835,31 +15810,6 @@
 				"maxLevel": "high"
 			}
 		},
-		"gemini-3.7-flash-low": {
-			"id": "gemini-3.7-flash-low",
-			"name": "Gemini 3.7 Flash (Low) (Antigravity)",
-			"api": "google-gemini-cli",
-			"provider": "google-antigravity",
-			"baseUrl": "https://daily-cloudcode-pa.sandbox.googleapis.com",
-			"reasoning": true,
-			"input": [
-				"text",
-				"image"
-			],
-			"cost": {
-				"input": 0,
-				"output": 0,
-				"cacheRead": 0,
-				"cacheWrite": 0
-			},
-			"contextWindow": 1048576,
-			"maxTokens": 65536,
-			"thinking": {
-				"mode": "google-level",
-				"minLevel": "low",
-				"maxLevel": "high"
-			}
-		},
 		"gemini-3.6-flash-medium": {
 			"id": "gemini-3.6-flash-medium",
 			"name": "Gemini 3.6 Flash (Medium) (Antigravity)",
@@ -15885,31 +15835,6 @@
 				"maxLevel": "high"
 			}
 		},
-		"gemini-3.7-flash-medium": {
-			"id": "gemini-3.7-flash-medium",
-			"name": "Gemini 3.7 Flash (Medium) (Antigravity)",
-			"api": "google-gemini-cli",
-			"provider": "google-antigravity",
-			"baseUrl": "https://daily-cloudcode-pa.sandbox.googleapis.com",
-			"reasoning": true,
-			"input": [
-				"text",
-				"image"
-			],
-			"cost": {
-				"input": 0,
-				"output": 0,
-				"cacheRead": 0,
-				"cacheWrite": 0
-			},
-			"contextWindow": 1048576,
-			"maxTokens": 65536,
-			"thinking": {
-				"mode": "google-level",
-				"minLevel": "low",
-				"maxLevel": "high"
-			}
-		},
 		"gemini-3.6-flash-tiered": {
 			"id": "gemini-3.6-flash-tiered",
 			"name": "gemini-3.6-flash-tiered",
@@ -93690,4 +93615,4 @@
 			}
 		}
 	}
-}
+}

package/src/providers/anthropic.ts

@@ -3320,7 +3320,22 @@ function ensureMaxTokensForThinking(params: MessageCreateParamsStreaming, model:
 	const maxTokens = params.max_tokens ?? 0;
 	const requiredMaxTokens = budgetTokens + OUTPUT_FALLBACK_BUFFER;
 	if (maxTokens < requiredMaxTokens) {
-		params.max_tokens = Math.min(requiredMaxTokens, model.maxTokens);
+		const modelMaxTokens =
+			Number.isSafeInteger(model.maxTokens) && model.maxTokens > 0
+				? model.maxTokens
+				: Math.max(maxTokens, requiredMaxTokens);
+		params.max_tokens = Math.min(requiredMaxTokens, modelMaxTokens);
+	}
+	// Anthropic requires budget_tokens strictly below max_tokens; when the cap
+	// cannot fit the requested budget plus the output buffer, shrink the budget
+	// (or disable thinking) instead of sending an invalid pair.
+	const cappedBudget = params.max_tokens - OUTPUT_FALLBACK_BUFFER;
+	if (cappedBudget < budgetTokens) {
+		if (cappedBudget <= 0) {
+			params.thinking = { type: "disabled" };
+		} else {
+			params.thinking = { type: "enabled", budget_tokens: cappedBudget };
+		}
 	}
 }
 

package/src/providers/openai-anthropic-shim.ts

@@ -64,6 +64,7 @@ export function streamOpenAIAnthropicShim(
 					contextWindow: model.contextWindow,
 					maxTokens: model.maxTokens,
 					reasoning: model.reasoning,
+					thinking: model.thinking,
 					input: model.input,
 					cost: model.cost,
 				};

package/src/providers/openai-completions.ts

@@ -1637,7 +1637,14 @@ function buildParams(
 	}
 
 	if (compat.extraBody) {
-		Object.assign(params, compat.extraBody);
+		// The resolved output limit owns the selected wire field; extraBody is a
+		// free-form compatibility escape hatch and must not add a competing
+		// max-token field or overwrite the resolved budget.
+		const { max_tokens, max_completion_tokens, max_output_tokens, ...restExtra } = compat.extraBody as Record<
+			string,
+			unknown
+		>;
+		Object.assign(params, restExtra);
 	}
 	applyOpenAIRequestTransformBody(params, model.requestTransform);
 	if (!supportsReasoningParams) {

package/src/stream.d.ts

@@ -41,3 +41,4 @@ export declare function completeSimple<TApi extends Api>(model: Model<TApi>, con
 export declare const OUTPUT_FALLBACK_BUFFER = 4000;
 export declare const ANTHROPIC_THINKING: Record<Effort, number>;
 export declare function mapAnthropicToolChoice(choice?: ToolChoice): AnthropicOptions["toolChoice"];
+export declare function resolveDefaultRequestMaxTokens<TApi extends Api>(model: Model<TApi>, requested?: number): number;

package/src/stream.ts

@@ -320,6 +320,14 @@ export function stream<TApi extends Api>(
 	if (options?.fallbackManaged) {
 		options = { ...options, requestMaxRetries: 0, streamMaxRetries: 0 } as OptionsForApi<TApi>;
 	}
+	// Canonical low-level boundary: the request budget must be a positive safe
+	// integer. Provider options arrive here unvalidated (unlike `streamSimple`,
+	// whose resolver already normalizes), so an unsafe value is dropped to
+	// unspecified here once for every dispatch below — integer-only provider
+	// fields can never receive a fractional or MAX_SAFE_INTEGER+1 budget.
+	if (options?.maxTokens !== undefined && !(Number.isSafeInteger(options.maxTokens) && options.maxTokens > 0)) {
+		options = { ...options, maxTokens: undefined } as OptionsForApi<TApi>;
+	}
 	// Check custom API registry first (extension-provided APIs like "vertex-Anthropic model-api")
 	const customApiProvider = getCustomApi(model.api);
 	if (customApiProvider) {
@@ -613,17 +621,18 @@ export function streamSimple<TApi extends Api>(
 	// the gateway bearer instead. Comes BEFORE the custom-API check so
 	// extension-registered APIs can't accidentally override a configured
 	// pi-native transport.
+	const resolvedRequestMaxTokens = resolveDefaultRequestMaxTokens(model, options?.maxTokens);
 	if (model.transport === "pi-native") {
 		return streamFromLazyImport(async () => {
 			const { streamPiNative } = await import("./providers/pi-native-client");
-			return streamPiNative(model, context, options);
+			return streamPiNative(model, context, { ...options, maxTokens: resolvedRequestMaxTokens });
 		}, options?.signal);
 	}
 
 	// Check custom API registry (extension-provided APIs)
 	const customApiProvider = getCustomApi(model.api);
 	if (customApiProvider) {
-		return customApiProvider.streamSimple(model, context, options);
+		return customApiProvider.streamSimple(model, context, { ...options, maxTokens: resolvedRequestMaxTokens });
 	}
 
 	// Vertex AI uses Application Default Credentials, not API keys
@@ -643,6 +652,7 @@ export function streamSimple<TApi extends Api>(
 	const adapterOptions = isProviderSafetyStopModelTrusted(model)
 		? withProviderSafetyStopAdapterInvocation(options ?? {})
 		: options;
+	const resolvedSpecialProviderMaxTokens = resolvedRequestMaxTokens;
 
 	// GitLab Duo - wraps Anthropic/OpenAI behind GitLab AI Gateway direct access tokens
 	if (model.provider === "gitlab-duo") {
@@ -654,6 +664,7 @@ export function streamSimple<TApi extends Api>(
 				copyProviderSafetyStopAdapterInvocation(adapterOptions, {
 					...adapterOptions,
 					apiKey,
+					maxTokens: resolvedSpecialProviderMaxTokens,
 				}),
 			);
 		}, options?.signal);
@@ -670,6 +681,7 @@ export function streamSimple<TApi extends Api>(
 				copyProviderSafetyStopAdapterInvocation(adapterOptions, {
 					...adapterOptions,
 					apiKey,
+					maxTokens: resolvedSpecialProviderMaxTokens,
 					format: options?.kimiApiFormat ?? "anthropic",
 				}),
 			);
@@ -687,6 +699,7 @@ export function streamSimple<TApi extends Api>(
 				copyProviderSafetyStopAdapterInvocation(adapterOptions, {
 					...adapterOptions,
 					apiKey,
+					maxTokens: resolvedSpecialProviderMaxTokens,
 					format: options?.syntheticApiFormat ?? "openai", // Default to OpenAI format
 				}),
 			);
@@ -707,6 +720,7 @@ export async function completeSimple<TApi extends Api>(
 }
 
 const MIN_OUTPUT_TOKENS = 1024;
+const DEFAULT_REQUEST_MAX_TOKENS = 32000;
 export const OUTPUT_FALLBACK_BUFFER = 4000;
 const ANTHROPIC_USE_INTERLEAVED_THINKING = Bun.env.PI_NO_INTERLEAVED_THINKING !== "1";
 
@@ -804,6 +818,16 @@ function resolveOpenAiReasoningEffort<TApi extends Api>(
 
 const castApi = <TApi extends Api>(api: OptionsForApi<TApi>): OptionsForApi<Api> => api as OptionsForApi<Api>;
 
+export function resolveDefaultRequestMaxTokens<TApi extends Api>(model: Model<TApi>, requested?: number): number {
+	if (requested !== undefined && Number.isSafeInteger(requested) && requested > 0) return requested;
+	if (model.maxTokensSource === "configured" && Number.isSafeInteger(model.maxTokens) && model.maxTokens > 0) {
+		return model.maxTokens;
+	}
+	return Number.isSafeInteger(model.maxTokens) && model.maxTokens > 0
+		? Math.min(model.maxTokens, DEFAULT_REQUEST_MAX_TOKENS)
+		: DEFAULT_REQUEST_MAX_TOKENS;
+}
+
 function mapOptionsForApi<TApi extends Api>(
 	model: Model<TApi>,
 	options?: SimpleStreamOptions,
@@ -816,7 +840,7 @@ function mapOptionsForApi<TApi extends Api>(
 		minP: options?.minP,
 		presencePenalty: options?.presencePenalty,
 		repetitionPenalty: options?.repetitionPenalty,
-		maxTokens: options?.maxTokens || Math.min(model.maxTokens, 32000),
+		maxTokens: resolveDefaultRequestMaxTokens(model, options?.maxTokens),
 		signal: options?.signal,
 		apiKey: apiKey || options?.apiKey,
 		fallbackManaged: options?.fallbackManaged,
@@ -888,8 +912,13 @@ function mapOptionsForApi<TApi extends Api>(
 				});
 			}
 
-			// Caller's maxTokens is the desired output; add thinking budget on top, capped at model limit
-			const maxTokens = Math.min((base.maxTokens || 0) + thinkingBudget, model.maxTokens);
+			// Caller's maxTokens is the desired output; add thinking budget on top,
+			// capped at the model limit. `base.maxTokens` is already resolver-sanitized,
+			// so only a finite positive model cap participates (malformed metadata
+			// cannot reintroduce NaN into the wire budget).
+			const modelCap =
+				Number.isSafeInteger(model.maxTokens) && model.maxTokens > 0 ? model.maxTokens : base.maxTokens;
+			const maxTokens = Math.min((base.maxTokens || 0) + thinkingBudget, modelCap);
 
 			// If not enough room for thinking + output, reduce thinking budget
 			if (maxTokens <= thinkingBudget) {
@@ -1048,12 +1077,17 @@ function mapOptionsForApi<TApi extends Api>(
 
 			let thinkingBudget = options.thinkingBudgets?.[effort] ?? GOOGLE_THINKING[effort];
 
-			// Caller's maxTokens is the desired output; add thinking budget on top, capped at model limit
-			const maxTokens = Math.min((base.maxTokens || 0) + thinkingBudget, model.maxTokens);
+			// Caller's maxTokens is the desired output; add thinking budget on top,
+			// capped at the model limit. `base.maxTokens` is already resolver-sanitized,
+			// so only a finite positive model cap participates (malformed metadata
+			// cannot reintroduce NaN into the wire budget).
+			const modelCap =
+				Number.isSafeInteger(model.maxTokens) && model.maxTokens > 0 ? model.maxTokens : base.maxTokens;
+			const maxTokens = Math.min((base.maxTokens || 0) + thinkingBudget, modelCap);
 
 			// If not enough room for thinking + output, reduce thinking budget
 			if (maxTokens <= thinkingBudget) {
-				thinkingBudget = Math.max(0, maxTokens - MIN_OUTPUT_TOKENS) ?? 0;
+				thinkingBudget = Math.max(0, maxTokens - MIN_OUTPUT_TOKENS);
 			}
 
 			// If thinking budget is too low, disable thinking

package/src/types.d.ts

@@ -405,11 +405,12 @@ export interface ToolCall {
      * Such a payload parses cleanly but
      * is unverifiable: one mistyped hex digit decodes to a different, equally
      * valid character, so the text can be silently wrong with no in-band evidence.
-     * The agent loop resamples the turn unconditionally a bounded number of
-     * times and then rejects the call instead of executing it. The single
-     * bounded after-budget exception is a tool that enumerated its display
-     * fields (`displaySafeEscapedArgFields`) whose non-ASCII content is benign
-     * typographic punctuation — rendered question text, never executable
+     * The agent loop resamples the turn a bounded number of times and then
+     * rejects the call instead of executing it. The single bounded exception
+     * is a tool that enumerated its display-only fields
+     * (`displaySafeEscapedArgFields`): when every escaped scalar corroborates
+     * a decoded non-ASCII character inside those fields, the call executes
+     * with a warning instead — rendered question text, never executable
      * content, ids, or durable metadata.
      * Escapes that are required (control characters) or unavoidable (lone
      * surrogates) never set this.
@@ -972,6 +973,8 @@ export interface ModelRequestTransform {
     /** Extra request body fields merged after provider defaults; protected core request keys are ignored. */
     extraBody?: Record<string, unknown>;
 }
+/** Provenance used when resolving a model's default request output budget. */
+export type ModelMaxTokensSource = "configured" | "discovered";
 export interface ModelCost {
     input: number;
     output: number;
@@ -1006,6 +1009,8 @@ export interface Model<TApi extends Api = any> {
     premiumMultiplier?: number;
     contextWindow: number;
     maxTokens: number;
+    /** Explicit models.yml/model-override authority; absent keeps the safe transport default. */
+    maxTokensSource?: ModelMaxTokensSource;
     headers?: Record<string, string>;
     /**
      * Streaming transport override. When `"pi-native"`, `streamSimple` routes

package/src/types.ts

@@ -626,11 +626,12 @@ export interface ToolCall {
 	 * Such a payload parses cleanly but
 	 * is unverifiable: one mistyped hex digit decodes to a different, equally
 	 * valid character, so the text can be silently wrong with no in-band evidence.
-	 * The agent loop resamples the turn unconditionally a bounded number of
-	 * times and then rejects the call instead of executing it. The single
-	 * bounded after-budget exception is a tool that enumerated its display
-	 * fields (`displaySafeEscapedArgFields`) whose non-ASCII content is benign
-	 * typographic punctuation — rendered question text, never executable
+	 * The agent loop resamples the turn a bounded number of times and then
+	 * rejects the call instead of executing it. The single bounded exception
+	 * is a tool that enumerated its display-only fields
+	 * (`displaySafeEscapedArgFields`): when every escaped scalar corroborates
+	 * a decoded non-ASCII character inside those fields, the call executes
+	 * with a warning instead — rendered question text, never executable
 	 * content, ids, or durable metadata.
 	 * Escapes that are required (control characters) or unavoidable (lone
 	 * surrogates) never set this.
@@ -1178,6 +1179,9 @@ export interface ModelRequestTransform {
 	extraBody?: Record<string, unknown>;
 }
 
+/** Provenance used when resolving a model's default request output budget. */
+export type ModelMaxTokensSource = "configured" | "discovered";
+
 export interface ModelCost {
 	input: number; // $/million tokens
 	output: number; // $/million tokens
@@ -1214,6 +1218,8 @@ export interface Model<TApi extends Api = any> {
 	premiumMultiplier?: number;
 	contextWindow: number;
 	maxTokens: number;
+	/** Explicit models.yml/model-override authority; absent keeps the safe transport default. */
+	maxTokensSource?: ModelMaxTokensSource;
 	headers?: Record<string, string>;
 	/**
 	 * Streaming transport override. When `"pi-native"`, `streamSimple` routes

package/src/utils/json-parse.d.ts

@@ -64,7 +64,15 @@ export declare function findUnnecessaryUnicodeEscape(json: string): string | und
  * intentionally omitted to preserve `questions.question`-style field matching.
  */
 export declare function collectUnicodeEscapeEvidence(json: string): UnicodeEscapeEvidence | undefined;
-/** Attach bounded raw evidence while preserving the existing call-level guard flag. */
+/**
+ * Return evidence only when decoded tool arguments are unsafe to execute.
+ *
+ * Valid JSON escapes and literal UTF-8 have the same canonical decoded value.
+ * Malformed JSON, duplicate/deep evidence, and unpaired UTF-16 surrogates keep
+ * the existing fail-closed path.
+ */
+export declare function collectUnsafeUnicodeEscapeEvidence(json: string): UnicodeEscapeEvidence | undefined;
+/** Attach unsafe raw evidence while preserving the existing call-level guard flag. */
 export declare function captureUnicodeEscapeEvidence(target: UnicodeEscapeEvidenceTarget, json: string): boolean;
 /** Attach evidence as transient, non-enumerable metadata excluded from serialization. */
 export declare function attachUnicodeEscapeEvidence(target: UnicodeEscapeEvidenceTarget, evidence: UnicodeEscapeEvidence): void;

package/src/utils/json-parse.ts

@@ -484,9 +484,54 @@ export function collectUnicodeEscapeEvidence(json: string): UnicodeEscapeEvidenc
 	return createUnicodeEscapeEvidence(positions, totalPositions, truncated, false);
 }
 
-/** Attach bounded raw evidence while preserving the existing call-level guard flag. */
+function hasUnpairedUnicodeSurrogate(value: unknown): boolean {
+	const pending: unknown[] = [value];
+	const seen = new WeakSet<object>();
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (typeof current === "string") {
+			if (!current.isWellFormed()) return true;
+			continue;
+		}
+		if (typeof current !== "object" || current === null || seen.has(current)) continue;
+		seen.add(current);
+		if (Array.isArray(current)) {
+			for (const child of current) pending.push(child);
+			continue;
+		}
+		for (const [key, child] of Object.entries(current)) {
+			if (!key.isWellFormed()) return true;
+			pending.push(child);
+		}
+	}
+	return false;
+}
+
+/**
+ * Return evidence only when decoded tool arguments are unsafe to execute.
+ *
+ * Valid JSON escapes and literal UTF-8 have the same canonical decoded value.
+ * Malformed JSON, duplicate/deep evidence, and unpaired UTF-16 surrogates keep
+ * the existing fail-closed path.
+ */
+export function collectUnsafeUnicodeEscapeEvidence(json: string): UnicodeEscapeEvidence | undefined {
+	const hasUnicodeEscape = json.includes("\\u");
+	if (!hasUnicodeEscape && json.isWellFormed()) return undefined;
+	const evidence = hasUnicodeEscape ? collectUnicodeEscapeEvidence(json) : undefined;
+	if (evidence?.malformed) return evidence;
+	try {
+		if (hasUnpairedUnicodeSurrogate(JSON.parse(json))) {
+			return createUnicodeEscapeEvidence([], 0, false, true);
+		}
+	} catch {
+		return createUnicodeEscapeEvidence([], 0, false, true);
+	}
+	return undefined;
+}
+
+/** Attach unsafe raw evidence while preserving the existing call-level guard flag. */
 export function captureUnicodeEscapeEvidence(target: UnicodeEscapeEvidenceTarget, json: string): boolean {
-	const evidence = collectUnicodeEscapeEvidence(json);
+	const evidence = collectUnsafeUnicodeEscapeEvidence(json);
 	if (!evidence) return false;
 	attachUnicodeEscapeEvidence(target, evidence);
 	return true;

package/src/utils/oauth/vllm.ts

@@ -12,12 +12,11 @@ import type { OAuthController, OAuthProvider } from "./types";
 const PROVIDER_ID: OAuthProvider = "vllm";
 const AUTH_URL = "https://docs.vllm.ai/en/latest/serving/openai_compatible_server.html";
 const DEFAULT_LOCAL_BASE_URL = "http://127.0.0.1:8000/v1";
-const DEFAULT_LOCAL_TOKEN = "vllm-local";
 /**
  * Login to vLLM.
  *
- * Opens vLLM OpenAI-compatible auth docs, prompts for an optional token,
- * and returns a stored key value.
+ * Opens vLLM OpenAI-compatible auth docs, prompts for a bearer token,
+ * and returns a stored key value. Local no-auth servers need no login.
  */
 export async function loginVllm(options: OAuthController): Promise<string> {
 	if (!options.onPrompt) {
@@ -25,16 +24,19 @@ export async function loginVllm(options: OAuthController): Promise<string> {
 	}
 	options.onAuth?.({
 		url: AUTH_URL,
-		instructions: `Paste your vLLM API key if your server requires auth. Leave empty for local no-auth mode (default base URL: ${DEFAULT_LOCAL_BASE_URL}).`,
+		instructions: `Paste the API key configured with vLLM's --api-key option. Local no-auth servers at ${DEFAULT_LOCAL_BASE_URL} are discovered automatically and do not need /login.`,
 	});
 	const apiKey = await options.onPrompt({
-		message: "Paste your vLLM API key (optional for local no-auth)",
-		placeholder: DEFAULT_LOCAL_TOKEN,
-		allowEmpty: true,
+		message: "Paste your vLLM API key",
+		placeholder: "vLLM API key",
+		allowEmpty: false,
 	});
 	if (options.signal?.aborted) {
 		throw new Error("Login cancelled");
 	}
 	const trimmed = apiKey.trim();
-	return trimmed || DEFAULT_LOCAL_TOKEN;
+	if (!trimmed) {
+		throw new Error("vLLM API key is required; local no-auth servers are discovered automatically");
+	}
+	return trimmed;
 }

package/src/utils/overflow.ts

@@ -127,8 +127,12 @@ const EMPTY_RESPONSE_USAGE_THRESHOLD = 5;
  * misleading error text.
  */
 const OVERFLOW_PROVIDER_CODES = new Set(["context_length_exceeded", "request_too_large"]);
+/**
+ * Codes that name a specific non-overflow *cause*. These are authoritative and
+ * can never be upgraded by error prose. Generic HTTP envelope types belong in
+ * {@link GENERIC_ENVELOPE_PROVIDER_CODES} instead.
+ */
 const NON_OVERFLOW_PROVIDER_CODES = new Set([
-	"invalid_request_error",
 	"authentication_error",
 	"invalid_api_key",
 	"invalid_token",
@@ -158,6 +162,53 @@ function hasTypedNonOverflowCode(transportFailure: TransportFailureFacts | undef
 	return transportCodes(transportFailure).some(code => NON_OVERFLOW_PROVIDER_CODES.has(code));
 }
 
+/**
+ * Generic envelope codes that name the HTTP error *category*, not its cause.
+ *
+ * Anthropic reports context overflow through this envelope:
+ *
+ *   {"type":"error","error":{"type":"invalid_request_error",
+ *    "message":"prompt is too long: 1158066 tokens > 1000000 maximum"}}
+ *
+ * Treating the envelope as an authoritative non-overflow cause vetoed the
+ * overflow classification, so auto-compaction never ran and the session died on
+ * the very overflow it was supposed to absorb.
+ *
+ * Unlike {@link NON_OVERFLOW_PROVIDER_CODES} (auth, quota, rate limit), this
+ * envelope names no cause, so it must not veto an overflow the provider stated
+ * quantitatively. It still vetoes free-form prose: only the self-verifying
+ * measured form below can override it.
+ */
+const GENERIC_ENVELOPE_PROVIDER_CODES = new Set(["invalid_request_error"]);
+
+/**
+ * Anthropic's measured overflow report: `<used> tokens > <limit> maximum`.
+ *
+ * Deliberately far narrower than {@link OVERFLOW_PATTERNS}. Those patterns
+ * include loose prose (`too many tokens`, `token limit exceeded`) that a tool
+ * result or a model-authored string can trivially contain, so they must never
+ * be able to flip a typed transport classification. This form carries its own
+ * arithmetic proof and is verified below, so injected text cannot satisfy it
+ * without also asserting a real overage.
+ */
+const ANTHROPIC_MEASURED_OVERFLOW_PATTERN = /prompt is too long:\s*(\d+)\s*tokens?\s*>\s*(\d+)\s*maximum/i;
+
+/**
+ * True only for a provider-measured overflow that verifies against itself:
+ * the reported usage must actually exceed the reported maximum.
+ */
+function hasSelfVerifyingOverflowMeasurement(message: AssistantMessage): boolean {
+	if (message.stopReason !== "error") return false;
+	const errorMessage = message.errorMessage;
+	if (!errorMessage) return false;
+	const match = ANTHROPIC_MEASURED_OVERFLOW_PATTERN.exec(errorMessage);
+	if (!match) return false;
+	const used = Number(match[1]);
+	const maximum = Number(match[2]);
+	if (!Number.isFinite(used) || !Number.isFinite(maximum) || maximum <= 0) return false;
+	return used > maximum;
+}
+
 function isTypedNoBodyOverflow(
 	message: AssistantMessage,
 	transportFailure: TransportFailureFacts | undefined,
@@ -174,7 +225,18 @@ export function classifyContextOverflow(
 	if (transportFailure?.status === 429) return false;
 	const typedCodes = transportCodes(transportFailure);
 	if (typedCodes.some(code => OVERFLOW_PROVIDER_CODES.has(code))) return true;
+	// A specific non-overflow cause (auth, quota, rate limit) is authoritative
+	// and can never be upgraded by error prose.
 	if (hasTypedNonOverflowCode(transportFailure)) return false;
+	// A generic envelope (`invalid_request_error`) names no cause. It still
+	// vetoes free-form overflow prose, but must not veto a provider-measured,
+	// self-verifying overflow report — that is how Anthropic reports overflow.
+	if (
+		typedCodes.some(code => GENERIC_ENVELOPE_PROVIDER_CODES.has(code)) &&
+		!hasSelfVerifyingOverflowMeasurement(message)
+	) {
+		return false;
+	}
 	if (isTypedNoBodyOverflow(message, transportFailure)) return true;
 
 	const errorMessage = message.errorMessage;

package/src/utils/tool-call-healing.ts

@@ -19,7 +19,7 @@
 
 import {
 	attachUnicodeEscapeEvidence,
-	collectUnicodeEscapeEvidence,
+	collectUnsafeUnicodeEscapeEvidence,
 	parseJsonWithRepair,
 	type UnicodeEscapeEvidence,
 } from "./json-parse";
@@ -243,9 +243,11 @@ export class ToolCallHealer {
 		const name = normalizeFunctionName(rawId);
 		const id = generateHealedToolCallId();
 
-		// Sample the raw payload first: the round-trip below decodes `\uXXXX` into
-		// literal characters, so checking `argsJson` afterwards always reports clean.
-		const escapedUnicodeArgumentEvidence = collectUnicodeEscapeEvidence(rawArgs);
+		// Sample unsafe raw payloads first: the round-trip below decodes `\uXXXX`
+		// into literal characters, so malformed escape data must be retained before
+		// normalization. Valid escapes need no evidence because their decoded value
+		// is canonical.
+		const escapedUnicodeArgumentEvidence = collectUnsafeUnicodeEscapeEvidence(rawArgs);
 		const escapedNonAsciiArguments = escapedUnicodeArgumentEvidence !== undefined;
 
 		let argsJson = rawArgs;