@gajae-code/ai 0.15.4 → 0.15.6

package/dist/types/utils/oauth/api-key-login.d.ts

@@ -1,7 +1,8 @@
 /**
  * Shared factory for API-key-paste "login" flows.
  *
- * Several providers (Cerebras, Synthetic, Moonshot, Together, NanoGPT, ZenMux)
+ * Several providers (Cerebras, Synthetic, Moonshot, Together, NanoGPT, ZenMux,
+ * Command Code GOAT)
  * don't actually implement OAuth — they just ask the user to paste an API key,
  * optionally validate it, and return the trimmed key.
  */
@@ -11,6 +12,7 @@ type ChatCompletionsValidation = {
     provider: string;
     baseUrl: string;
     model: string;
+    requireInferenceResponse?: boolean;
 };
 type ModelsEndpointValidation = {
     kind: "models-endpoint";
@@ -30,6 +32,7 @@ export type ApiKeyLoginConfig = {
     placeholder: string;
     /** Validation strategy, or `null` to skip validation. */
     validation: ChatCompletionsValidation | ModelsEndpointValidation | null;
+    validationProgressMessage?: string;
 };
 export declare function createApiKeyLogin(config: ApiKeyLoginConfig): (options: OAuthController) => Promise<string>;
 export {};

package/dist/types/utils/oauth/api-key-validation.d.ts

@@ -4,12 +4,17 @@ type OpenAICompatibleValidationOptions = {
     baseUrl: string;
     model: string;
     signal?: AbortSignal;
+    fetch?: typeof globalThis.fetch;
+    requireInferenceResponse?: boolean;
+    timeoutMs?: number;
 };
 type ModelListValidationOptions = {
     provider: string;
     apiKey: string;
     modelsUrl: string;
     signal?: AbortSignal;
+    fetch?: typeof globalThis.fetch;
+    timeoutMs?: number;
 };
 /**
  * Validate an API key against an OpenAI-compatible chat completions endpoint.
@@ -18,16 +23,17 @@ type ModelListValidationOptions = {
  */
 export declare function validateOpenAICompatibleApiKey(options: OpenAICompatibleValidationOptions): Promise<void>;
 /**
- * Validate an API key against a provider models endpoint.
+ * Validate a provider models endpoint's reachability and response shape.
  *
  * Useful for providers where access to specific models may vary by plan and
- * should not block key validation.
+ * should not block login; an available model list is not proof that an
+ * authenticated inference request will succeed for the supplied key.
  *
  * A 200 status alone is NOT accepted: a captive portal, misrouting proxy, or
- * broken gateway can answer 200 with an HTML page or an empty JSON object, and
- * accepting the key on status alone would store a credential that was never
- * actually checked. The body must parse as JSON and carry a recognizable model
- * list before the key is considered validated.
+ * broken gateway can answer 200 with an HTML page or an empty JSON object.
+ * The body must parse as JSON and carry a recognizable model list before the
+ * endpoint is considered reachable. This catalog check is not proof that
+ * authenticated inference is entitled to use the supplied key.
  */
 export declare function validateApiKeyAgainstModelsEndpoint(options: ModelListValidationOptions): Promise<void>;
 export {};

package/dist/types/utils/oauth/commandcode.d.ts

@@ -0,0 +1 @@
+export declare const loginCommandCode: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/utils/oauth/types.d.ts

@@ -7,7 +7,7 @@ export type OAuthCredentials = {
     email?: string;
     accountId?: string;
 };
-export type OAuthProvider = "kiro" | "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sglang" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "opencodex" | "zai";
+export type OAuthProvider = "kiro" | "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "commandcode-goat" | "opengateway" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sglang" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "opencodex" | "zai";
 export type OAuthProviderId = OAuthProvider | (string & {});
 export type OAuthPrompt = {
     message: string;

package/dist/types/utils/retry.d.ts

@@ -24,4 +24,6 @@ export declare function callWithCopilotModelRetry<T>(fn: () => Promise<T>, optio
     signal?: AbortSignal;
     retryBaseDelayMs?: number;
     fallbackManaged?: boolean;
+    requestMaxRetries?: number;
+    disableProviderRetries?: boolean;
 }): Promise<T>;

package/dist/types/utils/tool-call-healing.d.ts

@@ -22,10 +22,10 @@ export interface HealedToolCall {
     readonly name: string;
     readonly arguments: string;
     /**
-     * Whether the raw leaked payload spelled a printable non-ASCII character as a
-     * `\uXXXX` escape. Captured BEFORE the normalizing round-trip below, which
-     * decodes escapes into literal characters and would otherwise erase the only
-     * evidence that the text is unverifiable.
+     * Whether the raw leaked payload carried unsafe Unicode argument data.
+     * Captured before the normalizing round-trip below, which would otherwise
+     * erase malformed escape evidence. Valid `\uXXXX` spellings decode
+     * canonically and leave this false.
      */
     readonly escapedNonAsciiArguments: boolean;
     readonly escapedUnicodeArgumentEvidence?: UnicodeEscapeEvidence;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.15.4",
+	"version": "0.15.6",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,8 +40,8 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/natives": "0.15.4",
-		"@gajae-code/utils": "0.15.4",
+		"@gajae-code/natives": "0.15.6",
+		"@gajae-code/utils": "0.15.6",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-broker/client.ts

@@ -8,6 +8,7 @@
 import { readSseEvents } from "@gajae-code/utils";
 import type { ZodType, infer as zInfer } from "zod/v4";
 import type { AuthCredential } from "../auth-storage";
+import type { Provider } from "../types";
 import type {
 	CredentialDisableRequest,
 	CredentialDisableResponse,
@@ -34,6 +35,8 @@ import {
 	usageResponseSchema,
 } from "./wire-schemas";
 
+export const AUTH_BROKER_EPOCH_HEADER = "X-GJC-Auth-Broker-Epoch";
+
 export interface AuthBrokerClientOptions {
 	/** Base URL (e.g. `https://broker.tailnet:8765`). Trailing slashes are trimmed. */
 	url: string;
@@ -80,24 +83,27 @@ export class AuthBrokerCredentialMetadataUnsupportedError extends AuthBrokerErro
 
 export interface FetchSnapshotOptions {
 	ifGenerationGt?: number;
+	ifEpoch?: string;
 	waitMs?: number;
 	signal?: AbortSignal;
 }
 
 export type FetchSnapshotResult =
 	| { status: 200; snapshot: SnapshotResponse; generation: number }
-	| { status: 304; generation: number };
+	| { status: 304; generation: number; epoch?: string };
 
-function parseGenerationTag(header: string | null): number | undefined {
+function parseSnapshotTag(header: string | null): { epoch?: string; generation: number } | undefined {
 	if (!header) return undefined;
 	let value = header.trim();
 	if (value.startsWith("W/")) value = value.slice(2).trim();
 	if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
 		value = value.slice(1, -1);
 	}
-	const generation = Number(value);
+	const separator = value.lastIndexOf(":");
+	const epoch = separator > 0 ? value.slice(0, separator) : undefined;
+	const generation = Number(separator > 0 ? value.slice(separator + 1) : value);
 	if (!Number.isInteger(generation) || generation < 0) return undefined;
-	return generation;
+	return { epoch, generation };
 }
 
 const DEFAULT_TIMEOUT_MS = 10_000;
@@ -136,6 +142,7 @@ export class AuthBrokerClient {
 		try {
 			return (await this.#request("GET", "/v1/credentials/metadata", {
 				schema: credentialMetadataResponseSchema,
+				headers: { [AUTH_BROKER_EPOCH_HEADER]: "1" },
 				signal,
 			})) as CredentialMetadataResponse;
 		} catch (error) {
@@ -150,7 +157,11 @@ export class AuthBrokerClient {
 		if (opts.waitMs !== undefined) query.set("wait", String(opts.waitMs));
 		const path = `/v1/snapshot${query.size > 0 ? `?${query.toString()}` : ""}`;
 		const headers: Record<string, string> = {};
-		if (opts.ifGenerationGt !== undefined) headers["If-None-Match"] = `"${opts.ifGenerationGt}"`;
+		headers[AUTH_BROKER_EPOCH_HEADER] = "1";
+		if (opts.ifGenerationGt !== undefined) {
+			const validator = opts.ifEpoch ? `${opts.ifEpoch}:${opts.ifGenerationGt}` : String(opts.ifGenerationGt);
+			headers["If-None-Match"] = `"${validator}"`;
+		}
 		const timeoutMs =
 			opts.waitMs !== undefined && opts.waitMs > 0 ? Math.max(this.#timeoutMs, opts.waitMs + 1000) : undefined;
 		const response = await this.#fetchRaw("GET", path, {
@@ -159,9 +170,13 @@ export class AuthBrokerClient {
 			signal: opts.signal,
 			timeoutMs,
 		});
-		const etagGeneration = parseGenerationTag(response.headers.get("etag"));
+		const etag = parseSnapshotTag(response.headers.get("etag"));
 		if (response.status === 304) {
-			return { status: 304, generation: etagGeneration ?? opts.ifGenerationGt ?? 0 };
+			return {
+				status: 304,
+				generation: etag?.generation ?? opts.ifGenerationGt ?? 0,
+				...(etag?.epoch ? { epoch: etag.epoch } : {}),
+			};
 		}
 		const text = await response.text();
 		const raw = this.#parseJson(text, response.status);
@@ -173,7 +188,7 @@ export class AuthBrokerClient {
 			});
 		}
 		const snapshot = validated.data as SnapshotResponse;
-		return { status: 200, snapshot, generation: etagGeneration ?? snapshot.generation };
+		return { status: 200, snapshot, generation: etag?.generation ?? snapshot.generation };
 	}
 
 	/**
@@ -190,6 +205,7 @@ export class AuthBrokerClient {
 		const headers: Record<string, string> = {
 			Accept: "text/event-stream",
 			Authorization: `Bearer ${this.#token}`,
+			[AUTH_BROKER_EPOCH_HEADER]: "1",
 		};
 		if (opts.signal?.aborted) {
 			throw new AuthBrokerError("Auth broker request aborted", { cause: opts.signal.reason });
@@ -258,12 +274,13 @@ export class AuthBrokerClient {
 		}
 	}
 
-	fetchUsage(signal?: AbortSignal): Promise<UsageResponse> {
+	fetchUsage(signal?: AbortSignal, provider?: Provider): Promise<UsageResponse> {
 		// Validates the envelope (`generatedAt`, `reports[].provider`, `limits`,
 		// `metadata`) but leaves provider-specific extension fields permissive so
 		// the broker can ship new shapes ahead of the client. `raw` is accepted
 		// but normally stripped by the broker before send.
-		return this.#request("GET", "/v1/usage", { schema: usageResponseSchema, signal }) as Promise<UsageResponse>;
+		const path = provider ? `/v1/usage/scoped?provider=${encodeURIComponent(provider)}` : "/v1/usage";
+		return this.#request("GET", path, { schema: usageResponseSchema, signal }) as Promise<UsageResponse>;
 	}
 
 	async refreshCredential(id: number, signal?: AbortSignal): Promise<CredentialRefreshResponse> {
@@ -285,8 +302,13 @@ export class AuthBrokerClient {
 		}) as Promise<CredentialRefreshResponse>;
 	}
 
-	async disableCredential(id: number, cause: string, signal?: AbortSignal): Promise<CredentialDisableResponse> {
-		const body: CredentialDisableRequest = { cause };
+	async disableCredential(
+		id: number,
+		cause: string,
+		signal?: AbortSignal,
+		expectedRevision?: number,
+	): Promise<CredentialDisableResponse> {
+		const body: CredentialDisableRequest = { cause, ...(expectedRevision === undefined ? {} : { expectedRevision }) };
 		return this.#request("POST", `/v1/credential/${id}/disable`, {
 			body,
 			schema: credentialDisableResponseSchema,
@@ -323,7 +345,13 @@ export class AuthBrokerClient {
 	async #request<TSchema extends ZodType>(
 		method: "GET" | "POST",
 		path: string,
-		opts: { schema: TSchema; auth?: boolean; body?: unknown; signal?: AbortSignal },
+		opts: {
+			schema: TSchema;
+			auth?: boolean;
+			body?: unknown;
+			signal?: AbortSignal;
+			headers?: Record<string, string>;
+		},
 	): Promise<zInfer<TSchema>> {
 		const response = await this.#fetchRaw(method, path, opts);
 		const text = await response.text();

package/src/auth-broker/redact.ts

@@ -7,8 +7,32 @@
 export function cleanReason(value: unknown): string | undefined {
 	if (value === undefined || value === null) return undefined;
 	let reason = value instanceof Error ? value.message : String(value);
+	if (/[\u0000-\u001f\u007f-\u009f]/.test(reason)) return "Credential diagnostic unavailable.";
+	if (reason.includes("\\")) return "Credential diagnostic unavailable.";
+	if (/["']?authorization(?:[_-]header)?["']?\s*[:=]/i.test(reason)) return "Credential diagnostic unavailable.";
+	if (
+		/\b["']?(?:key|api[_-]?key|client[_-]?secret|clientSecret|token|secret|password|access|refresh|cookie|credential)(?:[_-](?:token|key|secret|header|headers))?["']?\s*[:=]/i.test(
+			reason,
+		)
+	) {
+		return "Credential diagnostic unavailable.";
+	}
+	if (/\b(?:bearer|basic)\s+["']/i.test(reason)) return "Credential diagnostic unavailable.";
+	if (/^No credential with id=\d+$/i.test(reason)) return reason;
+	if (/\b(?:api\s*[-_]?key|access\s*[-_]?token|refresh\s*[-_]?token|credential)\b/i.test(reason))
+		return "Credential diagnostic unavailable.";
 	reason = reason.replace(/bearer\s+[^\s,;]+/gi, "Bearer [redacted]");
-	reason = reason.replace(/(api[_-]?key|token|secret|authorization)[=:]\s*[^\s,;]+/gi, "$1=[redacted]");
+	reason = reason.replace(/basic\s+[^\s,;]+/gi, "Basic [redacted]");
+	reason = reason.replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, "$1[redacted]@");
+	reason = reason.replace(/\b([a-z][a-z0-9+.-]*:\/\/[^\s<>"']*?)(?:[?#][^\s<>"']*)/gi, "$1");
+	reason = reason.replace(
+		/((?:\\?["']?(?:key|api[_-]?key|client[_-]?secret|clientSecret|token|secret|authorization|password|access|refresh|cookie|credential)(?:[_-](?:token|key|secret|header|headers))?\\?["']?)\s*:\s*)\\?(["'])(?:\\.|(?!\2)[^\\])*\2/gi,
+		"$1$2[redacted]$2",
+	);
+	reason = reason.replace(
+		/((?:key|api[_-]?key|client[_-]?secret|clientSecret|token|secret|authorization|password|access|refresh|cookie|credential)(?:[_-](?:token|key|secret|header|headers))?)\s*[:=]\s*[^\s,;]+/gi,
+		"$1=[redacted]",
+	);
 	reason = reason.replace(/[\r\n\t ]+/g, " ").trim();
 	if (reason.length > 256) reason = `${reason.slice(0, 253)}...`;
 	return reason || undefined;