@gajae-code/ai 0.15.5 → 0.16.0

package/src/utils/oauth/kiro.ts

@@ -8,6 +8,7 @@
  * and AWS public documentation, not from any third-party reference.
  */
 import { scheduler } from "node:timers/promises";
+import { assertAwsRegionLabel } from "../../adapter-internals/aws-region";
 import type { OAuthCredentials } from "./types";
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -72,23 +73,38 @@ interface CreateTokenError {
 	error_uri?: string;
 }
 
+interface CreateTokenResult {
+	response: Response;
+	status: number;
+	data: CreateTokenSuccess | CreateTokenError;
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Typed SSO OIDC error names from the published service model
 // ─────────────────────────────────────────────────────────────────────────────
 
 const SSO_OIDC_FATAL_ERRORS = new Set([
 	"access_denied_exception",
+	"access_denied",
 	"expired_token_exception",
+	"expired_token",
 	"internal_server_exception",
+	"server_error",
 	"invalid_client_exception",
+	"invalid_client",
 	"invalid_client_metadata_exception",
 	"invalid_grant_exception",
+	"invalid_grant",
 	"invalid_redirect_uri_exception",
 	"invalid_request_exception",
+	"invalid_request",
 	"invalid_request_region_exception",
 	"invalid_scope_exception",
+	"invalid_scope",
 	"unauthorized_client_exception",
+	"unauthorized_client",
 	"unsupported_grant_type_exception",
+	"unsupported_grant_type",
 ]);
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -133,6 +149,7 @@ export async function registerClient(
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify(body),
+		redirect: "error",
 		signal,
 	});
 
@@ -180,6 +197,7 @@ export async function startDeviceAuthorization(
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify(body),
+		redirect: "error",
 		signal,
 	});
 
@@ -227,33 +245,54 @@ export async function pollForToken(
 			deviceCode,
 		};
 
-		const response = await fetchOidc(url, {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify(body),
-			signal,
-		});
-
-		const data = (await response.json()) as CreateTokenSuccess | CreateTokenError;
+		const requestSignal = AbortSignal.any([
+			...(signal ? [signal] : []),
+			AbortSignal.timeout(Math.max(1, deadline - Date.now())),
+		]);
+		let result: CreateTokenResult;
+		try {
+			result = await createTokenOnce(url, {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify(body),
+				signal: requestSignal,
+			});
+		} catch (error) {
+			if (signal?.aborted) throw new Error("Login cancelled");
+			if (Date.now() >= deadline) break;
+			throw error;
+		}
 
-		if ("accessToken" in data && typeof data.accessToken === "string") {
+		if (Date.now() >= deadline) break;
+		const { status, data } = result;
+
+		if ("accessToken" in data) {
+			if (
+				status < 200 ||
+				status >= 300 ||
+				"error" in data ||
+				data.accessToken.length === 0 ||
+				!Number.isFinite(data.expiresIn) ||
+				data.expiresIn <= 0
+			) {
+				throw new Error("SSO OIDC CreateToken: invalid success response");
+			}
 			return data;
 		}
 
 		if ("error" in data) {
+			if (status !== 400) throw new Error(oidcRequestFailure(url, result.response));
 			const errorCode = data.error;
 			if (errorCode === "authorization_pending") continue;
 			if (errorCode === "slow_down") {
-				currentInterval = Math.ceil(currentInterval * 1.5);
+				currentInterval += 5_000;
 				continue;
 			}
 			if (SSO_OIDC_FATAL_ERRORS.has(errorCode)) {
-				const desc = data.error_description ? `: ${data.error_description}` : "";
-				throw new Error(`SSO OIDC token error: ${errorCode}${desc}`);
+				throw new Error(`SSO OIDC token error: ${errorCode}`);
 			}
 			// Unknown error — fail closed
-			const desc = data.error_description ? `: ${data.error_description}` : "";
-			throw new Error(`SSO OIDC unrecognized token error: ${errorCode}${desc}`);
+			throw new Error(`SSO OIDC unrecognized token error: ${errorCode}`);
 		}
 
 		throw new Error("SSO OIDC CreateToken: unrecognized response shape");
@@ -292,6 +331,7 @@ export async function refreshKiroToken(credentials: OAuthCredentials): Promise<O
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify(body),
+		redirect: "error",
 	});
 
 	const data = (await response.json()) as CreateTokenSuccess | CreateTokenError;
@@ -430,19 +470,48 @@ export function importSsoCacheToken(): OAuthCredentials | undefined {
 // ─────────────────────────────────────────────────────────────────────────────
 
 function ssoOidcEndpoint(region: string, pathSuffix: string): string {
+	assertAwsRegionLabel(region);
 	return `https://oidc.${region}.amazonaws.com${pathSuffix}`;
 }
 
 async function fetchOidc(url: string, init: RequestInit & { signal?: AbortSignal }): Promise<Response> {
-	const response = await fetch(url, init);
+	const response = await fetch(url, { ...init, redirect: "error" });
 	if (!response.ok) {
-		let errorBody = "";
-		try {
-			errorBody = await response.text();
-		} catch {}
-		throw new Error(
-			`SSO OIDC request to ${url} failed: ${response.status} ${response.statusText}: ${errorBody.slice(0, 500)}`,
-		);
+		throw new Error(oidcRequestFailure(url, response));
 	}
 	return response;
 }
+
+function oidcRequestFailure(url: string, response: Response): string {
+	return `SSO OIDC request to ${url} failed: ${response.status} ${response.statusText}`;
+}
+
+/**
+ * `CreateToken` reports the in-progress device-code states (`authorization_pending`,
+ * `slow_down`) as HTTP 400 responses whose body carries the error code, so the poll
+ * loop must read the payload instead of treating a non-2xx status as fatal.
+ * Non-2xx responses without an `error` field still fail closed.
+ */
+async function createTokenOnce(url: string, init: RequestInit & { signal?: AbortSignal }): Promise<CreateTokenResult> {
+	const response = await fetch(url, { ...init, redirect: "error" });
+	const rawBody = await response.text();
+	let data: CreateTokenSuccess | CreateTokenError;
+	try {
+		data = JSON.parse(rawBody) as CreateTokenSuccess | CreateTokenError;
+	} catch {
+		throw new Error(oidcRequestFailure(url, response));
+	}
+	if (data === null || typeof data !== "object") {
+		throw new Error(oidcRequestFailure(url, response));
+	}
+	if (!response.ok && !("error" in data)) {
+		throw new Error(oidcRequestFailure(url, response));
+	}
+	if ("error" in data && typeof data.error !== "string") {
+		throw new Error(oidcRequestFailure(url, response));
+	}
+	if ("accessToken" in data && typeof data.accessToken !== "string") {
+		throw new Error(oidcRequestFailure(url, response));
+	}
+	return { response, status: response.status, data };
+}

package/src/utils/oauth/types.d.ts

@@ -7,7 +7,7 @@ export type OAuthCredentials = {
     email?: string;
     accountId?: string;
 };
-export type OAuthProvider = "kiro" | "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sglang" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "opencodex" | "zai";
+export type OAuthProvider = "kiro" | "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "commandcode-goat" | "opengateway" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sglang" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "opencodex" | "zai";
 export type OAuthProviderId = OAuthProvider | (string & {});
 export type OAuthPrompt = {
     message: string;

package/src/utils/oauth/types.ts

@@ -43,6 +43,7 @@ export type OAuthProvider =
 	| "openai-codex-device"
 	| "opencode-go"
 	| "opencode-zen"
+	| "commandcode-goat"
 	| "opengateway"
 	| "openrouter"
 	| "parallel"

package/src/utils/retry.d.ts

@@ -24,4 +24,6 @@ export declare function callWithCopilotModelRetry<T>(fn: () => Promise<T>, optio
     signal?: AbortSignal;
     retryBaseDelayMs?: number;
     fallbackManaged?: boolean;
+    requestMaxRetries?: number;
+    disableProviderRetries?: boolean;
 }): Promise<T>;

package/src/utils/retry.ts

@@ -34,9 +34,22 @@ const COPILOT_MODEL_RETRY_BASE_DELAY_MS = 400;
  */
 export async function callWithCopilotModelRetry<T>(
 	fn: () => Promise<T>,
-	options: { provider: string; signal?: AbortSignal; retryBaseDelayMs?: number; fallbackManaged?: boolean },
+	options: {
+		provider: string;
+		signal?: AbortSignal;
+		retryBaseDelayMs?: number;
+		fallbackManaged?: boolean;
+		requestMaxRetries?: number;
+		disableProviderRetries?: boolean;
+	},
 ): Promise<T> {
-	if (options.provider !== "github-copilot" || options.fallbackManaged) return fn();
+	if (
+		options.provider !== "github-copilot" ||
+		options.fallbackManaged ||
+		options.requestMaxRetries === 0 ||
+		options.disableProviderRetries
+	)
+		return fn();
 
 	let lastError: unknown;
 	const retryBaseDelayMs = options.retryBaseDelayMs ?? COPILOT_MODEL_RETRY_BASE_DELAY_MS;

package/src/utils/schema/dereference.ts

@@ -11,69 +11,190 @@
  */
 import { isJsonObject, type JsonObject } from "./types";
 
-/**
- * Resolve a JSON-pointer-style `$ref` against the root schema's `$defs`
- * or `definitions` block. Returns `undefined` for external or unresolvable refs.
- */
-function resolveLocalRef(ref: string, root: JsonObject): JsonObject | undefined {
-	// Only handle local refs: #/$defs/Name or #/definitions/Name
-	const match = /^#\/(\$defs|definitions)\/(.+)$/.exec(ref);
-	if (!match) return undefined;
+const JSON_SCHEMA_LITERAL_PAYLOAD_KEYS = new Set(["default", "const", "enum", "examples"]);
+const JSON_SCHEMA_MAP_KEYS = new Set([
+	"properties",
+	"patternProperties",
+	"dependencies",
+	"dependentSchemas",
+	"$defs",
+	"definitions",
+]);
+
+function setOwnKey(target: JsonObject, key: string, value: unknown): void {
+	if (key === "__proto__") {
+		Object.defineProperty(target, key, { value, writable: true, enumerable: true, configurable: true });
+		return;
+	}
+	target[key] = value;
+}
+
+type DereferenceState = {
+	unresolvedRef: boolean;
+};
+
+/** Resolve any local JSON Pointer, including escaped names and boolean schemas. */
+function resolveLocalRef(ref: string, root: JsonObject): unknown | undefined {
+	if (!ref.startsWith("#")) return undefined;
+	let pointer: string;
+	try {
+		pointer = decodeURIComponent(ref.slice(1));
+	} catch {
+		return undefined;
+	}
+	if (pointer === "") return root;
+	if (!pointer.startsWith("/")) return undefined;
 
-	const [, defsKey, name] = match;
-	const defs = root[defsKey!];
-	if (!isJsonObject(defs)) return undefined;
+	let current: unknown = root;
+	for (const encodedSegment of pointer.slice(1).split("/")) {
+		const segment = encodedSegment.replaceAll("~1", "/").replaceAll("~0", "~");
+		if (Array.isArray(current)) {
+			if (!/^(0|[1-9]\d*)$/.test(segment) || !Object.hasOwn(current, segment)) return undefined;
+			current = current[Number(segment)];
+		} else if (isJsonObject(current)) {
+			if (!Object.hasOwn(current, segment)) return undefined;
+			current = current[segment];
+		} else {
+			return undefined;
+		}
+	}
+	return current;
+}
 
-	const resolved = defs[name!];
-	return isJsonObject(resolved) ? resolved : undefined;
+/** Find definition maps anywhere in a schema graph, excluding literal instance data. */
+function hasDefinitionMapDeep(value: unknown, seen: Set<object>, inSchemaMap = false): boolean {
+	if (Array.isArray(value)) {
+		if (seen.has(value)) return false;
+		seen.add(value);
+		return value.some(entry => hasDefinitionMapDeep(entry, seen, false));
+	}
+	if (!isJsonObject(value) || seen.has(value)) return false;
+	seen.add(value);
+	for (const key in value) {
+		if (!Object.hasOwn(value, key)) continue;
+		if (!inSchemaMap && (key === "$defs" || key === "definitions")) return true;
+		if (!inSchemaMap && JSON_SCHEMA_LITERAL_PAYLOAD_KEYS.has(key)) continue;
+		const childInSchemaMap = !inSchemaMap && JSON_SCHEMA_MAP_KEYS.has(key);
+		if (hasDefinitionMapDeep(value[key], seen, childInSchemaMap)) return true;
+	}
+	return false;
+}
+
+function dereferenceSchemaMap(
+	schemaMap: JsonObject,
+	root: JsonObject,
+	visitingRefs: Set<string>,
+	visitingNodes: Set<object>,
+	state: DereferenceState,
+): JsonObject {
+	const result: JsonObject = {};
+	for (const key in schemaMap) {
+		if (!Object.hasOwn(schemaMap, key)) continue;
+		setOwnKey(result, key, dereferenceNode(schemaMap[key], root, visitingRefs, visitingNodes, state));
+	}
+	return result;
 }
 
 /**
  * Recursively dereference a JSON Schema node, inlining all local `$ref` pointers.
+ * Object and array path tracking preserves the existing `{}` cycle boundary.
  */
-function dereferenceNode(node: unknown, root: JsonObject, visiting: Set<string>): unknown {
-	if (!isJsonObject(node)) return node;
-	if (Array.isArray(node)) return node.map(item => dereferenceNode(item, root, visiting));
+function dereferenceNode(
+	node: unknown,
+	root: JsonObject,
+	visitingRefs: Set<string>,
+	visitingNodes: Set<object>,
+	state: DereferenceState,
+	inSchemaMap = false,
+): unknown {
+	if (!node || typeof node !== "object") return node;
+	if (visitingNodes.has(node)) return {};
+	visitingNodes.add(node);
+
+	if (Array.isArray(node)) {
+		const result = node.map(item => dereferenceNode(item, root, visitingRefs, visitingNodes, state));
+		visitingNodes.delete(node);
+		return result;
+	}
 
-	const ref = node.$ref;
+	const schemaNode = node as JsonObject;
+	const ref = Object.hasOwn(schemaNode, "$ref") ? schemaNode.$ref : undefined;
 	if (typeof ref === "string") {
-		// Break circular references
-		if (visiting.has(ref)) return {};
+		if (visitingRefs.has(ref)) {
+			visitingNodes.delete(node);
+			return {};
+		}
 		const resolved = resolveLocalRef(ref, root);
-		if (!resolved) return node; // External ref — leave as-is
-		visiting.add(ref);
-		const inlined = dereferenceNode(resolved, root, visiting);
-		visiting.delete(ref);
+		if (resolved !== undefined) {
+			visitingRefs.add(ref);
+			const inlined = dereferenceNode(resolved, root, visitingRefs, visitingNodes, state);
+			visitingRefs.delete(ref);
 
-		// Merge sibling keywords (e.g. description, default) from the
-		// referencing node. In draft 2020-12 these are valid alongside $ref.
-		let hasSiblings = false;
-		for (const k in node) {
-			if (k !== "$ref") {
-				hasSiblings = true;
-				break;
+			// Merge sibling keywords (e.g. description, default) from the
+			// referencing node. In draft 2020-12 these are valid alongside `$ref`.
+			let hasSiblings = false;
+			for (const key in schemaNode) {
+				if (Object.hasOwn(schemaNode, key) && key !== "$ref") {
+					hasSiblings = true;
+					break;
+				}
+			}
+			if (inlined === false) {
+				visitingNodes.delete(node);
+				return false;
+			}
+			if (!hasSiblings || (!isJsonObject(inlined) && inlined !== true)) {
+				visitingNodes.delete(node);
+				return inlined;
 			}
+			const merged: JsonObject = {};
+			if (isJsonObject(inlined)) {
+				for (const key in inlined) {
+					if (Object.hasOwn(inlined, key)) setOwnKey(merged, key, inlined[key]);
+				}
+			}
+			for (const key in schemaNode) {
+				if (!Object.hasOwn(schemaNode, key) || key === "$ref") continue;
+				const siblingValue = schemaNode[key];
+				const sibling =
+					!inSchemaMap && JSON_SCHEMA_LITERAL_PAYLOAD_KEYS.has(key)
+						? schemaNode[key]
+						: !inSchemaMap && JSON_SCHEMA_MAP_KEYS.has(key) && isJsonObject(siblingValue)
+							? dereferenceSchemaMap(siblingValue, root, visitingRefs, visitingNodes, state)
+							: dereferenceNode(siblingValue, root, visitingRefs, visitingNodes, state);
+				setOwnKey(merged, key, sibling);
+			}
+			if (!state.unresolvedRef) {
+				delete merged.$defs;
+				delete merged.definitions;
+			}
+			visitingNodes.delete(node);
+			return merged;
 		}
-		if (!hasSiblings || !isJsonObject(inlined)) return inlined;
-		const merged: JsonObject = { ...inlined, ...node };
-		delete merged.$ref;
-		return merged;
+		state.unresolvedRef = true;
 	}
 
 	const result: JsonObject = {};
-	for (const key in node) {
-		const value = node[key];
-		// Skip $defs/definitions — they get inlined into consumers
-		if (key === "$defs" || key === "definitions") continue;
-
-		if (Array.isArray(value)) {
-			result[key] = value.map(item => dereferenceNode(item, root, visiting));
-		} else if (isJsonObject(value)) {
-			result[key] = dereferenceNode(value, root, visiting);
-		} else {
-			result[key] = value;
+	for (const key in schemaNode) {
+		if (!Object.hasOwn(schemaNode, key)) continue;
+		const value = schemaNode[key];
+		// Literal instance data is not schema-shaped, even when it contains an
+		// object that happens to use schema-looking keys or a local `$ref`.
+		if (!inSchemaMap && JSON_SCHEMA_LITERAL_PAYLOAD_KEYS.has(key)) {
+			setOwnKey(result, key, value);
+			continue;
+		}
+		if (!inSchemaMap && JSON_SCHEMA_MAP_KEYS.has(key) && isJsonObject(value)) {
+			setOwnKey(result, key, dereferenceSchemaMap(value, root, visitingRefs, visitingNodes, state));
+			continue;
 		}
+		setOwnKey(result, key, dereferenceNode(value, root, visitingRefs, visitingNodes, state));
+	}
+	if (!state.unresolvedRef) {
+		delete result.$defs;
+		delete result.definitions;
 	}
+	visitingNodes.delete(node);
 	return result;
 }
 
@@ -90,9 +211,8 @@ function dereferenceNode(node: unknown, root: JsonObject, visiting: Set<string>)
 export function dereferenceJsonSchema(schema: unknown): unknown {
 	if (!isJsonObject(schema)) return schema;
 
-	// Fast path: nothing to dereference
-	const hasDefs = schema.$defs !== undefined || schema.definitions !== undefined;
-	if (!hasDefs) return schema;
+	// Fast path: nothing to dereference anywhere in the schema graph
+	if (!hasDefinitionMapDeep(schema, new Set())) return schema;
 
-	return dereferenceNode(schema, schema, new Set());
+	return dereferenceNode(schema, schema, new Set(), new Set(), { unresolvedRef: false });
 }