@gajae-code/ai 0.15.6 → 0.16.0

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## [Unreleased]
 
+## [0.16.0] - 2026-09-02
+
+### Added
+
+- Bundled `anthropic/claude-fable-5-1` (Claude Fable 5.1): 1M context, 128K output, `anthropic-adaptive` thinking clamped to `xhigh` on the Messages API, matching the Fable 5 effort ladder exactly. The model is served only by Anthropic's first-party API and requires a Claude Code compatibility version of at least `2.1.251`; older fingerprints are answered with an HTTP 400 `claude_code_version_too_old`, which the `2.1.257` attribution bump clears. Verified live: `2.1.219` returns the 400, `2.1.257` returns 200, `low`/`high`/`xhigh` all stream, and adaptive thinking returns visible summarized content rather than signature-only billed thinking.
+
+### Fixed
+
+- Cursor's `kimi-k3-low`, `kimi-k3-high`, and `kimi-k3-max` now declare their real 1,048,576-token context window instead of 200,000. The bundled value was understated by 5.2x, so context management compacted these models at roughly a fifth of their usable window. The same underlying model already declares 1,048,576 elsewhere in this catalog (`openrouter/moonshotai/kimi-k3`, `kilo/moonshotai/kimi-k3`, and `opencode-go/kimi-k3` in `provider-models/openai-compat.ts`), so the cursor entries were the inconsistent ones. Measured against the live `cursor-agent` transport, which reports `usage.inputTokens` per request: 1,026,459 input tokens were accepted and answered correctly, while 1,161,948 tokens were silently summarized down to 20,552 and lost the answer. Output `maxTokens` is unchanged at 64,000, which this change did not measure.
+
+- The Cursor Kimi K3 context correction is now enforced by the deterministic model-generation policy, so a future catalog regeneration cannot reintroduce the stale 200,000-token fallback.
+
+- OpenCode Go's bundled catalog now contains all 33 models advertised by its live provider list, including the seven newly published models. Canonical endpoint metadata supplies their transport, multimodal input, limits, pricing, and reasoning capabilities, while generated output remains deterministic and preserves fail-closed selection when a live catalog is unavailable (#5144).
+
+- SQLite corruption detection is now shared by credential and capability-cache surfaces, so callers can recognize `SQLITE_CORRUPT` and `SQLITE_NOTADB` without inspecting provider-specific error details.
+
+- OpenAI Codex WebSockets are now opt-in on Windows. Bun 1.4.0 can segfault in its Windows TLS WebSocket handshake, so the automatic model preference uses SSE on Windows while the explicit WebSocket setting remains available for operators who have a newer safe runtime.
+- MCP dispatcher tools now preserve dynamic nested `args` and `params` objects when a server declares them as propertyless JSON Schema objects. `normalizeSchemaForMCP` makes the implicit open-map semantics explicit with `additionalProperties: true` without loosening objects that declare properties or an explicit closure, so provider tool schemas no longer collapse valid nested arguments to `{}`.
+- Schema normalization now copies `default`, `const`, `enum`, and `examples` payloads verbatim. These keywords carry instance data, not subschemas, so the previous recursive walk rewrote user payloads as if they were schemas (a `default` of `{"type":"object","nullable":true}` lost `nullable`, and literal `anyOf`/`const` branches collapsed into `enum`).
+- Schema copies now write property names as own data properties. A `JSON.parse`d tool schema carries `__proto__` as an ordinary key, and plain assignment routed it to `Object.prototype`'s `__proto__` setter, dropping that valid property from the normalized schema.
+- Schema-valued maps now remain maps even when dispatcher argument names collide with JSON Schema keywords (`type`, `default`, `const`, `enum`, or `examples`), and prototype-colliding names survive draft-upgrade, dereference, and Zod cleanup copies without polluting `Object.prototype`.
+- Claude Code compatibility attribution moved from `2.1.219` to `2.1.257`, and the Gemini CLI spoofed version from `0.52.0` to `0.58.0`. Anthropic gates newer models behind a minimum client version, so a stale `claude-cli/<version>` fingerprint surfaces as an HTTP 400 on a model the account can otherwise reach. `scripts/check-spoofed-versions.ts` now covers `claudeCodeVersion` (resolved from Anthropic's `latest` native-installer release channel, with the `@anthropic-ai/claude-code` npm dist-tag as a second source and the higher of the two winning so one lagging channel cannot pin us back), spans multiple source files, and compares by semver instead of string equality. Both constants had only ever been bumped by hand and the check was never scheduled, so the new read-only daily `spoofed-version-sync` workflow now runs it and fails with a one-command remediation on drift.
+- Bedrock and both Kiro credential transports now reject malformed project-aware AWS regions before interpolating them into authenticated service authorities. Valid lowercase ASCII region labels and explicit Kiro model `baseUrl` overrides are unchanged.
+- Kiro Builder ID device-code login no longer aborts on the first poll. AWS SSO OIDC `CreateToken` reports the in-progress states (`authorization_pending`, `slow_down`) as HTTP 400 responses whose body carries the error code, but the poll loop went through the shared `fetchOidc` helper that throws on any non-2xx status, so the `authorization_pending` branch it already implemented was unreachable and every login failed within one interval of printing the verification URL. The poll now reads the JSON payload before classifying the response; non-2xx responses without an `error` field still fail closed.
+
 ## [0.15.6] - 2026-08-30
 
 ### Added

package/dist/types/adapter-internals/aws-region.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Fail closed before an AWS region is interpolated into a credential-bearing
+ * service authority. Region names are one lowercase ASCII DNS label; dots,
+ * URL delimiters, Unicode, whitespace, and controls must never reach URL
+ * parsing as part of that label.
+ */
+export declare function assertAwsRegionLabel(region: unknown): asserts region is string;

package/dist/types/core.d.ts

@@ -31,5 +31,6 @@ export type { OAuthCredentials, OAuthProvider, OAuthProviderId, OAuthProviderInf
 export * from "./utils/overflow";
 export * from "./utils/retry";
 export * from "./utils/schema";
+export * from "./utils/sqlite-errors";
 export * from "./utils/tool-choice-capability";
 export * from "./utils/validation";

package/dist/types/index.d.ts

@@ -51,5 +51,6 @@ export * from "./utils/overflow";
 export * from "./utils/provider-safety-stop";
 export * from "./utils/retry";
 export * from "./utils/schema";
+export * from "./utils/sqlite-errors";
 export * from "./utils/tool-choice-capability";
 export * from "./utils/validation";

package/dist/types/providers/anthropic.d.ts

@@ -107,7 +107,7 @@ export interface CpaToolAliasRestoreFailure {
  */
 export declare function parseCpaToolAliasRestoreFailure(error: unknown): CpaToolAliasRestoreFailure | undefined;
 export declare function isCpaToolAliasRestoreFailure(error: unknown): boolean;
-export declare const claudeCodeVersion = "2.1.219";
+export declare const claudeCodeVersion = "2.1.257";
 export declare const claudeCodeEntrypoint = "sdk-cli";
 export declare const claudeToolPrefix: string;
 export declare const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";

package/dist/types/providers/google-gemini-headers.d.ts

@@ -5,7 +5,7 @@
  */
 export declare const GEMINI_CLI_VERSION_ENV = "GJC_AI_GEMINI_CLI_VERSION";
 export declare const LEGACY_GEMINI_CLI_VERSION_ENV = "PI_AI_GEMINI_CLI_VERSION";
-export declare const DEFAULT_GEMINI_CLI_VERSION = "0.52.0";
+export declare const DEFAULT_GEMINI_CLI_VERSION = "0.58.0";
 export declare function getGeminiCliUserAgent(modelId?: string): string;
 export declare const getGeminiCliHeaders: (modelId?: string) => {
     "User-Agent": string;

package/dist/types/providers/openai-codex-responses.d.ts

@@ -25,6 +25,12 @@ export declare function normalizeCodexToolChoice(choice: ToolChoice | undefined,
 export declare function formatCodexUserAgent(platform: string, release: string, arch: string): string;
 export declare const streamOpenAICodexResponses: StreamFunction<"openai-codex-responses">;
 export declare function prewarmOpenAICodexResponses(model: Model<"openai-codex-responses">, options?: Pick<OpenAICodexResponsesOptions, "apiKey" | "headers" | "sessionId" | "signal" | "preferWebsockets" | "providerSessionState">): Promise<void>;
+/**
+ * Bun 1.4.0's Windows WebSocket client can segfault during TLS handshakes.
+ * Keep the model's websocket preference available on other platforms, while
+ * requiring an explicit opt-in on Windows until the bundled runtime is fixed.
+ */
+export declare function isCodexWebSocketSafeByDefault(platform?: NodeJS.Platform): boolean;
 export interface OpenAICodexTransportDetails {
     websocketPreferred: boolean;
     lastTransport?: CodexTransport;

package/dist/types/utils/schema/normalize.d.ts

@@ -25,11 +25,6 @@ export interface NormalizeSchemaOptions {
 }
 /** Copy all keys from a schema except the specified combiner key. */
 export declare function copySchemaWithout(schema: JsonObject, combiner: string): JsonObject;
-/**
- * Recursively strip any remaining anyOf/oneOf that same-type or mixed-type
- * collapse can handle. This is needed because object-combiner merging can
- * create new anyOf in merged subtrees after child normalization already ran.
- */
 export declare function stripResidualCombiners(value: unknown, epoch?: number): unknown;
 export declare function normalizeSchema(value: unknown, options: NormalizeSchemaOptions): unknown;
 export declare function normalizeSchemaForGoogle(value: unknown): unknown;

package/dist/types/utils/sqlite-errors.d.ts

@@ -0,0 +1,4 @@
+/** Return whether an error carries a SQLite result code. */
+export declare function isSqliteError(error: unknown): boolean;
+/** Return whether an error is one of SQLite's explicit database-corruption classes. */
+export declare function isSqliteCorruptionError(error: unknown): boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.15.6",
+	"version": "0.16.0",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,8 +40,8 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/natives": "0.15.6",
-		"@gajae-code/utils": "0.15.6",
+		"@gajae-code/natives": "0.16.0",
+		"@gajae-code/utils": "0.16.0",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/adapter-internals/aws-region.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Fail closed before an AWS region is interpolated into a credential-bearing
+ * service authority. Region names are one lowercase ASCII DNS label; dots,
+ * URL delimiters, Unicode, whitespace, and controls must never reach URL
+ * parsing as part of that label.
+ */
+export declare function assertAwsRegionLabel(region: unknown): asserts region is string;

package/src/adapter-internals/aws-region.ts

@@ -0,0 +1,14 @@
+const AWS_REGION_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+
+/**
+ * Fail closed before an AWS region is interpolated into a credential-bearing
+ * service authority. Region names are one lowercase ASCII DNS label; dots,
+ * URL delimiters, Unicode, whitespace, and controls must never reach URL
+ * parsing as part of that label.
+ */
+export function assertAwsRegionLabel(region: unknown): asserts region is string {
+	const match = typeof region === "string" ? AWS_REGION_LABEL.exec(region) : undefined;
+	if (!match || match[0] !== region) {
+		throw new Error("Invalid AWS region: expected a lowercase ASCII DNS label.");
+	}
+}

package/src/auth-storage.ts

@@ -37,6 +37,7 @@ import type {
 	OAuthProvider,
 	OAuthProviderId,
 } from "./utils/oauth/types";
+import { isSqliteError } from "./utils/sqlite-errors";
 
 // ─────────────────────────────────────────────────────────────────────────────
 // Credential Types
@@ -4944,7 +4945,9 @@ export class AuthStorage {
 						!refreshedCredentials.persistedByLease,
 						credentialId,
 					);
-				} catch {}
+				} catch (error) {
+					if (isSqliteError(error)) throw error;
+				}
 			}),
 		);
 
@@ -5408,6 +5411,7 @@ export class AuthStorage {
 			this.#recordSessionCredential(provider, sessionId, "oauth", selection.index);
 			return { apiKey: result.apiKey, credential: updated };
 		} catch (error) {
+			if (isSqliteError(error)) throw error;
 			// Auth-broker errors retain the sanitized upstream body separately from
 			// their transport message. Include that body for failure classification
 			// (the broker's 500 envelope otherwise hides `invalid_grant`) while
@@ -7116,19 +7120,15 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 	}
 
 	updateAuthCredential(id: number, credential: AuthCredential): void {
-		try {
-			const providerRow = this.#db.prepare("SELECT provider FROM auth_credentials WHERE id = ?").get(id) as
-				| { provider?: string }
-				| undefined;
-			const provider = providerRow?.provider ?? "";
-			const serialized = serializeCredential(provider, credential);
-			if (!serialized) return;
-			this.#updateStmt.run(serialized.credentialType, serialized.data, serialized.identityKey, id);
-			if (provider) {
-				this.#purgeSupersededDisabledRows(provider, this.listAuthCredentials(provider));
-			}
-		} catch {
-			// Ignore update failures
+		const providerRow = this.#db.prepare("SELECT provider FROM auth_credentials WHERE id = ?").get(id) as
+			| { provider?: string }
+			| undefined;
+		const provider = providerRow?.provider ?? "";
+		const serialized = serializeCredential(provider, credential);
+		if (!serialized) return;
+		this.#updateStmt.run(serialized.credentialType, serialized.data, serialized.identityKey, id);
+		if (provider) {
+			this.#purgeSupersededDisabledRows(provider, this.listAuthCredentials(provider));
 		}
 	}
 

package/src/core.ts

@@ -40,5 +40,6 @@ export type {
 export * from "./utils/overflow";
 export * from "./utils/retry";
 export * from "./utils/schema";
+export * from "./utils/sqlite-errors";
 export * from "./utils/tool-choice-capability";
 export * from "./utils/validation";

package/src/index.ts

@@ -57,5 +57,6 @@ export * from "./utils/overflow";
 export * from "./utils/provider-safety-stop";
 export * from "./utils/retry";
 export * from "./utils/schema";
+export * from "./utils/sqlite-errors";
 export * from "./utils/tool-choice-capability";
 export * from "./utils/validation";

package/src/model-thinking.ts

@@ -278,6 +278,14 @@ export function applyGeneratedModelPolicies(models: ApiModel<Api>[]): void {
 		if (source.provider === "omlx") {
 			source.reasoning = true;
 		}
+		if (
+			source.provider === "cursor" &&
+			(source.id === "kimi-k3-low" || source.id === "kimi-k3-high" || source.id === "kimi-k3-max")
+		) {
+			// Cursor's GetUsableModels metadata omits numeric context limits for
+			// this family. Keep the measured 1M fallback across regeneration.
+			source.contextWindow = 1_048_576;
+		}
 		const model = refreshModelThinking(source);
 		applyGeneratedModelPolicy(model);
 		models[index] = model;

package/src/models.json

@@ -3853,6 +3853,31 @@
 				"maxLevel": "xhigh"
 			}
 		},
+		"claude-fable-5-1": {
+			"id": "claude-fable-5-1",
+			"name": "Anthropic Fable 5.1",
+			"api": "anthropic-messages",
+			"provider": "anthropic",
+			"baseUrl": "https://api.anthropic.com",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 10,
+				"output": 50,
+				"cacheRead": 0.25,
+				"cacheWrite": 12.5
+			},
+			"contextWindow": 1000000,
+			"maxTokens": 128000,
+			"thinking": {
+				"mode": "anthropic-adaptive",
+				"minLevel": "minimal",
+				"maxLevel": "xhigh"
+			}
+		},
 		"claude-haiku-4-5": {
 			"id": "claude-haiku-4-5",
 			"name": "Anthropic Haiku 4.5 (latest)",
@@ -10900,7 +10925,7 @@
 				"cacheRead": 0,
 				"cacheWrite": 0
 			},
-			"contextWindow": 200000,
+			"contextWindow": 1048576,
 			"maxTokens": 64000
 		},
 		"kimi-k3-low": {
@@ -10919,7 +10944,7 @@
 				"cacheRead": 0,
 				"cacheWrite": 0
 			},
-			"contextWindow": 200000,
+			"contextWindow": 1048576,
 			"maxTokens": 64000
 		},
 		"kimi-k3-max": {
@@ -10938,7 +10963,7 @@
 				"cacheRead": 0,
 				"cacheWrite": 0
 			},
-			"contextWindow": 200000,
+			"contextWindow": 1048576,
 			"maxTokens": 64000
 		}
 	},
@@ -66259,6 +66284,179 @@
 				"minLevel": "minimal",
 				"maxLevel": "xhigh"
 			}
+		},
+		"deepseek-v4-flash-vision-exp": {
+			"id": "deepseek-v4-flash-vision-exp",
+			"name": "DeepSeek V4 Flash Vision Exp",
+			"api": "openai-completions",
+			"provider": "opencode-go",
+			"baseUrl": "https://opencode.ai/zen/go/v1",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 0.22,
+				"output": 0.66,
+				"cacheRead": 0.007,
+				"cacheWrite": 0
+			},
+			"contextWindow": 1000000,
+			"maxTokens": 384000,
+			"thinking": {
+				"mode": "effort",
+				"minLevel": "minimal",
+				"maxLevel": "xhigh"
+			}
+		},
+		"glm-5.3-flash": {
+			"id": "glm-5.3-flash",
+			"name": "GLM-5.3-Flash (2x usage)",
+			"api": "openai-completions",
+			"provider": "opencode-go",
+			"baseUrl": "https://opencode.ai/zen/go/v1",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 0.075,
+				"output": 0.25,
+				"cacheRead": 0.015,
+				"cacheWrite": 0
+			},
+			"contextWindow": 1000000,
+			"maxTokens": 131072,
+			"thinking": {
+				"mode": "effort",
+				"minLevel": "minimal",
+				"maxLevel": "xhigh"
+			}
+		},
+		"grok-4.6": {
+			"id": "grok-4.6",
+			"name": "Grok 4.6",
+			"api": "openai-responses",
+			"provider": "opencode-go",
+			"baseUrl": "https://opencode.ai/zen/go/v1",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 2,
+				"output": 6,
+				"cacheRead": 0.5,
+				"cacheWrite": 0
+			},
+			"contextWindow": 500000,
+			"maxTokens": 500000,
+			"thinking": {
+				"mode": "effort",
+				"minLevel": "minimal",
+				"maxLevel": "xhigh"
+			}
+		},
+		"hy4-preview": {
+			"id": "hy4-preview",
+			"name": "Hy4 preview",
+			"api": "openai-completions",
+			"provider": "opencode-go",
+			"baseUrl": "https://opencode.ai/zen/go/v1",
+			"reasoning": true,
+			"input": [
+				"text"
+			],
+			"cost": {
+				"input": 0.834,
+				"output": 2.501,
+				"cacheRead": 0.042,
+				"cacheWrite": 0
+			},
+			"contextWindow": 1024000,
+			"maxTokens": 64000,
+			"thinking": {
+				"mode": "effort",
+				"minLevel": "minimal",
+				"maxLevel": "xhigh"
+			}
+		},
+		"longcat-2.0": {
+			"id": "longcat-2.0",
+			"name": "LongCat-2.0",
+			"api": "openai-completions",
+			"provider": "opencode-go",
+			"baseUrl": "https://opencode.ai/zen/go/v1",
+			"reasoning": true,
+			"input": [
+				"text"
+			],
+			"cost": {
+				"input": 0.3,
+				"output": 1.2,
+				"cacheRead": 0.006,
+				"cacheWrite": 0
+			},
+			"contextWindow": 1000000,
+			"maxTokens": 131072,
+			"thinking": {
+				"mode": "effort",
+				"minLevel": "minimal",
+				"maxLevel": "xhigh"
+			}
+		},
+		"muse-spark-1.2-contributor": {
+			"id": "muse-spark-1.2-contributor",
+			"name": "Muse Spark 1.2 Contributor",
+			"api": "openai-responses",
+			"provider": "opencode-go",
+			"baseUrl": "https://opencode.ai/zen/go/v1",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 0.1,
+				"output": 0.2,
+				"cacheRead": 0.002,
+				"cacheWrite": 0
+			},
+			"contextWindow": 1048576,
+			"maxTokens": 131072,
+			"thinking": {
+				"mode": "effort",
+				"minLevel": "minimal",
+				"maxLevel": "xhigh"
+			}
+		},
+		"qwen3.8-flash": {
+			"id": "qwen3.8-flash",
+			"name": "Qwen3.8 Flash",
+			"api": "anthropic-messages",
+			"provider": "opencode-go",
+			"baseUrl": "https://opencode.ai/zen/go",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 0.15,
+				"output": 0.47,
+				"cacheRead": 0.016,
+				"cacheWrite": 0.2
+			},
+			"contextWindow": 1000000,
+			"maxTokens": 131072,
+			"thinking": {
+				"mode": "budget",
+				"minLevel": "minimal",
+				"maxLevel": "xhigh"
+			}
 		}
 	},
 	"opencode-zen": {

package/src/provider-models/openai-compat.ts

@@ -2357,11 +2357,15 @@ const OPENCODE_GO_BASE_PATH = "https://opencode.ai/zen/go";
 const OPENCODE_ZEN_API_RESOLUTION = createOpenCodeApiResolution("https://opencode.ai/zen");
 const OPENCODE_GO_CHAT_COMPLETIONS_MODEL_IDS = [
 	"deepseek-v4-flash",
+	"deepseek-v4-flash-vision-exp",
 	"deepseek-v4-pro",
 	"glm-5.1",
 	"glm-5.2",
+	"glm-5.3-flash",
 	"kimi-k2.6",
 	"kimi-k2.7-code",
+	"hy4-preview",
+	"longcat-2.0",
 	"mimo-v2.5",
 	"mimo-v2.5-pro",
 ] as const;
@@ -2372,6 +2376,7 @@ const OPENCODE_GO_MESSAGES_MODEL_IDS = [
 	"qwen3.6-plus",
 	"qwen3.7-max",
 	"qwen3.7-plus",
+	"qwen3.8-flash",
 ] as const;
 const OPENCODE_GO_API_OVERRIDES: Readonly<Record<string, Api>> = {
 	...Object.fromEntries(OPENCODE_GO_CHAT_COMPLETIONS_MODEL_IDS.map(id => [id, "openai-completions"])),
@@ -2796,6 +2801,62 @@ const OPENCODE_GO_OFFICIAL_MODELS: Readonly<Record<string, OpenCodeGoOfficialMod
 		reasoning: true,
 		cost: { input: 0.066, output: 0.26, cacheRead: 0.029, cacheWrite: 0 },
 	},
+	"deepseek-v4-flash-vision-exp": {
+		name: "DeepSeek V4 Flash Vision Exp",
+		contextWindow: 1_000_000,
+		maxTokens: 384_000,
+		input: ["text", "image"],
+		reasoning: true,
+		cost: { input: 0.22, output: 0.66, cacheRead: 0.007, cacheWrite: 0 },
+	},
+	"glm-5.3-flash": {
+		name: "GLM-5.3-Flash (2x usage)",
+		contextWindow: 1_000_000,
+		maxTokens: 131_072,
+		input: ["text", "image"],
+		reasoning: true,
+		cost: { input: 0.075, output: 0.25, cacheRead: 0.015, cacheWrite: 0 },
+	},
+	"grok-4.6": {
+		name: "Grok 4.6",
+		contextWindow: 500_000,
+		maxTokens: 500_000,
+		input: ["text", "image"],
+		reasoning: true,
+		cost: { input: 2, output: 6, cacheRead: 0.5, cacheWrite: 0 },
+	},
+	"hy4-preview": {
+		name: "Hy4 preview",
+		contextWindow: 1_024_000,
+		maxTokens: 64_000,
+		input: ["text"],
+		reasoning: true,
+		cost: { input: 0.834, output: 2.501, cacheRead: 0.042, cacheWrite: 0 },
+	},
+	"longcat-2.0": {
+		name: "LongCat-2.0",
+		contextWindow: 1_000_000,
+		maxTokens: 131_072,
+		input: ["text"],
+		reasoning: true,
+		cost: { input: 0.3, output: 1.2, cacheRead: 0.006, cacheWrite: 0 },
+	},
+	"muse-spark-1.2-contributor": {
+		name: "Muse Spark 1.2 Contributor",
+		contextWindow: 1_048_576,
+		maxTokens: 131_072,
+		input: ["text", "image"],
+		reasoning: true,
+		cost: { input: 0.1, output: 0.2, cacheRead: 0.002, cacheWrite: 0 },
+	},
+	"qwen3.8-flash": {
+		name: "Qwen3.8 Flash",
+		contextWindow: 1_000_000,
+		maxTokens: 131_072,
+		input: ["text", "image"],
+		reasoning: true,
+		cost: { input: 0.15, output: 0.47, cacheRead: 0.016, cacheWrite: 0.2 },
+	},
 };
 
 function applyOpenCodeGoOfficialMetadata<TApi extends Api>(model: Model<TApi>): Model<TApi> {

package/src/providers/amazon-bedrock.ts

@@ -8,6 +8,7 @@
  */
 
 import { $credentialEnv, $env, $flag, extractHttpStatusFromError, fetchWithRetry } from "@gajae-code/utils";
+import { assertAwsRegionLabel } from "../adapter-internals/aws-region";
 import type { Effort } from "../model-thinking";
 import {
 	mapEffortToAnthropicAdaptiveEffort,
@@ -202,9 +203,10 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 
 		const blocks = output.content as Block[];
 		let rawRequestDump: RawHttpRequestDump | undefined;
-		const region = options.region || $env.AWS_REGION || $env.AWS_DEFAULT_REGION || "us-east-1";
+		const region = options.region ?? $env.AWS_REGION ?? $env.AWS_DEFAULT_REGION ?? "us-east-1";
 
 		try {
+			assertAwsRegionLabel(region);
 			const cacheRetention = resolveCacheRetention(options.cacheRetention);
 			const resolvedToolChoice = resolveToolChoice(model, options.toolChoice);
 			const toolConfig = convertToolConfig(context.tools, resolvedToolChoice.resolvedChoice);
@@ -303,6 +305,7 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 					method: "POST",
 					headers: await buildRequestHeaders(retryBody),
 					body: retryBody,
+					redirect: "error",
 					signal: options.signal,
 					maxAttempts: 1,
 				});
@@ -312,6 +315,7 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 				method: "POST",
 				headers: requestHeaders,
 				body,
+				redirect: "error",
 				signal: options.signal,
 				maxAttempts: resolveRetryBudget(options.requestMaxRetries, 4) + 1,
 			});

package/src/providers/anthropic.d.ts

@@ -107,7 +107,7 @@ export interface CpaToolAliasRestoreFailure {
  */
 export declare function parseCpaToolAliasRestoreFailure(error: unknown): CpaToolAliasRestoreFailure | undefined;
 export declare function isCpaToolAliasRestoreFailure(error: unknown): boolean;
-export declare const claudeCodeVersion = "2.1.219";
+export declare const claudeCodeVersion = "2.1.257";
 export declare const claudeCodeEntrypoint = "sdk-cli";
 export declare const claudeToolPrefix: string;
 export declare const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";

package/src/providers/anthropic.ts

@@ -828,7 +828,7 @@ function getCacheControl(
 }
 
 // Stealth mode: Mimic Anthropic Code headers and tool prefixing.
-export const claudeCodeVersion = "2.1.219";
+export const claudeCodeVersion = "2.1.257";
 export const claudeCodeEntrypoint = "sdk-cli";
 export const claudeToolPrefix: string = "proxy_";
 export const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";