@gajae-code/ai 0.16.0 → 0.16.3

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 ## [Unreleased]
 
+## [0.16.3] - 2026-09-04
+
+## [0.16.2] - 2026-09-04
+
+- OpenAI Codex GPT-5.6 Sol selections now reject a known non-Pro ChatGPT OAuth account before dispatch, instead of allowing a binding that fails later with the provider's raw entitlement error. The same rejection is normalized for HTTP and streaming provider responses with guidance to choose a callable model or use an API-key credential.
+
+## [0.16.1] - 2026-09-03
+
+### Added
+
+- Exported `fetchModelsDevPayload` from `provider-models/openai-compat` and coalesced its downloads. models.dev publishes one catalog document describing every provider, but each models.dev-backed provider downloaded it separately, so a single discovery pass transferred the same payload once per provider (and `packages/coding-agent` kept a second downloader of its own). Downloads are now shared per fetch implementation for a 60s window, failures are not retained, and `coding-agent` model discovery consumes the same fetcher.
+
+- Exported `detectDiscoveredApiFamily` from `utils/discovery/openai-compatible`: infers the wire API family (`anthropic-messages` vs `openai-completions`) for a discovered model on a mixed OpenAI-compatible gateway, using the OpenAI `owned_by` owner first and the model id (`claude-*` vs `gpt-*`/`o1`/`codex`/…) as fallback, returning `undefined` when inconclusive. Consumed by custom-provider auto model discovery in `packages/coding-agent`.
+
+### Fixed
+
+- Antigravity discovery now keeps mid-rollout models that the backend marks `isInternal` when the same response surfaces them through `agentModelSorts`. Internal models absent from the IDE's surfaced model groups remain hidden, and denylisted or retired selectors still take precedence.
+- Tokenless loopback auth-broker requests carrying a browser `Origin` header are now rejected before credential reads or mutations. Native loopback clients without `Origin`, authenticated browser-origin clients, and the public health endpoint retain their existing behavior.
+- `glm-zcode` login instructions now warn users who have the ZCode desktop app installed to cancel the browser's `zcode://` open prompt. The app exchanges the single-use authorization code itself, so a code pasted afterwards is rejected by the broker (`500 {"code":2007}`) and the documented paste flow failed without explanation.
+
+- Cursor sessions now report prompt tokens instead of zero. `ConversationTokenDetails.used_tokens` counts the whole conversation, but the checkpoint handler assigned it to `usage.output` and returned early whenever token deltas had been seen — which is the normal streaming path — so `usage.input`, `usage.cacheRead`, and `usage.cacheWrite` were left at their zero initializers for every cursor request. `calculatePromptTokens` therefore fell through to its output-only fallback, so the context indicator tracked the last response's output size rather than the conversation, and automatic compaction never observed a full context. Conversation usage is now recorded through the stream and split into prompt and output tokens when the stream finalizes.
+
+- OAuth callback responses now serialize provider-controlled result fields as safe JSON script data, preventing callback values from terminating the embedded state element while preserving exact JSON values and callback behavior.
+
 ## [0.16.0] - 2026-09-02
 
 ### Added

package/dist/types/provider-models/openai-compat.d.ts

@@ -23,6 +23,7 @@ export interface ModelsDevModel {
         npm?: string;
     };
 }
+export declare function fetchModelsDevPayload(fetchImpl?: typeof fetch): Promise<unknown>;
 export interface OpenAIModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;

package/dist/types/providers/cursor.d.ts

@@ -1,8 +1,9 @@
 import { type JsonValue } from "@bufbuild/protobuf";
-import type { CursorExecHandlerResult, CursorExecHandlers, CursorToolResultHandler, Message, Model, StreamFunction, StreamOptions, ToolCall, ToolResultMessage } from "../types";
+import type { AssistantMessage, CursorExecHandlerResult, CursorExecHandlers, CursorToolResultHandler, Message, Model, StreamFunction, StreamOptions, ToolCall, ToolResultMessage, Usage } from "../types";
 import { kCursorExecResolved } from "../utils/block-symbols";
 import { CURSOR_CLIENT_VERSION } from "./cursor/client-version";
 import type { CursorRule, RequestedModel_ModelParameterbytes } from "./cursor/gen/agent_pb";
+import { type ConversationStateStructure } from "./cursor/gen/agent_pb";
 export declare const CURSOR_API_URL = "https://api2.cursor.sh";
 export { CURSOR_CLIENT_VERSION };
 /** Drop all cached state + blob bytes for a conversation (F15 bound + session-teardown hook). */
@@ -31,6 +32,19 @@ type ToolCallState = ToolCall & {
     kind: "mcp" | "todo_write" | "native" | "cursor-exec";
     [kCursorExecResolved]?: true;
 };
+interface UsageState {
+    sawTokenDelta: boolean;
+    /**
+     * Latest `ConversationTokenDetails.used_tokens`: the whole conversation's
+     * token consumption as counted by Cursor, not this turn's output.
+     */
+    conversationUsedTokens: number;
+    /** Output tokens already included in the latest checkpoint snapshot. */
+    checkpointOutputTokens: number;
+    /** Whether the current stream received a checkpoint, including an explicit zero. */
+    hasConversationCheckpoint: boolean;
+    pendingCheckpoint?: ConversationStateStructure;
+}
 /** Exported for tests: verifies handler is invoked with correct `this` when passed as bound. */
 export declare function resolveExecHandler<TArgs, TResult>(args: TArgs, handler: ((args: TArgs) => Promise<CursorExecHandlerResult<TResult>>) | undefined, onToolResult: CursorToolResultHandler | undefined, buildFromToolResult: (toolResult: ToolResultMessage) => TResult, buildRejected: (reason: string) => TResult, buildError: (error: string) => TResult): Promise<{
     execResult: TResult;
@@ -44,6 +58,18 @@ export declare function createCursorMessageQueueForTest(onError?: (error: unknow
 /** Exported for direct regression coverage of the JSON-safety boundary. */
 export declare function cursorJsonSafeValueForTest(value: unknown): unknown;
 export declare function buildNativeToolCallBlock(toolCall: Record<string, unknown>, callId: string, index: number): ToolCallState | null;
+/**
+ * Cursor streams output tokens as deltas and reports whole-conversation
+ * consumption separately as `ConversationTokenDetails.used_tokens`. Derive
+ * prompt tokens from the difference so context accounting and compaction see a
+ * real prompt size instead of zero.
+ */
+export declare function finalizeCursorUsage(output: AssistantMessage, usageState: UsageState): void;
+/** Exposes {@link finalizeCursorUsage} for tests without a live HTTP/2 stream. */
+export declare function finalizeCursorUsageForTest(usedTokens: number, outputTokens: number, options?: {
+    checkpointOutputTokens?: number;
+    hasConversationCheckpoint?: boolean;
+}): Usage;
 /**
  * Build `ConversationStateStructure.rootPromptMessagesJson` blob IDs for the
  * system prompt plus prior conversation history, as JSON blobs matching

package/dist/types/utils/codex-entitlement.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Model entitlement facts shared by Codex credential selection and provider
+ * error presentation.
+ *
+ * GPT-5.6 Sol is a Pro-tier ChatGPT Codex model. The usage endpoint is the
+ * authority for the account tier; this module only names the model policy and
+ * keeps the provider's deterministic rejection wording in one place.
+ */
+export declare function requiresOpenAICodexProModel(provider: string, modelId: string | undefined): boolean;
+export declare function requiresStrictOpenAICodexProModel(provider: string, modelId: string | undefined): boolean;
+export declare function isOpenAICodexChatGPTEntitlementError(message: string | undefined, code?: string): boolean;
+export declare function formatOpenAICodexChatGPTEntitlementError(modelId: string | undefined): string;

package/dist/types/utils/discovery/openai-compatible.d.ts

@@ -1,6 +1,27 @@
 import type { Api, FetchImpl, Model, Provider } from "../../types";
 /** Catalog identities are rendered and used for routing; unsafe values are dropped, never rewritten. */
 export declare function isSafeCatalogModelId(value: unknown): value is string;
+/**
+ * The two wire families a mixed OpenAI-compatible gateway (e.g. CLIProxyAPI)
+ * can front. A gateway exposes an OpenAI-shaped `/v1/models` catalog but may
+ * proxy Anthropic models that must be driven through the Anthropic Messages
+ * transport rather than OpenAI Chat Completions.
+ */
+export type DiscoveredApiFamily = "anthropic-messages" | "openai-completions";
+/**
+ * Infer the wire API family for one discovered model on a mixed
+ * OpenAI-compatible gateway.
+ *
+ * Uses the `owned_by` owner string first (authoritative when the gateway
+ * populates it — `"anthropic"` / `"openai"`), then falls back to the model id
+ * (`claude-*` → Anthropic, `gpt-*`/`o1`/`codex`/… → OpenAI). Returns
+ * `undefined` when neither signal is conclusive so the caller can keep the
+ * provider-level default instead of guessing.
+ */
+export declare function detectDiscoveredApiFamily(entry: {
+    id?: unknown;
+    owned_by?: unknown;
+}): DiscoveredApiFamily | undefined;
 /**
  * Minimal OpenAI-style model entry shape consumed by discovery.
  *

package/dist/types/utils/h2-fetch.d.ts

@@ -14,6 +14,13 @@
  * or `ConnectionClosed` rather than `HTTP2Unsupported`, so we treat those
  * codes as h2-fallback triggers as well.
  *
+ * ALPN-refusing hosts (notably zcode.z.ai, the GLM ZCode OAuth broker) abort
+ * the TLS handshake entirely when the client offers ALPN h2. Bun reports that
+ * abort as `UNKNOWN_CERTIFICATE_VERIFICATION_ERROR` even though the host's
+ * certificate chain verifies fine over h1 (issue #5178), so that code is a
+ * fallback trigger too — never a reason to accept a bad certificate: the h1
+ * attempt below performs full verification on its own.
+ *
  * Bun negotiates h2 via ALPN over TLS only (no h2c), so plain `http://` URLs
  * skip the attempt entirely — avoids the throw/retry round-trip for localhost.
  *

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.16.0",
+	"version": "0.16.3",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,8 +40,8 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/natives": "0.16.0",
-		"@gajae-code/utils": "0.16.0",
+		"@gajae-code/natives": "0.16.3",
+		"@gajae-code/utils": "0.16.3",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-broker/server.ts

@@ -11,7 +11,7 @@
  */
 import * as crypto from "node:crypto";
 import { logger } from "@gajae-code/utils";
-import { timingSafeEqual } from "../auth-gateway/http";
+import { isNoAuthBrowserOriginRequest, timingSafeEqual } from "../auth-gateway/http";
 import type { AuthStorage } from "../auth-storage";
 import type { Provider } from "../types";
 import { assertAuthenticatedOrLoopback, parseBind } from "../utils/parse-bind";
@@ -594,6 +594,15 @@ export function startAuthBroker(opts: AuthBrokerServerOptions): AuthBrokerServer
 					const body: HealthzResponse = { ok: true, version };
 					return json(200, body);
 				}
+				if (isNoAuthBrowserOriginRequest(req, tokens)) {
+					logger.info("auth-broker no-auth browser-origin request rejected", {
+						method: req.method,
+						path: pathname,
+						peer,
+						originPresent: true,
+					});
+					return json(403, { error: "no-auth rejects requests carrying Origin" });
+				}
 				if (!isAuthorized(req, tokens)) {
 					logger.info("auth-broker request unauthorized", { method: req.method, path: pathname, peer });
 					return json(401, { error: "unauthorized" });

package/src/auth-storage.ts

@@ -26,6 +26,11 @@ import type {
 	UsageReport,
 } from "./usage";
 
+import {
+	formatOpenAICodexChatGPTEntitlementError,
+	requiresOpenAICodexProModel,
+	requiresStrictOpenAICodexProModel,
+} from "./utils/codex-entitlement";
 import { getOAuthApiKey, getOAuthProvider, refreshOAuthToken, resolveOAuthStorageProvider } from "./utils/oauth";
 import { loginDeepInfra } from "./utils/oauth/deepinfra";
 import { loginDeepSeek } from "./utils/oauth/deepseek";
@@ -1140,10 +1145,6 @@ export function readBrokerErrorBody(error: unknown): string | undefined {
 	}
 }
 
-function requiresOpenAICodexProModel(provider: string, modelId: string | undefined): boolean {
-	return provider === "openai-codex" && typeof modelId === "string" && modelId.includes("-spark");
-}
-
 function getUsagePlanType(report: UsageReport | null): string | undefined {
 	const metadata = report?.metadata;
 	if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) return undefined;
@@ -4955,6 +4956,19 @@ export class AuthStorage {
 		// non-Pro accounts can still attempt Spark requests (e.g. trial/grandfathered access).
 		const enforceProRequirement =
 			requiresProModel && candidates.some(candidate => hasOpenAICodexProPlan(candidate.usage));
+		// Spark retains its historical Plus fallback for grandfathered accounts.
+		// Sol is different: a confirmed non-Pro plan cannot call it, so reject the
+		// model before returning an OAuth bearer and letting the turn fail remotely.
+		const strictProRequirement = requiresStrictOpenAICodexProModel(provider, options?.modelId);
+		if (
+			strictProRequirement &&
+			candidates.length > 0 &&
+			candidates.every(
+				candidate => getUsagePlanType(candidate.usage) !== undefined && !hasOpenAICodexProPlan(candidate.usage),
+			)
+		) {
+			throw new Error(formatOpenAICodexChatGPTEntitlementError(options?.modelId));
+		}
 
 		const fallback = candidates[0];
 

package/src/provider-models/openai-compat.ts

@@ -59,15 +59,39 @@ function toInputCapabilities(value: unknown): ("text" | "image")[] {
 	return supportsImage ? ["text", "image"] : ["text"];
 }
 
-async function fetchModelsDevPayload(fetchImpl: typeof fetch = fetch): Promise<unknown> {
-	const response = await fetchImpl(MODELS_DEV_URL, {
-		method: "GET",
-		headers: { Accept: "application/json" },
-	});
-	if (!response.ok) {
-		throw new Error(`models.dev fetch failed: ${response.status}`);
+/**
+ * models.dev serves one catalog document describing every provider, and a
+ * discovery pass resolves several providers from it. Downloads are coalesced
+ * per fetch implementation so one pass transfers the catalog once instead of
+ * once per provider; the window is short enough that a later refresh still
+ * observes catalog updates.
+ */
+const MODELS_DEV_PAYLOAD_TTL_MS = 60_000;
+const modelsDevPayloadCache = new WeakMap<typeof fetch, { at: number; payload: Promise<unknown> }>();
+
+export async function fetchModelsDevPayload(fetchImpl: typeof fetch = fetch): Promise<unknown> {
+	const now = Date.now();
+	const cached = modelsDevPayloadCache.get(fetchImpl);
+	if (cached && now - cached.at < MODELS_DEV_PAYLOAD_TTL_MS) return cached.payload;
+	const payload = (async () => {
+		const response = await fetchImpl(MODELS_DEV_URL, {
+			method: "GET",
+			headers: { Accept: "application/json" },
+			signal: AbortSignal.timeout(5_000),
+		});
+		if (!response.ok) {
+			throw new Error(`models.dev fetch failed: ${response.status}`);
+		}
+		return (await response.json()) as unknown;
+	})();
+	const entry = { at: now, payload };
+	modelsDevPayloadCache.set(fetchImpl, entry);
+	try {
+		return await payload;
+	} catch (error) {
+		if (modelsDevPayloadCache.get(fetchImpl) === entry) modelsDevPayloadCache.delete(fetchImpl);
+		throw error;
 	}
-	return response.json();
 }
 
 function anthropicToolChoiceCompat(modelId: string): Pick<Model<"anthropic-messages">, "compat"> {

package/src/providers/cursor.d.ts

@@ -1,8 +1,9 @@
 import { type JsonValue } from "@bufbuild/protobuf";
-import type { CursorExecHandlerResult, CursorExecHandlers, CursorToolResultHandler, Message, Model, StreamFunction, StreamOptions, ToolCall, ToolResultMessage } from "../types";
+import type { AssistantMessage, CursorExecHandlerResult, CursorExecHandlers, CursorToolResultHandler, Message, Model, StreamFunction, StreamOptions, ToolCall, ToolResultMessage, Usage } from "../types";
 import { kCursorExecResolved } from "../utils/block-symbols";
 import { CURSOR_CLIENT_VERSION } from "./cursor/client-version";
 import type { CursorRule, RequestedModel_ModelParameterbytes } from "./cursor/gen/agent_pb";
+import { type ConversationStateStructure } from "./cursor/gen/agent_pb";
 export declare const CURSOR_API_URL = "https://api2.cursor.sh";
 export { CURSOR_CLIENT_VERSION };
 /** Drop all cached state + blob bytes for a conversation (F15 bound + session-teardown hook). */
@@ -31,6 +32,19 @@ type ToolCallState = ToolCall & {
     kind: "mcp" | "todo_write" | "native" | "cursor-exec";
     [kCursorExecResolved]?: true;
 };
+interface UsageState {
+    sawTokenDelta: boolean;
+    /**
+     * Latest `ConversationTokenDetails.used_tokens`: the whole conversation's
+     * token consumption as counted by Cursor, not this turn's output.
+     */
+    conversationUsedTokens: number;
+    /** Output tokens already included in the latest checkpoint snapshot. */
+    checkpointOutputTokens: number;
+    /** Whether the current stream received a checkpoint, including an explicit zero. */
+    hasConversationCheckpoint: boolean;
+    pendingCheckpoint?: ConversationStateStructure;
+}
 /** Exported for tests: verifies handler is invoked with correct `this` when passed as bound. */
 export declare function resolveExecHandler<TArgs, TResult>(args: TArgs, handler: ((args: TArgs) => Promise<CursorExecHandlerResult<TResult>>) | undefined, onToolResult: CursorToolResultHandler | undefined, buildFromToolResult: (toolResult: ToolResultMessage) => TResult, buildRejected: (reason: string) => TResult, buildError: (error: string) => TResult): Promise<{
     execResult: TResult;
@@ -44,6 +58,18 @@ export declare function createCursorMessageQueueForTest(onError?: (error: unknow
 /** Exported for direct regression coverage of the JSON-safety boundary. */
 export declare function cursorJsonSafeValueForTest(value: unknown): unknown;
 export declare function buildNativeToolCallBlock(toolCall: Record<string, unknown>, callId: string, index: number): ToolCallState | null;
+/**
+ * Cursor streams output tokens as deltas and reports whole-conversation
+ * consumption separately as `ConversationTokenDetails.used_tokens`. Derive
+ * prompt tokens from the difference so context accounting and compaction see a
+ * real prompt size instead of zero.
+ */
+export declare function finalizeCursorUsage(output: AssistantMessage, usageState: UsageState): void;
+/** Exposes {@link finalizeCursorUsage} for tests without a live HTTP/2 stream. */
+export declare function finalizeCursorUsageForTest(usedTokens: number, outputTokens: number, options?: {
+    checkpointOutputTokens?: number;
+    hasConversationCheckpoint?: boolean;
+}): Usage;
 /**
  * Build `ConversationStateStructure.rootPromptMessagesJson` blob IDs for the
  * system prompt plus prior conversation history, as JSON blobs matching

package/src/providers/cursor.ts

@@ -24,6 +24,7 @@ import type {
 	Tool,
 	ToolCall,
 	ToolResultMessage,
+	Usage,
 } from "../types";
 import { normalizeSystemPrompts } from "../utils";
 import { kCursorExecResolved } from "../utils/block-symbols";
@@ -76,6 +77,7 @@ import {
 	type ConversationStateStructure,
 	ConversationStateStructureSchema,
 	ConversationStepSchema,
+	ConversationTokenDetailsSchema,
 	ConversationTurnStructureSchema,
 	CursorRuleSchema,
 	CursorRuleSource,
@@ -175,6 +177,7 @@ export { CURSOR_CLIENT_VERSION };
 
 const conversationStateCache = new Map<string, ConversationStateStructure>();
 const conversationBlobStores = new Map<string, Map<string, Uint8Array>>();
+const conversationUsageContextCache = new Map<string, CursorUsageContext>();
 
 // F15: bound the module-global conversation caches so long-lived / many-session use cannot
 // grow them without limit. LRU by conversation count + TTL on idle conversations.
@@ -186,6 +189,7 @@ const conversationLastAccess = new Map<string, number>();
 export function disposeCursorConversation(conversationId: string): void {
 	conversationStateCache.delete(conversationId);
 	conversationBlobStores.delete(conversationId);
+	conversationUsageContextCache.delete(conversationId);
 	conversationLastAccess.delete(conversationId);
 }
 
@@ -337,9 +341,18 @@ class CursorRequestCoordinator implements CursorRequestWriter {
 
 	admit(taskFactory: () => Promise<void>): void {
 		if (!this.canAdmitTask()) return;
+		this.#admitOrdered(taskFactory, false);
+	}
+
+	admitCheckpoint(taskFactory: () => Promise<void>): Promise<void> {
+		if (this.#state === "failed") return Promise.reject(this.#failure ?? new Error("Cursor request failed"));
+		return this.#admitOrdered(taskFactory, true);
+	}
+
+	#admitOrdered(taskFactory: () => Promise<void>, allowAfterSuccess: boolean): Promise<void> {
 		const orderedTask = this.#hasAdmittedTask
 			? this.#taskChain.then(() => {
-					if (this.#state === "failed" || this.#state === "succeeded") return;
+					if (this.#state === "failed" || (!allowAfterSuccess && this.#state === "succeeded")) return;
 					return taskFactory();
 				})
 			: taskFactory();
@@ -355,6 +368,7 @@ class CursorRequestCoordinator implements CursorRequestWriter {
 			() => this.#tasks.delete(orderedTask),
 			() => this.#tasks.delete(orderedTask),
 		);
+		return orderedTask;
 	}
 
 	turnEnded(): void {
@@ -651,6 +665,9 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 		let onAbort: (() => void) | undefined;
 		let coordinator: CursorRequestCoordinator = undefined!;
 		const baseUrl = model.baseUrl || CURSOR_API_URL;
+		let activeConversationId: string | undefined;
+		let previousConversationState: ConversationStateStructure | undefined;
+		let previousUsageContext: CursorUsageContext | undefined;
 
 		try {
 			const apiKey = options?.apiKey;
@@ -662,16 +679,22 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 			}
 
 			const conversationId = options?.conversationId ?? options?.sessionId ?? crypto.randomUUID();
-			const blobStore = conversationBlobStores.get(conversationId) ?? new Map<string, Uint8Array>();
-			conversationBlobStores.set(conversationId, blobStore);
+			activeConversationId = conversationId;
+			const cachedBlobStore = conversationBlobStores.get(conversationId);
+			const blobStore = new Map(cachedBlobStore);
 			const cachedState = conversationStateCache.get(conversationId);
+			previousConversationState = cachedState;
+			const usageContext = buildCursorUsageContext(context, model, options);
+			previousUsageContext = conversationUsageContextCache.get(conversationId);
+			conversationUsageContextCache.set(conversationId, usageContext);
+			const reusableCachedState =
+				cachedState && canReuseCursorUsageContext(previousUsageContext, usageContext) ? cachedState : undefined;
 			const { requestBytes, conversationState } = buildGrpcRequest(model, context, options, {
 				conversationId,
 				blobStore,
-				conversationState: cachedState,
+				conversationState: reusableCachedState,
 			});
 			conversationStateCache.set(conversationId, conversationState);
-			touchCursorConversation(conversationId);
 			const requestContextTools = buildMcpToolDefinitions(context.tools);
 			const targetUrl = new URL(baseUrl);
 			const proxyUrl = getProxyForUrl(model.provider, targetUrl);
@@ -709,6 +732,28 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 			};
 			let resolveH2: (() => void) | undefined;
 			let rejectH2: ((error: Error) => void) | undefined;
+			const inboundEnd = Promise.withResolvers<void>();
+			let inboundSettled = false;
+			let inboundTimeout: NodeJS.Timeout | undefined;
+			const settleInbound = (error?: Error) => {
+				if (inboundSettled) return;
+				inboundSettled = true;
+				if (inboundTimeout) {
+					clearTimeout(inboundTimeout);
+					inboundTimeout = undefined;
+				}
+				if (error) inboundEnd.reject(error);
+				else inboundEnd.resolve();
+			};
+			void inboundEnd.promise.catch(() => {});
+			const armInboundTimeout = () => {
+				const timeoutMs = options?.streamIdleTimeoutMs ?? 0;
+				if (timeoutMs <= 0 || inboundSettled) return;
+				inboundTimeout = setTimeout(
+					() => settleInbound(new Error("Cursor stream did not reach its inbound terminal frame")),
+					timeoutMs,
+				);
+			};
 			coordinator = new CursorRequestCoordinator(
 				h2Request,
 				stopHeartbeat,
@@ -724,16 +769,32 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 				},
 				options?.streamIdleTimeoutMs ?? getStreamIdleTimeoutMs(),
 			);
-			h2Client.on("error", error => coordinator.fail(error));
-			h2Request.on("error", error => coordinator.fail(error));
+			h2Client.on("error", error => {
+				settleInbound(error);
+				coordinator.fail(error);
+			});
+			h2Request.on("error", error => {
+				settleInbound(error);
+				coordinator.fail(error);
+			});
 
 			stream.push({ type: "start", partial: output });
 
 			let pendingBuffer = Buffer.alloc(0);
+			const checkpointTasks: Promise<void>[] = [];
 			let currentTextBlock: (TextContent & { index: number }) | null = null;
 			let currentThinkingBlock: (ThinkingContent & { index: number }) | null = null;
 			let currentToolCall: ToolCallState | null = null;
-			const usageState: UsageState = { sawTokenDelta: false };
+			const cachedConversationUsedTokens =
+				conversationState.tokenDetails && canReuseCursorUsageContext(previousUsageContext, usageContext)
+					? conversationState.tokenDetails.usedTokens
+					: 0;
+			const usageState: UsageState = {
+				sawTokenDelta: false,
+				conversationUsedTokens: cachedConversationUsedTokens,
+				checkpointOutputTokens: 0,
+				hasConversationCheckpoint: false,
+			};
 
 			const state: BlockState = {
 				get currentTextBlock() {
@@ -763,8 +824,7 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 			};
 
 			const onConversationCheckpoint = (checkpoint: ConversationStateStructure) => {
-				conversationStateCache.set(conversationId, checkpoint);
-				touchCursorConversation(conversationId);
+				usageState.pendingCheckpoint = checkpoint;
 			};
 
 			h2Request.on("trailers", trailers => {
@@ -775,11 +835,18 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 				}
 			});
 			h2Request.on("end", () => {
+				settleInbound();
 				if (!coordinator.hasTurnEnded()) {
 					coordinator.fail(new Error("Cursor stream ended before turnEnded"));
 				}
 			});
+			h2Request.on("close", () => {
+				const error = new Error("Cursor stream closed before inbound completion");
+				if (!inboundSettled) settleInbound(error);
+				coordinator.fail(error);
+			});
 			onAbort = () => {
+				settleInbound(new Error("Request was aborted"));
 				coordinator.fail(new Error("Request was aborted"));
 			};
 			if (options?.signal) {
@@ -813,6 +880,21 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 						const isTurnEnded =
 							serverMessage.message.case === "interactionUpdate" &&
 							serverMessage.message.value.message?.case === "turnEnded";
+						const isConversationCheckpoint = serverMessage.message.case === "conversationCheckpointUpdate";
+						if (isConversationCheckpoint) {
+							checkpointTasks.push(
+								coordinator.admitCheckpoint(() => {
+									handleConversationCheckpointUpdate(
+										serverMessage.message.value as ConversationStateStructure,
+										output,
+										usageState,
+										onConversationCheckpoint,
+									);
+									return Promise.resolve();
+								}),
+							);
+							continue;
+						}
 						// Serialize handlers: exec messages can be asynchronous, and resolving the
 						// request on turnEnded before prior handlers finish loses their responses.
 						if (!coordinator.canAdmitTask()) continue;
@@ -866,6 +948,9 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 					resolve();
 				}
 			});
+			armInboundTimeout();
+			await inboundEnd.promise;
+			await Promise.all(checkpointTasks);
 
 			if (state.currentTextBlock) {
 				const idx = output.content.indexOf(state.currentTextBlock);
@@ -899,6 +984,36 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 				});
 			}
 
+			finalizeCursorUsage(output, usageState);
+			const stateToCommit =
+				usageState.pendingCheckpoint ?? conversationStateCache.get(conversationId) ?? conversationState;
+			if (
+				usageState.pendingCheckpoint ||
+				usageState.hasConversationCheckpoint ||
+				usageState.conversationUsedTokens > 0
+			) {
+				conversationStateCache.set(
+					conversationId,
+					create(ConversationStateStructureSchema, {
+						...stateToCommit,
+						...(usageState.hasConversationCheckpoint || usageState.conversationUsedTokens > 0
+							? {
+									tokenDetails: create(ConversationTokenDetailsSchema, {
+										usedTokens: output.usage.totalTokens,
+										maxTokens: stateToCommit.tokenDetails?.maxTokens ?? 0,
+									}),
+								}
+							: {}),
+					}),
+				);
+				touchCursorConversation(conversationId);
+			}
+			conversationUsageContextCache.set(conversationId, {
+				...usageContext,
+				messageKeys: [...usageContext.messageKeys, hashCursorUsageMessage(output)],
+			});
+			conversationBlobStores.set(conversationId, blobStore);
+			touchCursorConversation(conversationId);
 			calculateCost(model, output.usage);
 
 			output.duration = Date.now() - startTime;
@@ -910,6 +1025,12 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 			});
 			stream.end();
 		} catch (error) {
+			if (activeConversationId) {
+				if (previousConversationState) conversationStateCache.set(activeConversationId, previousConversationState);
+				else conversationStateCache.delete(activeConversationId);
+				if (previousUsageContext) conversationUsageContextCache.set(activeConversationId, previousUsageContext);
+				else conversationUsageContextCache.delete(activeConversationId);
+			}
 			// Keep the completion promise terminal even for synchronous setup/write
 			// failures that may not emit a separate HTTP/2 error event.
 			const mappedError = mapH2TransportError(coordinator?.failureError() ?? error, baseUrl);
@@ -959,6 +1080,24 @@ interface BlockState {
 
 interface UsageState {
 	sawTokenDelta: boolean;
+	/**
+	 * Latest `ConversationTokenDetails.used_tokens`: the whole conversation's
+	 * token consumption as counted by Cursor, not this turn's output.
+	 */
+	conversationUsedTokens: number;
+	/** Output tokens already included in the latest checkpoint snapshot. */
+	checkpointOutputTokens: number;
+	/** Whether the current stream received a checkpoint, including an explicit zero. */
+	hasConversationCheckpoint: boolean;
+	pendingCheckpoint?: ConversationStateStructure;
+}
+
+interface CursorUsageContext {
+	modelKey: string;
+	systemPromptKey: string;
+	customSystemPromptKey: string;
+	toolsKey: string;
+	messageKeys: string[];
 }
 
 async function handleServerMessage(
@@ -2855,17 +2994,58 @@ function handleConversationCheckpointUpdate(
 	onConversationCheckpoint?: (checkpoint: ConversationStateStructure) => void,
 ): void {
 	onConversationCheckpoint?.(checkpoint);
-	if (usageState.sawTokenDelta) {
-		return;
-	}
 	const usedTokens = checkpoint.tokenDetails?.usedTokens ?? 0;
-	if (usedTokens <= 0) {
+	if (!checkpoint.tokenDetails) {
 		return;
 	}
-	if (output.usage.output !== usedTokens) {
-		output.usage.output = usedTokens;
-		output.usage.totalTokens = output.usage.input + output.usage.output;
+	const previousUsedTokens = usageState.conversationUsedTokens;
+	// `used_tokens` counts the whole conversation, so it is prompt-side usage and
+	// must not be attributed to this turn's output. Checkpoints can arrive while
+	// output is still streaming; the split is applied once the stream finalizes.
+	usageState.conversationUsedTokens = usedTokens;
+	usageState.checkpointOutputTokens =
+		usageState.hasConversationCheckpoint && usedTokens < previousUsedTokens ? 0 : output.usage.output;
+	usageState.hasConversationCheckpoint = true;
+}
+
+/**
+ * Cursor streams output tokens as deltas and reports whole-conversation
+ * consumption separately as `ConversationTokenDetails.used_tokens`. Derive
+ * prompt tokens from the difference so context accounting and compaction see a
+ * real prompt size instead of zero.
+ */
+export function finalizeCursorUsage(output: AssistantMessage, usageState: UsageState): void {
+	const used = usageState.conversationUsedTokens;
+	if (!usageState.hasConversationCheckpoint && used <= 0) {
+		return;
 	}
+	const outputIncludedInSnapshot = usageState.hasConversationCheckpoint ? usageState.checkpointOutputTokens : 0;
+	output.usage.input = Math.max(0, used - outputIncludedInSnapshot);
+	output.usage.totalTokens = output.usage.input + output.usage.output;
+}
+
+/** Exposes {@link finalizeCursorUsage} for tests without a live HTTP/2 stream. */
+export function finalizeCursorUsageForTest(
+	usedTokens: number,
+	outputTokens: number,
+	options: { checkpointOutputTokens?: number; hasConversationCheckpoint?: boolean } = {},
+): Usage {
+	const usage: Usage = {
+		input: 0,
+		output: outputTokens,
+		cacheRead: 0,
+		cacheWrite: 0,
+		totalTokens: outputTokens,
+		cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+	};
+	finalizeCursorUsage({ usage } as AssistantMessage, {
+		sawTokenDelta: true,
+		conversationUsedTokens: usedTokens,
+		checkpointOutputTokens:
+			options.checkpointOutputTokens ?? ((options.hasConversationCheckpoint ?? usedTokens > 0) ? outputTokens : 0),
+		hasConversationCheckpoint: options.hasConversationCheckpoint ?? usedTokens > 0,
+	});
+	return usage;
 }
 
 function createBlobId(data: Uint8Array): Uint8Array {
@@ -3188,6 +3368,43 @@ function buildConversationTurns(messages: Message[], blobStore: Map<string, Uint
 	return turns;
 }
 
+function buildCursorUsageContext(
+	context: Context,
+	model: Model<"cursor-agent">,
+	options: CursorOptions | undefined,
+): CursorUsageContext {
+	return {
+		modelKey: hashCursorUsageValue({ provider: model.provider, id: model.id, wireModelId: model.wireModelId }),
+		systemPromptKey: hashCursorUsageValue(context.systemPrompt ?? []),
+		customSystemPromptKey: hashCursorUsageValue(options?.customSystemPrompt ?? ""),
+		toolsKey: hashCursorUsageValue(context.tools ?? []),
+		messageKeys: context.messages.map(message => hashCursorUsageMessage(message)),
+	};
+}
+
+function hashCursorUsageMessage(message: { role: string; content: unknown }): string {
+	return hashCursorUsageValue({ role: message.role, content: message.content });
+}
+
+function hashCursorUsageValue(value: unknown): string {
+	return createHash("sha256")
+		.update(JSON.stringify(value) ?? "")
+		.digest("hex");
+}
+
+function canReuseCursorUsageContext(previous: CursorUsageContext | undefined, current: CursorUsageContext): boolean {
+	if (
+		!previous ||
+		previous.modelKey !== current.modelKey ||
+		previous.systemPromptKey !== current.systemPromptKey ||
+		previous.customSystemPromptKey !== current.customSystemPromptKey ||
+		previous.toolsKey !== current.toolsKey
+	)
+		return false;
+	if (previous.messageKeys.length > current.messageKeys.length) return false;
+	return previous.messageKeys.every((key, index) => key === current.messageKeys[index]);
+}
+
 /** Exported for tests: decodes Cursor history blobs built from conversation messages. */
 export function buildCursorHistoryForTest(messages: Message[]): {
 	rootPromptMessagesJson: unknown[];

package/src/providers/openai-codex-responses.ts

@@ -51,6 +51,10 @@ import {
 	normalizeSystemPrompts,
 	sanitizeOpenAIResponsesHistoryItemsForReplay,
 } from "../utils";
+import {
+	formatOpenAICodexChatGPTEntitlementError,
+	isOpenAICodexChatGPTEntitlementError,
+} from "../utils/codex-entitlement";
 import { AssistantMessageEventStream } from "../utils/event-stream";
 import { STREAM_FIRST_EVENT_TIMEOUT_PROVIDER_CODE, transportFailureFacts } from "../utils/fallback-transport";
 import { finalizeErrorMessage, type RawHttpRequestDump } from "../utils/http-inspector";
@@ -1234,7 +1238,7 @@ function handleCodexStreamEvent(args: {
 	}
 
 	if (eventType === "error" || eventType === "response.failed") {
-		throw createCodexProviderStreamError(rawEvent);
+		throw createCodexProviderStreamError(rawEvent, model.id);
 	}
 
 	return firstTokenTime;
@@ -2853,7 +2857,11 @@ async function openCodexSseEventStream(
 	updateCodexSessionMetadataFromHeaders(state, response.headers);
 	if (!response.ok) {
 		const info = await parseCodexError(response);
-		const error = new Error(info.friendlyMessage || info.message);
+		const error = new Error(
+			isOpenAICodexChatGPTEntitlementError(info.message, info.code)
+				? formatOpenAICodexChatGPTEntitlementError(body.model)
+				: info.friendlyMessage || info.message,
+		);
 		(error as { headers?: Headers; status?: number }).headers = response.headers;
 		(error as { headers?: Headers; status?: number }).status = response.status;
 		(error as { code?: string }).code = info.code;
@@ -3235,11 +3243,12 @@ function isRetryableCodexFailureEvent(rawEvent: Record<string, unknown>): boolea
 	return !!message && CODEX_RETRYABLE_EVENT_MESSAGE.test(message);
 }
 
-function createCodexProviderStreamError(rawEvent: Record<string, unknown>): CodexProviderStreamError {
+function createCodexProviderStreamError(rawEvent: Record<string, unknown>, modelId: string): CodexProviderStreamError {
 	const code = getCodexEventErrorCode(rawEvent);
 	const message = getCodexEventErrorMessage(rawEvent);
-	const formattedMessage =
-		typeof rawEvent.type === "string" && rawEvent.type === "error"
+	const formattedMessage = isOpenAICodexChatGPTEntitlementError(message, code)
+		? formatOpenAICodexChatGPTEntitlementError(modelId)
+		: typeof rawEvent.type === "string" && rawEvent.type === "error"
 			? formatCodexErrorEvent(rawEvent, code, message)
 			: (formatCodexFailure(rawEvent) ?? "Codex response failed");
 	return new CodexProviderStreamError(

package/src/utils/codex-entitlement.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Model entitlement facts shared by Codex credential selection and provider
+ * error presentation.
+ *
+ * GPT-5.6 Sol is a Pro-tier ChatGPT Codex model. The usage endpoint is the
+ * authority for the account tier; this module only names the model policy and
+ * keeps the provider's deterministic rejection wording in one place.
+ */
+export declare function requiresOpenAICodexProModel(provider: string, modelId: string | undefined): boolean;
+export declare function requiresStrictOpenAICodexProModel(provider: string, modelId: string | undefined): boolean;
+export declare function isOpenAICodexChatGPTEntitlementError(message: string | undefined, code?: string): boolean;
+export declare function formatOpenAICodexChatGPTEntitlementError(modelId: string | undefined): string;

package/src/utils/codex-entitlement.ts

@@ -0,0 +1,36 @@
+/**
+ * Model entitlement facts shared by Codex credential selection and provider
+ * error presentation.
+ *
+ * GPT-5.6 Sol is a Pro-tier ChatGPT Codex model. The usage endpoint is the
+ * authority for the account tier; this module only names the model policy and
+ * keeps the provider's deterministic rejection wording in one place.
+ */
+
+export function requiresOpenAICodexProModel(provider: string, modelId: string | undefined): boolean {
+	return (
+		provider === "openai-codex" &&
+		typeof modelId === "string" &&
+		(modelId.toLowerCase().includes("-spark") || modelId.toLowerCase() === "gpt-5.6-sol")
+	);
+}
+
+export function requiresStrictOpenAICodexProModel(provider: string, modelId: string | undefined): boolean {
+	return provider === "openai-codex" && modelId?.toLowerCase() === "gpt-5.6-sol";
+}
+
+export function isOpenAICodexChatGPTEntitlementError(message: string | undefined, code?: string): boolean {
+	return (
+		/\bnot supported when using codex with a chatgpt account\b/i.test(message ?? "") &&
+		(code === undefined || code.toLowerCase() === "invalid_request_error")
+	);
+}
+
+export function formatOpenAICodexChatGPTEntitlementError(modelId: string | undefined): string {
+	const safeModelId = modelId
+		?.replace(/[\x00-\x1f\x7f-\x9f]+/gu, " ")
+		.trim()
+		.slice(0, 128);
+	const model = safeModelId ? ` model "${safeModelId}"` : " model";
+	return `This ChatGPT Codex account cannot use${model}. Select a model available to this ChatGPT account, such as "gpt-5.5", or use an API-key credential that supports the model.`;
+}

package/src/utils/discovery/antigravity.ts

@@ -218,13 +218,22 @@ export async function fetchAntigravityDiscoveryModels(
 			continue;
 		}
 
+		const surfacedModelIds = new Set<string>();
+		for (const sort of parsed.agentModelSorts ?? []) {
+			for (const group of sort.groups ?? []) {
+				for (const modelId of group.modelIds ?? []) {
+					surfacedModelIds.add(modelId);
+				}
+			}
+		}
+
 		const models: Model<"google-gemini-cli">[] = [];
 
 		for (const [modelId, model] of Object.entries(parsed.models ?? {})) {
 			if (ANTIGRAVITY_DISCOVERY_DENYLIST.has(modelId) || isRetiredModelKey(targetProvider, modelId)) {
 				continue;
 			}
-			if (model.isInternal === true) {
+			if (model.isInternal === true && !surfacedModelIds.has(modelId)) {
 				continue;
 			}
 

package/src/utils/discovery/openai-compatible.ts

@@ -52,6 +52,44 @@ export function isSafeCatalogModelId(value: unknown): value is string {
 	);
 }
 
+/**
+ * The two wire families a mixed OpenAI-compatible gateway (e.g. CLIProxyAPI)
+ * can front. A gateway exposes an OpenAI-shaped `/v1/models` catalog but may
+ * proxy Anthropic models that must be driven through the Anthropic Messages
+ * transport rather than OpenAI Chat Completions.
+ */
+export type DiscoveredApiFamily = "anthropic-messages" | "openai-completions";
+
+const ANTHROPIC_OWNER_PATTERN = /\banthropic\b/i;
+const OPENAI_OWNER_PATTERN = /\b(openai|open-ai)\b/i;
+// Anthropic model ids are consistently `claude-*` across every gateway; the
+// `owned_by` owner string is the primary signal and the id is the fallback.
+const ANTHROPIC_MODEL_ID_PATTERN = /(^|[/:])claude[-.]/i;
+const OPENAI_MODEL_ID_PATTERN = /(^|[/:])(gpt[-.]?|o[1-9]|codex|text-|chatgpt|davinci|dall-e|gpt-image|whisper|tts-)/i;
+
+/**
+ * Infer the wire API family for one discovered model on a mixed
+ * OpenAI-compatible gateway.
+ *
+ * Uses the `owned_by` owner string first (authoritative when the gateway
+ * populates it — `"anthropic"` / `"openai"`), then falls back to the model id
+ * (`claude-*` → Anthropic, `gpt-*`/`o1`/`codex`/… → OpenAI). Returns
+ * `undefined` when neither signal is conclusive so the caller can keep the
+ * provider-level default instead of guessing.
+ */
+export function detectDiscoveredApiFamily(entry: {
+	id?: unknown;
+	owned_by?: unknown;
+}): DiscoveredApiFamily | undefined {
+	const owner = typeof entry.owned_by === "string" ? entry.owned_by : "";
+	if (ANTHROPIC_OWNER_PATTERN.test(owner)) return "anthropic-messages";
+	if (OPENAI_OWNER_PATTERN.test(owner)) return "openai-completions";
+	const id = typeof entry.id === "string" ? entry.id : "";
+	if (ANTHROPIC_MODEL_ID_PATTERN.test(id)) return "anthropic-messages";
+	if (OPENAI_MODEL_ID_PATTERN.test(id)) return "openai-completions";
+	return undefined;
+}
+
 /**
  * Minimal OpenAI-style model entry shape consumed by discovery.
  *

package/src/utils/h2-fetch.ts

@@ -14,6 +14,13 @@
  * or `ConnectionClosed` rather than `HTTP2Unsupported`, so we treat those
  * codes as h2-fallback triggers as well.
  *
+ * ALPN-refusing hosts (notably zcode.z.ai, the GLM ZCode OAuth broker) abort
+ * the TLS handshake entirely when the client offers ALPN h2. Bun reports that
+ * abort as `UNKNOWN_CERTIFICATE_VERIFICATION_ERROR` even though the host's
+ * certificate chain verifies fine over h1 (issue #5178), so that code is a
+ * fallback trigger too — never a reason to accept a bad certificate: the h1
+ * attempt below performs full verification on its own.
+ *
  * Bun negotiates h2 via ALPN over TLS only (no h2c), so plain `http://` URLs
  * skip the attempt entirely — avoids the throw/retry round-trip for localhost.
  *
@@ -36,6 +43,9 @@ export function installH2Fetch(): void {
 		"ConnectionRefused", // Server refused the h2 connection
 		"ConnectionReset", // Server reset during h2 handshake
 		"ConnectionClosed", // Server closed before h2 response
+		// Bun's h2 client reports an ALPN-refusing host's TLS abort with this
+		// code; the h1 fallback below re-verifies the certificate itself.
+		"UNKNOWN_CERTIFICATE_VERIFICATION_ERROR",
 	]);
 	const wrapper = async function h2fetch(input: string | URL | Request, init?: RequestInit): Promise<Response> {
 		if (!isHttps(input)) return original(input, init);

package/src/utils/oauth/callback-server.ts

@@ -19,6 +19,13 @@ const DEFAULT_TIMEOUT = 300_000;
 const DEFAULT_HOSTNAME = "localhost";
 const CALLBACK_PATH = "/callback";
 
+function serializeScriptData(value: unknown): string {
+	return JSON.stringify(value)
+		.replaceAll("<", "\\u003c")
+		.replaceAll("\u2028", "\\u2028")
+		.replaceAll("\u2029", "\\u2029");
+}
+
 export type CallbackResult = { code: string; state: string };
 
 export interface OAuthCallbackFlowOptions {
@@ -259,7 +266,7 @@ export abstract class OAuthCallbackFlow {
 		});
 
 		return new Response(
-			(templateHtml as unknown as string).replaceAll("__OAUTH_STATE__", JSON.stringify(resultState)),
+			(templateHtml as unknown as string).replaceAll("__OAUTH_STATE__", () => serializeScriptData(resultState)),
 			{
 				status: resultState.ok ? 200 : 500,
 				headers: { "Content-Type": "text/html" },

package/src/utils/oauth/glm-zcode.ts

@@ -387,7 +387,7 @@ export class GlmZcodeOAuthFlow extends OAuthCallbackFlow {
 		return {
 			url: `${authorizeUrl}?${params.toString()}`,
 			instructions:
-				"Complete Z.AI login in your browser. This is an UNOFFICIAL ZCode-based login — use at your own risk; it may stop working or violate ZCode/Z.AI Terms of Service. Because this CLI cannot receive the zcode:// redirect, paste the final redirect URL or authorization code when prompted.",
+				"Complete Z.AI login in your browser. This is an UNOFFICIAL ZCode-based login — use at your own risk; it may stop working or violate ZCode/Z.AI Terms of Service. Because this CLI cannot receive the zcode:// redirect, paste the final redirect URL or authorization code when prompted. If the ZCode desktop app is installed, cancel the browser's prompt to open it: the app exchanges the single-use code itself and the pasted code is then rejected (broker error 2007).",
 		};
 	}