@gajae-code/ai 0.17.2 → 0.17.5

package/CHANGELOG.md

@@ -2,6 +2,124 @@
 
 ## [Unreleased]
 
+## [0.17.5] - 2026-09-24
+
+### Added
+
+- `packages/ai/src/models.json` was regenerated against models.dev, bundling Claude Opus 5.5 across Anthropic (`claude-opus-5-5`), Bedrock (`anthropic.claude-opus-5-5` plus the `us.`/`eu.`/`au.`/`jp.`/`global.` inference profiles), OpenRouter, Vercel AI Gateway, Kilo, and Venice, alongside the rest of the upstream catalog drift (Grok 4.7, GLM 5.3 variants, Xiaomi MiMo V2.6 Flash/Pro/Pro-Ultraspeed, DeepSeek/Qwen token-plan rows). `VISION_CORRECTED_CLAUDE_OPUS_GENERATIONS` declares generation 5.5 so the new rows pass the Opus vision tripwire instead of silently bypassing the generator correction.
+- Kiro bundles `claude-opus-5.5` (1M input / 128K output, text input only). Kiro's API-key request serializer drops images, so this model does not advertise image support until that transport can serialize them. Kiro's Anthropic model list is hand-maintained in `kiro-api-key.ts` rather than sourced from models.dev, so a regeneration alone left Kiro stranded on Opus 5 while every models.dev-backed provider advanced; the entry follows the existing dual dotted/dashed id convention already used for `claude-opus-4.5` through `4.8`.
+
+### Fixed
+
+- openai-completions treats a `compat.extraBody` `tool_choice` as an endpoint default instead of an override: it fills the gap only on ordinary turns that offer tools and resolved no directive of their own, leaving forced-tool directives and deliberate no-tools turns untouched (strict backends reject `tool_choice` with an empty `tools` list). The default also passes through the provider's existing tool-choice reasoning suppression so endpoint defaults do not bypass compatibility flags.
+
+- Cross-model assistant-history replay now collapses pathological runs of exact consecutive thinking paragraphs into one copy with the exact repeat count, preventing repeated reasoning from inflating custom OpenAI-compatible prompts while preserving stored history, final answers, tool content, and native same-model reasoning (#5805).
+
+- Keep provider evidence stable when the same runtime, configured, or environment API key is resolved.
+
+## [0.17.4] - 2026-09-23
+
+### Added
+
+- The Codex catalog now bundles `gpt-6-sol` and `gpt-6-luna` alongside `gpt-6-astra`, so both models are selectable the day they ship instead of waiting for an upstream `models.dev` refresh. Tiered pricing is declared from the published rates — Sol `$2`/`$10` per 1M (cached input `$0.20`, cached output `$2.50`) and Luna `$0.10`/`$0.50` (cached `$0.01`/`$0.125`) — including the above-272K multipliers (input 2x, output 1.5x).
+
+### Changed
+
+- Updated the Claude Code-compatible `claude-cli` header version to `2.1.280`, matching the published Claude Code npm release so Anthropic does not reject requests carrying a stale client version.
+
+## [0.17.3] - 2026-09-22
+
+### Added
+
+- Alibaba Token Plan now bundles `deepseek-v4.1-flash`, `deepseek-v4-pro-0813`, and `glm-5.3` with the reviewed sibling envelopes (DeepSeek V4 1M/384K, GLM 1M/128K) and low/high/max reasoning efforts, so Token Plan subscribers can select the current Model Studio IDs without waiting for authenticated catalog discovery.
+
+### Fixed
+
+- Stop a runaway reasoning stream instead of rendering every repeat. When an
+  openai-compatible model falls into a decode loop and emits the same line — or
+  the same short token run — 12 times in a row on the reasoning channel, the turn
+  is now cut short with `stopReason: "error"` and
+  `errorCode: "repetition_guard_tripped"` rather than dumping dozens of identical
+  lines into the terminal. Tool calls in the same message still stream and
+  execute normally, including ones the model emits *after* the repeats.
+
+  The stop is classified as a provider error rather than `aborted`, so the auth
+  gateway renders it as HTTP 502 `upstream_error` and telemetry no longer counts
+  it as a user cancellation. A genuine caller abort still wins and still reports
+  `aborted`. The trip is terminal and is not auto-retried: a decode loop is
+  deterministic for the submitted context, so replaying it would re-trip the
+  guard and re-bill the full context on every attempt.
+
+  The guard applies to the reasoning channel only. Visible text is opt-in via the
+  new `repetitionGuard` option (`{ thinking?: number | false; text?: number |
+  false }`), because visible output is a deliverable and intentional repetition
+  there — log dumps, fixtures, tables, generated code — must survive byte for
+  byte.
+- Keep a provider stall or transport error that lands *after* a repetition trip
+  classified as what it actually is. The guard drains the stream briefly after
+  tripping, and a fault arriving inside that window was being reported as a
+  decode loop — discarding the real error message, `errorStatus` and
+  `transportFailure`, and marking a retryable provider fault as terminal. The
+  guard's own abort is now tracked explicitly, so only it claims the trip.
+- Keep the repeated sample out of error payloads. The guard's `errorMessage`
+  interpolated the repeated unit, the channel and the repeat count, and the auth
+  gateway forwards `errorMessage` to API clients on the streaming path — so raw
+  model output was published verbatim, and a repeated `quota` or `forbidden` in
+  the sample could steer the HTTP status the gateway picked. The message is now
+  a fixed literal at the provider, the gateway substitutes the same bounded
+  envelope its non-streaming path already used, and the sample survives only in
+  local `logger.debug` diagnostics.
+- Classify a runaway turn whose final repeat arrives without a trailing newline.
+  The guard closed a line only on `\n` and a token only on whitespace, so a
+  stream that ended mid-unit left the last copy uncounted and the turn reported a
+  healthy completion. The guard is now finalized at end of stream — on the
+  normal-completion path only, so a stream that threw mid-repeat still keeps its
+  own transport facts.
+- Bound the post-trip drain on *every* consumed chunk. The drain budget was only
+  spent by chunks that carried a usable `choices[0]`; usage-only, keepalive-shaped,
+  `choices`-less and malformed frames skipped the check entirely, so a provider
+  answering a tripped stream with those frames held the request open with no
+  bound at all. The check now runs exactly once per consumed chunk, still after
+  that chunk is fully processed so late tool-call frames are never cut mid-flight.
+- Make `repetitionGuard` reachable from the public API. The option existed only
+  on the openai-completions provider type and was dropped by the
+  `streamSimple`/`completeSimple` options mapping, so callers on the normal path
+  could neither disable a channel nor change its threshold. It is now part of
+  `SimpleStreamOptions` (as the shared `RepetitionGuardOptions` type) and is
+  forwarded to the transport; defaults and semantics are unchanged.
+- Validate the repetition threshold before it sizes the guard's state. Now that
+  `repetitionGuard` is public, a caller could pass `NaN` — which made every
+  comparison false and silently disabled detection with no error — or `Infinity`
+  or a huge value, which left detection permanently off *and* made the guard's
+  token retention unbounded on a long stream. A fractional threshold was also
+  never reached exactly by an integer repeat counter. The threshold is now
+  normalized at the constructor: non-finite values fall back to the default,
+  fractions are floored, and the result is clamped into `[2,
+  MAX_REPETITION_THRESHOLD]`, so tracking capacity is finite by construction.
+  Bad input normalizes rather than throwing — a failed request would be worse
+  than the guard running at its default.
+- Stop persisting raw repeated model output in the default logs. The trip
+  diagnostic logged the repeated sample, and the default log transport is a
+  rotating file that JSON-stringifies metadata verbatim with no redaction, so a
+  model that looped on a secret or a private fragment of the prompt wrote it to
+  disk and into log rotation, support bundles and backups. The diagnostic now
+  carries bounded, derived metadata only (`sampleLength`, a number). The sample
+  remains on the in-memory trip object for callers.
+- Strip leaked chat-template tool fences (`<|tool_call_end|>` and friends) from
+  rendered thinking, including fences split across streaming chunk boundaries.
+  The visible text channel is deliberately untouched, so a fence token the
+  assistant mentions in prose still survives as text.
+
+- Serialize BigInt values safely at every Cursor payload and conversation-identity boundary without dropping generic tool-schema fields or truncating large schemas and contexts.
+
+- Track the current Claude Code release in the spoofed version constant (`2.1.273` → `2.1.278`). A stale `claude-cli/<version>` is rejected by the model with an HTTP 400, so the constant is not cosmetic. The daily spoofed-version drift guard had been red since 2026-09-16.
+
+- Preserve observed HTTP/2 reset and native error codes on Cursor failures without mutating native errors or replacing the first terminal diagnostic.
+
+### Performance
+
+- Drain completion-only stream events instead of retaining them, close idle-iterator sources once on early exit, and avoid repeated suffix scans in escape-dense JSON.
+
 ## [0.17.2] - 2026-09-18
 
 ### Added

package/dist/types/auth-gateway/server.d.ts

@@ -18,7 +18,7 @@
  *   POST /v1/responses                     → OpenAI Responses in/out
  */
 import type { AuthStorage } from "../auth-storage";
-import type { Api, AssistantMessageEventStream, Model, Provider, SimpleStreamOptions } from "../types";
+import type { Api, AssistantMessage, AssistantMessageEventStream, Model, Provider, SimpleStreamOptions } from "../types";
 import type { AuthGatewayServerHandle, AuthGatewayServerOptions, AuthGatewayParsedRequest as ParsedFormatRequest } from "./types";
 export type ModelResolver = (modelId: string) => Model<Api> | undefined;
 export interface AuthGatewayBootOptions extends AuthGatewayServerOptions {
@@ -68,5 +68,27 @@ export declare function createAuthGatewayModelCatalog(provider: Provider, models
 export declare function releaseGatewayCredentialLeaseOnAdmission(events: Pick<AssistantMessageEventStream, "result">, release: () => void, signal?: AbortSignal): void;
 /** Test seam for verifying translated gateway requests never acquire agent-owned provider identity. */
 export declare function buildAuthGatewayStreamOptionsForTest(parsed: ParsedFormatRequest, api: Api): SimpleStreamOptions;
+/**
+ * Classify a terminal {@link AssistantMessage} that failed into a wire envelope.
+ *
+ * Shared by both non-streaming handlers so a repetition stop cannot be reported
+ * as a client cancellation on one path and an upstream error on the other.
+ * Exported for tests.
+ */
+export declare function classifyGatewayMessageFailure(message: Pick<AssistantMessage, "stopReason" | "errorCode">, safeErrorMessage: string): {
+    status: number;
+    type: string;
+    message: string;
+};
+/**
+ * Protect all gateway SSE encoders from upstream error text. Provider wire
+ * modules format `error` events themselves, so sanitize at this boundary and
+ * also convert iterator failures to bounded errors before their catch blocks.
+ *
+ * Exported for tests: this is the only place the streaming path scrubs error
+ * text, so the assertion that a repetition sample never reaches the wire has to
+ * drive it directly.
+ */
+export declare function redactGatewayStream(events: AssistantMessageEventStream): AssistantMessageEventStream;
 export declare function startAuthGateway(opts: AuthGatewayBootOptions): AuthGatewayServerHandle;
 export declare function isSafeProviderScope(provider: unknown): provider is string;

package/dist/types/auth-storage.d.ts

@@ -292,6 +292,10 @@ export interface AuthCredentialStore {
         includeExpired?: boolean;
     }): string | null;
     setCache(key: string, value: string, expiresAtSec: number): void;
+    /** Atomically claim a cross-process usage poll lease for a bounded interval. */
+    tryAcquireUsageFetchLease?(key: string, owner: string, nowMs: number, leaseMs: number): boolean | undefined;
+    /** Release a usage poll lease owned by this process. */
+    releaseUsageFetchLease?(key: string, owner: string): void;
     /** Atomically allocate a durable sequence for broker restart epochs. */
     allocateMonotonicSequence(key: string, expiresAtSec: number): number;
     deleteCachePrefix?(prefix: string): void;
@@ -856,10 +860,15 @@ export declare class AuthStorage {
     fetchUsageReports(options?: {
         provider?: Provider;
         baseUrlResolver?: (provider: Provider) => string | undefined;
-        /** Caller's cancel signal; only rejects this caller, never the shared upstream fetch. */
+        /** Caller’s cancel signal; only rejects this caller, never the shared upstream fetch. */
         signal?: AbortSignal;
         /** Disable provider/account/error logging for secret-safe control surfaces. */
         logDetails?: boolean;
+        /**
+         * Enable identity correlation diagnostics. Values are one-way hashed and
+         * URLs are reduced to their origin; the default logs provider/type/count only.
+         */
+        logIdentity?: boolean;
     }): Promise<UsageReport[] | null>;
     /**
      * Probe each stored credential against its provider's auth-verifying usage
@@ -1061,6 +1070,8 @@ export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
         includeExpired?: boolean;
     }): string | null;
     setCache(key: string, value: string, expiresAtSec: number): void;
+    tryAcquireUsageFetchLease(key: string, owner: string, nowMs: number, leaseMs: number): boolean | undefined;
+    releaseUsageFetchLease(key: string, owner: string): void;
     allocateMonotonicSequence(key: string, expiresAtSec: number): number;
     deleteCachePrefix(prefix: string): void;
     cleanExpiredCache(): void;

package/dist/types/providers/anthropic.d.ts

@@ -107,7 +107,7 @@ export interface CpaToolAliasRestoreFailure {
  */
 export declare function parseCpaToolAliasRestoreFailure(error: unknown): CpaToolAliasRestoreFailure | undefined;
 export declare function isCpaToolAliasRestoreFailure(error: unknown): boolean;
-export declare const claudeCodeVersion = "2.1.273";
+export declare const claudeCodeVersion = "2.1.280";
 export declare const claudeCodeEntrypoint = "sdk-cli";
 export declare const claudeToolPrefix: string;
 export declare const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";

package/dist/types/providers/cursor.d.ts

@@ -73,6 +73,8 @@ export declare function createCursorMessageQueueForTest(onError?: (error: unknow
 };
 /** Exported for direct regression coverage of the JSON-safety boundary. */
 export declare function cursorJsonSafeValueForTest(value: unknown): unknown;
+/** Exported for direct regression coverage of the Cursor serialization boundary. */
+export declare function cursorJsonSafeStringifyForTest(value: unknown): string;
 export declare function buildNativeToolCallBlock(toolCall: Record<string, unknown>, callId: string, index: number): ToolCallState | null;
 /** Derive prompt usage from Cursor's whole-conversation checkpoint total. */
 export declare function finalizeCursorUsage(output: AssistantMessage, usageState: UsageState): void;
@@ -103,6 +105,14 @@ export declare function finalizeCursorUsageForTest(usedTokens: number, outputTok
 export declare function buildCursorSystemPromptJsons(systemPrompt: readonly string[] | undefined, modelId?: string): string[];
 /** Exported for regression coverage of the tool usage-cache identity boundary. */
 export declare function buildCursorUsageToolsKeyForTest(tools: Tool[]): string;
+/** Exported for regression coverage of the generic tool-schema wire boundary. */
+export declare function buildCursorWireToolIdentitiesForTest(tools: Tool[]): Array<{
+    name: string;
+    description: string;
+    inputSchema: JsonValue;
+}>;
+/** Exported for regression coverage of lossless conversation identity hashing. */
+export declare function hashCursorConversationValueForTest(value: unknown): string;
 /** Exported for tests: decodes Cursor history blobs built from conversation messages. */
 export declare function buildCursorHistoryForTest(messages: Message[]): {
     rootPromptMessagesJson: unknown[];

package/dist/types/providers/openai-completions.d.ts

@@ -1,5 +1,5 @@
 import type { ChatCompletionMessageParam } from "openai/resources/chat/completions";
-import { type AssistantMessage, type Context, type Model, type ServiceTier, type StreamFunction, type StreamOptions, type ToolChoice } from "../types";
+import { type AssistantMessage, type Context, type Model, type RepetitionGuardOptions, type ServiceTier, type StreamFunction, type StreamOptions, type ToolChoice } from "../types";
 import { type ResolvedOpenAICompat } from "./openai-completions-compat";
 /** Test seam: the provider base URL as resolved from trusted env. */
 export declare function resolveOpenAICompletionsBaseUrlForTest(baseUrl: string | undefined, authCredentialType: "api_key" | "oauth" | undefined): string;
@@ -23,6 +23,14 @@ export interface OpenAICompletionsOptions extends StreamOptions {
     /** Force-disable reasoning where supported, or request the lowest effort on generic effort endpoints. */
     disableReasoning?: boolean;
     serviceTier?: ServiceTier;
+    /**
+     * Runaway-repetition guard thresholds, per stream channel. A number sets the
+     * consecutive-repeat threshold; `false` disables the channel's guard.
+     * Defaults: thinking = DEFAULT_REPETITION_THRESHOLD, text = false — visible
+     * output is a deliverable and intentional repetition there (logs, fixtures,
+     * tables, generated code) must survive byte for byte (#5627).
+     */
+    repetitionGuard?: RepetitionGuardOptions;
 }
 export declare const streamOpenAICompletions: StreamFunction<"openai-completions">;
 export declare function parseChunkUsage(rawUsage: object, model: Model<"openai-completions">, premiumRequests: number | undefined): AssistantMessage["usage"];

package/dist/types/types.d.ts

@@ -338,6 +338,14 @@ export interface AttemptScopeRef {
     readonly generation: number;
     readonly lineage: string;
 }
+/**
+ * Runaway-repetition guard thresholds, per stream channel. A number sets the
+ * consecutive-repeat threshold; `false` disables that channel's guard.
+ */
+export interface RepetitionGuardOptions {
+    thinking?: number | false;
+    text?: number | false;
+}
 export interface SimpleStreamOptions extends StreamOptions {
     reasoning?: Effort;
     /**
@@ -373,6 +381,14 @@ export interface SimpleStreamOptions extends StreamOptions {
     syntheticApiFormat?: "openai" | "anthropic";
     /** Hint that websocket transport should be preferred when supported by the provider implementation. */
     preferWebsockets?: boolean;
+    /**
+     * Runaway-repetition guard thresholds, per stream channel. Honoured by the
+     * openai-completions transport; ignored by providers without a guard.
+     * Defaults: thinking = DEFAULT_REPETITION_THRESHOLD, text = false — visible
+     * output is a deliverable and intentional repetition there (logs, fixtures,
+     * tables, generated code) must survive byte for byte (#5627).
+     */
+    repetitionGuard?: RepetitionGuardOptions;
 }
 export type StreamFunction<TApi extends Api> = (model: Model<TApi>, context: Context, options: OptionsForApi<TApi>) => AssistantMessageEventStream;
 export interface TextSignatureV1 {

package/dist/types/utils/discovery/openai-compatible.d.ts

@@ -1,4 +1,12 @@
 import type { Api, FetchImpl, Model, Provider } from "../../types";
+/**
+ * Shared `/models` request deadline for setup-time probing and runtime
+ * discovery. One policy so an endpoint that passes setup validation cannot
+ * be unreachable under the runtime deadline (previously 10s vs 5s: a 6s
+ * endpoint passed setup, saved discovery-only config, then stayed
+ * unavailable at runtime with no recovery hint).
+ */
+export declare const MODELS_LIST_REQUEST_TIMEOUT_MS = 10000;
 /** Catalog identities are rendered and used for routing; unsafe values are dropped, never rewritten. */
 export declare function isSafeCatalogModelId(value: unknown): value is string;
 /**
@@ -100,3 +108,5 @@ export declare function resolveLoopbackOpenAIBaseUrl(value: string | undefined,
  * Returns `[]` only when the endpoint responds successfully with no usable models.
  */
 export declare function fetchOpenAICompatibleModels<TApi extends Api>(options: FetchOpenAICompatibleModelsOptions<TApi>): Promise<Model<TApi>[] | null>;
+/** Bounded JSON body reader for `/models` responses (shared by runtime and setup probe). */
+export declare function readBoundedModelsJson(response: Response): Promise<unknown>;

package/dist/types/utils/fallback-transport.d.ts

@@ -43,6 +43,10 @@ export type TransportHeaders = Headers | Record<string, string | undefined>;
  */
 export interface TransportFailureFacts {
     kind: "transport";
+    /** Diagnostic HTTP/2 reset code; not HTTP status or retry authority. */
+    http2RstCode?: number;
+    /** Native HTTP/2 error code; diagnostic only, not retry authority. */
+    nativeErrorCode?: string;
     status?: number;
     /** Canonical provider error code used for fallback classification. */
     providerCode?: string;

package/dist/types/utils/h2-fetch.d.ts

@@ -11,13 +11,14 @@
  * Some HTTPS endpoints (e.g. corporate API gateways behind reverse proxies)
  * advertise h2 via ALPN but then refuse or reset the connection at the HTTP/2
  * framing layer. Bun surfaces these as `ConnectionRefused`, `ConnectionReset`,
- * or `ConnectionClosed` rather than `HTTP2Unsupported`, so we treat those
- * codes as h2-fallback triggers as well. `ConnectionRefused` is raised before
- * the request is written, but a reset or a close does not prove the peer never
- * consumed the body — it may have processed the request and died before
- * answering. Replaying those two on h1 would duplicate the side effect, so
- * `ConnectionReset` and `ConnectionClosed` fall back only for replay-safe
- * methods; anything else rethrows the original error.
+ * `ConnectionClosed`, or `HTTP2StreamReset` rather than `HTTP2Unsupported`.
+ * `ConnectionRefused` is raised before the request is written, while
+ * `HTTP2RefusedStream` is the explicit HTTP/2 promise that a stream was never
+ * processed (including a stream above a graceful GOAWAY last-stream-id).
+ * `ConnectionReset`, `ConnectionClosed`, and a generic `HTTP2StreamReset` do
+ * not carry that promise: the peer may have consumed the body before the
+ * connection failed. Retrying those codes would duplicate non-idempotent side
+ * effects, so they preserve the original error instead of falling back.
  *
  * ALPN-refusing hosts (notably zcode.z.ai, the GLM ZCode OAuth broker) abort
  * the TLS handshake entirely when the client offers ALPN h2. Bun reports that

package/dist/types/utils/stream-repetition-guard.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Runaway-repetition detector for a model's streamed text or thinking channel.
+ *
+ * Some models fall into a decode loop and emit the same sentence — or the same
+ * short token run — until the turn's budget runs out. Nothing errors: the tool
+ * calls in the same message still execute, and the transcript just fills with
+ * dozens of identical lines (#5624).
+ *
+ * This is a pure state machine with no provider knowledge: `feed()` takes a
+ * chunk of streamed text and returns the prefix that is safe to emit. Until it
+ * trips, that prefix is the chunk itself, so a healthy stream passes through
+ * byte for byte. Once it trips, it emits nothing further and {@link takeTrip}
+ * hands the caller a one-shot signal to abort the request.
+ *
+ * Use one instance per stream **per channel**. Interleaving the visible-text
+ * and reasoning channels through a single instance would splice unrelated
+ * tokens into the same window and manufacture patterns that were never
+ * streamed.
+ */
+/** Consecutive repeats of one unit that trip the guard. */
+export declare const DEFAULT_REPETITION_THRESHOLD = 12;
+/**
+ * Largest accepted repetition threshold.
+ *
+ * Token retention is `MAX_NGRAM_TOKENS * (threshold + 1)`, so capping the
+ * threshold is what makes the guard's memory bounded: at this cap it retains
+ * at most 64 * 129 = 8256 tokens, against 832 at the default. That is roughly
+ * ten times the default's headroom — generous for a caller who genuinely wants
+ * a laxer guard — while keeping a hostile or buggy option from turning the
+ * detector into an unbounded buffer (#5627 review r6).
+ */
+export declare const MAX_REPETITION_THRESHOLD = 128;
+/**
+ * `errorCode` stamped on a turn this guard stopped. A bounded classifier, never
+ * raw model text — consumers branch on it to tell a local decode-loop stop from
+ * a client cancellation or a transport fault (#5627).
+ */
+export declare const REPETITION_GUARD_ERROR_CODE = "repetition_guard_tripped";
+/**
+ * Wire-safe `errorMessage` for a turn this guard stopped. A literal with zero
+ * interpolation — not the sample, not the channel, not the repeat count.
+ *
+ * The auth gateway forwards `errorMessage` to API clients on the streaming path
+ * (`redactGatewayMessage` only strips credential-shaped text), so anything
+ * interpolated here is raw model output published verbatim. It also reaches
+ * `classifyGatewayError`, which keyword-matches on message text, so a repeated
+ * `quota` or `forbidden` in a sample could pick the HTTP status (#5627 r5).
+ *
+ * The repeated unit is not logged either: the provider logs bounded metadata
+ * only, because the default log transport persists metadata verbatim to a
+ * rotating file on disk (#5627 review r6). {@link StreamRepetitionTrip.sample}
+ * stays in memory for callers that want it.
+ */
+export declare const REPETITION_GUARD_STOP_MESSAGE = "Stopped the turn: the model produced runaway repeated output.";
+export type RepetitionUnitKind = "line" | "ngram";
+export interface StreamRepetitionTrip {
+    /** Whether the repeats were whole lines or an n-gram inside one line. */
+    readonly kind: RepetitionUnitKind;
+    /** Consecutive repeats observed when the guard tripped. */
+    readonly repeats: number;
+    /** Normalized, truncated sample of the repeated unit, for diagnostics. */
+    readonly sample: string;
+}
+export interface StreamRepetitionGuardOptions {
+    /**
+     * Consecutive repeats that trip the guard. Defaults to 12. Normalized by
+     * {@link normalizeThreshold} — non-finite values fall back to the default,
+     * fractional values are floored, and the result is clamped into
+     * `[2, MAX_REPETITION_THRESHOLD]`.
+     */
+    readonly threshold?: number;
+}
+export declare class StreamRepetitionGuard {
+    #private;
+    constructor(options?: StreamRepetitionGuardOptions);
+    /**
+     * The threshold actually in force — the caller's option after
+     * {@link normalizeThreshold}, which may differ from what was passed.
+     */
+    get threshold(): number;
+    get tripped(): boolean;
+    get trip(): StreamRepetitionTrip | undefined;
+    /**
+     * Returns the trip exactly once, then `undefined` forever. Callers drive a
+     * one-shot side effect (aborting the request) off this, so the once-only
+     * latch lives here rather than being re-implemented at each call site.
+     */
+    takeTrip(): StreamRepetitionTrip | undefined;
+    /**
+     * Feed a chunk of streamed text. Returns the portion safe to emit: the whole
+     * chunk while healthy, the prefix up to the repeat that tripped the guard on
+     * the chunk that trips it, and nothing at all after that.
+     */
+    feed(text: string): string;
+    /**
+     * Close the in-progress unit at end of stream and run detection once more.
+     *
+     * `feed()` only closes a token on whitespace and a line on `\n`, so a stream
+     * whose final repeat arrives without a trailing newline left the last copy
+     * uncounted and the turn read as a healthy completion (#5627 review r5).
+     *
+     * Emits nothing — everything `feed()` returned has already been rendered by
+     * the time this runs. A trip found here therefore classifies the turn while
+     * the last copy is already on screen; that is intended. Idempotent.
+     */
+    finalize(): void;
+}

package/dist/types/utils/tool-call-healing.d.ts

@@ -17,6 +17,10 @@
  * the end of a chunk is held back until the next chunk arrives.
  */
 import { type UnicodeEscapeEvidence } from "./json-parse";
+declare const TOKENS: readonly ["<|tool_calls_section_begin|>", "<|tool_calls_section_end|>", "<|tool_call_begin|>", "<|tool_call_end|>", "<|tool_call_argument_begin|>"];
+/** Maximum buffered partial-token length before we give up holding back. */
+declare const MAX_PARTIAL_HOLD = 64;
+export { MAX_PARTIAL_HOLD as MAX_TOOL_FENCE_PARTIAL_HOLD, TOKENS as TOOL_FENCE_TOKENS };
 export interface HealedToolCall {
     readonly id: string;
     readonly name: string;

package/dist/types/utils/tool-fence-strip.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Streaming-safe removal of chat-template tool-call fence tokens.
+ *
+ * Unlike {@link ToolCallHealer}, this reconstructs nothing — it only deletes
+ * the markers. That makes it safe for the **reasoning channel**, where a leaked
+ * `<|tool_call_end|>` is pure noise: the structured `tool_calls` payload is the
+ * single source of truth, and the healer's doc comment warns that feeding the
+ * reasoning channel into its accumulator corrupts the holdback buffer (#5624).
+ *
+ * Deliberately NOT applied to the visible text channel: a fence token the
+ * assistant *talks about* in prose, outside an active section, must survive as
+ * text (see packages/ai/CHANGELOG.md:1094).
+ */
+/** Remove every complete fence token from `text`. Pure; no stream state. */
+export declare function stripToolFenceTokens(text: string): string;
+/**
+ * Stateful wrapper around {@link stripToolFenceTokens} that holds back a
+ * partial token at the end of a chunk until the next chunk arrives, so a fence
+ * split across a streaming boundary is still removed. One instance per stream.
+ */
+export declare class ToolFenceStripper {
+    #private;
+    /** Feed a chunk; returns the stripped text safe to emit now. */
+    feed(text: string): string;
+    /** Drain any held-back partial at end of stream. It never completed, so emit it. */
+    flush(): string;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.17.2",
+	"version": "0.17.5",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -41,8 +41,8 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/natives": "0.17.2",
-		"@gajae-code/utils": "0.17.2",
+		"@gajae-code/natives": "0.17.5",
+		"@gajae-code/utils": "0.17.5",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-gateway/server.ts

@@ -40,6 +40,7 @@ import type {
 } from "../types";
 import { beginAttempt, classifyFallbackTrigger } from "../utils/fallback-transport";
 import { assertAuthenticatedOrLoopback, parseBind } from "../utils/parse-bind";
+import { REPETITION_GUARD_ERROR_CODE } from "../utils/stream-repetition-guard";
 import {
 	captureRequestHeaders,
 	corsHeaders,
@@ -520,6 +521,38 @@ function classifyGatewayError(err: unknown): { status: number; type: string; mes
 	return { status: 502, type: "upstream_error", message };
 }
 
+/**
+ * Fixed envelope for a turn the streamed repetition guard stopped. The message
+ * is a literal on purpose: {@link classifyGatewayError} keyword-matches on
+ * message text (`invalid`, `quota`, `rate`, `forbidden`, …) and the guard's
+ * diagnostic carries a sample of raw model output, so routing it through that
+ * regex would let a repeated word in the sample pick the HTTP status (#5627).
+ */
+const REPETITION_GUARD_GATEWAY_ERROR = {
+	status: 502,
+	type: "upstream_error",
+	message: "Upstream model produced runaway repeated output and the turn was stopped",
+} as const;
+
+/**
+ * Classify a terminal {@link AssistantMessage} that failed into a wire envelope.
+ *
+ * Shared by both non-streaming handlers so a repetition stop cannot be reported
+ * as a client cancellation on one path and an upstream error on the other.
+ * Exported for tests.
+ */
+export function classifyGatewayMessageFailure(
+	message: Pick<AssistantMessage, "stopReason" | "errorCode">,
+	safeErrorMessage: string,
+): { status: number; type: string; message: string } {
+	// Checked before `aborted` as well as before the keyword classifier: a
+	// local decode-loop stop is never a user cancellation, whatever stop reason
+	// the provider chose to carry it on.
+	if (message.errorCode === REPETITION_GUARD_ERROR_CODE) return { ...REPETITION_GUARD_GATEWAY_ERROR };
+	if (message.stopReason === "aborted") return { status: 499, type: "request_aborted", message: safeErrorMessage };
+	return classifyGatewayError(new Error(safeErrorMessage));
+}
+
 function redactGatewayError(error: unknown): Error {
 	const redacted = new Error(cleanReason(error) ?? "Upstream request failed");
 	if (error instanceof Error) {
@@ -531,6 +564,14 @@ function redactGatewayError(error: unknown): Error {
 }
 
 function redactGatewayMessage(message: AssistantMessage): AssistantMessage {
+	// A repetition stop is replaced wholesale, before `cleanReason` ever sees it.
+	// `cleanReason` only strips credential-shaped text, so ordinary model prose
+	// survives it verbatim — and this message's free-form half is a sample of raw
+	// model output. Reuses the fixed envelope the non-streaming path already
+	// returns, so both paths publish the same bounded string (#5627 review r5).
+	if (message.errorCode === REPETITION_GUARD_ERROR_CODE) {
+		return { ...message, errorMessage: REPETITION_GUARD_GATEWAY_ERROR.message };
+	}
 	if (message.errorMessage === undefined) return message;
 	return { ...message, errorMessage: cleanReason(message.errorMessage) ?? "Upstream request failed" };
 }
@@ -539,8 +580,12 @@ function redactGatewayMessage(message: AssistantMessage): AssistantMessage {
  * Protect all gateway SSE encoders from upstream error text. Provider wire
  * modules format `error` events themselves, so sanitize at this boundary and
  * also convert iterator failures to bounded errors before their catch blocks.
+ *
+ * Exported for tests: this is the only place the streaming path scrubs error
+ * text, so the assertion that a repetition sample never reaches the wire has to
+ * drive it directly.
  */
-function redactGatewayStream(events: AssistantMessageEventStream): AssistantMessageEventStream {
+export function redactGatewayStream(events: AssistantMessageEventStream): AssistantMessageEventStream {
 	async function* redactedEvents(): AsyncGenerator<AssistantMessageEvent> {
 		try {
 			for await (const event of events) {
@@ -914,10 +959,7 @@ async function handleFormatEndpoint(
 					error: safeErrorMessage,
 					peer,
 				});
-				if (message.stopReason === "aborted") {
-					return route.module.formatError(499, "request_aborted", safeErrorMessage);
-				}
-				const classified = classifyGatewayError(new Error(safeErrorMessage));
+				const classified = classifyGatewayMessageFailure(message, safeErrorMessage);
 				return route.module.formatError(classified.status, classified.type, classified.message);
 			}
 			return json(200, route.module.encodeResponse(message, parsed.modelId));
@@ -1130,10 +1172,7 @@ async function handlePiNative(
 					error: safeErrorMessage,
 					peer,
 				});
-				if (message.stopReason === "aborted") {
-					return piNative.formatError(499, "request_aborted", safeErrorMessage);
-				}
-				const classified = classifyGatewayError(new Error(safeErrorMessage));
+				const classified = classifyGatewayMessageFailure(message, safeErrorMessage);
 				return piNative.formatError(classified.status, classified.type, classified.message);
 			}
 			return json(200, { message });