@gajae-code/ai 0.18.0 → 0.18.5

package/CHANGELOG.md

@@ -2,6 +2,47 @@
 
 ## [Unreleased]
 
+## [0.18.5] - 2026-09-30
+
+## [0.18.4] - 2026-09-30
+
+## [0.18.3] - 2026-09-30
+
+## [0.18.2] - 2026-09-30
+
+### Added
+
+- Bundled Claude Sonnet 5.5: `anthropic/claude-sonnet-5-5` and Amazon Bedrock `anthropic.claude-sonnet-5-5` (plus `au.`/`eu.`/`global.`/`jp.`/`us.` inference profiles), with 1M context, 128K output, and $2/$10 per MTok pricing (#6111).
+
+- Bundled GPT-6.1 Sol for the Codex provider: `openai-codex/gpt-6.1-sol` (272K context, 128K output, reasoning effort low..max) with $2/$10 per MTok and $0.10 cached-input pricing (#6147). Presets and model-profile defaults are unchanged.
+
+### Removed
+
+- Removed `installH2Fetch`. Bun's HTTP/2 client can wedge a pooled connection while uploading a large request body (~300 KB, a typical long agent context): every later request on that connection waits indefinitely for response headers. All `fetch()` traffic now uses HTTP/1.1.
+
+### Fixed
+
+- A large (≥1 MB) request to a custom Anthropic-compatible endpoint is now retried when its connection drops before any response (ECONNRESET, socket closed, `Connection error`). Previously the one-upload ceiling meant for first-event stalls also covered these failures, so a single network blip ended the turn. Server responses (e.g. 529) and first-event timeouts still respect the ceiling (#6072).
+
+- Kiro (OAuth CodeWhisperer transport) now replays earlier tool calls as structured `toolUses` and sends each tool result as `{ toolUseId, status, content: [{ text }] }`, linked to the call it answers, instead of serializing calls into assistant text and nesting results. Parallel tool results share one history entry, and image results are marked `[image omitted]` rather than sent empty (#6079).
+
+- OpenAI-compatible completions requests now log OpenAI SDK connection timeouts and retries to the gjc log. Previously a request stalled before response headers retried silently for up to several minutes.
+
+## [0.18.1] - 2026-09-29
+
+### Changed
+
+- Bump the bundled Claude Code fingerprint floor from 2.1.281 to 2.1.284.
+- Anthropic OAuth requests now sign `claude-cli/<version>` and the billing `cc_version` with the latest published Claude Code release instead of a build-time constant. The version is resolved in the background from Anthropic's `latest` release channel and the npm dist-tag (higher wins), refreshed at most every 6 hours, cached in `~/.gjc/cache/claude-code-version.json`, and never blocks a request or drops below the bundled floor. Set `GJC_CLAUDE_CODE_VERSION=X.Y.Z` to pin it. A stale fingerprint is answered with HTTP 400 `claude_code_version_too_old` on newer models, so this no longer waits for a gjc release to recover.
+
+### Fixed
+
+- OpenGateway models discovered from `/v1/models` now take their capabilities from the bundled catalog entry for the same upstream model, and `-ultrafast` deployments resolve to their upstream model, so `opengateway/deepseek/deepseek-v4.1-flash-ultrafast` and the GLM/Kimi ultrafast models are registered with reasoning support and accept thinking levels (#6070).
+
+- Bound Codex turns that stall after an empty reasoning item and streamed tool-call start to the shared stream idle timeout.
+
+- Apply the shared stream idle timeout to Codex WebSocket responses when no WebSocket-specific timeout is configured, so a stalled preferred transport surfaces an error within the expected idle window.
+
 ## [0.18.0] - 2026-09-27
 
 ### Added

package/dist/types/index.d.ts

@@ -14,6 +14,7 @@ export * from "./provider-diagnostic";
 export * from "./provider-models";
 export * from "./providers/anthropic";
 export * from "./providers/azure-openai-responses";
+export * from "./providers/claude-code-version";
 export type * from "./providers/cursor";
 export * from "./providers/gitlab-duo";
 export type * from "./providers/google";
@@ -45,7 +46,6 @@ export * from "./utils/anthropic-auth";
 export * from "./utils/discovery";
 export * from "./utils/event-stream";
 export * from "./utils/fallback-transport";
-export * from "./utils/h2-fetch";
 export * from "./utils/oauth";
 export type { OAuthCredentials, OAuthLoginOptions, OAuthProvider, OAuthProviderId, OAuthProviderInfo, } from "./utils/oauth/types";
 export * from "./utils/overflow";

package/dist/types/provider-models/openai-compat.d.ts

@@ -121,8 +121,11 @@ export interface OpenGatewayModelManagerConfig {
 }
 /**
  * OpenGateway by Sionic AI — an OpenAI-compatible gateway that fronts OpenAI,
- * Anthropic, and Google models behind one API key. Models are discovered from
- * the OpenAI-compatible `/v1/models` endpoint.
+ * Anthropic, Google, DeepSeek, Z.ai, Moonshot and Qwen models behind one API key.
+ * Models are discovered from the OpenAI-compatible `/v1/models` endpoint, which
+ * reports no capability metadata, so capabilities come from the bundled catalog:
+ * the OpenGateway entry first, then the same upstream id from any bundled
+ * provider, with `-ultrafast` deployments resolved to their upstream model.
  */
 export declare function opengatewayModelManagerOptions(config?: OpenGatewayModelManagerConfig): ModelManagerOptions<"openai-completions">;
 export interface BizRouterModelManagerConfig {

package/dist/types/providers/anthropic.d.ts

@@ -107,7 +107,6 @@ export interface CpaToolAliasRestoreFailure {
  */
 export declare function parseCpaToolAliasRestoreFailure(error: unknown): CpaToolAliasRestoreFailure | undefined;
 export declare function isCpaToolAliasRestoreFailure(error: unknown): boolean;
-export declare const claudeCodeVersion = "2.1.281";
 export declare const claudeCodeEntrypoint = "sdk-cli";
 export declare const claudeToolPrefix: string;
 export declare const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";

package/dist/types/providers/claude-code-version.d.ts

@@ -0,0 +1,39 @@
+/** Bundled floor; `scripts/check-spoofed-versions.ts --update` keeps it current. */
+export declare const CLAUDE_CODE_BASELINE_VERSION = "2.1.284";
+/** Pins the fingerprint and disables network resolution. */
+export declare const CLAUDE_CODE_VERSION_ENV = "GJC_CLAUDE_CODE_VERSION";
+/**
+ * Anthropic's native-installer release channel. `stable` deliberately lags the
+ * npm package during a staged rollout, so `latest` is the channel that matches
+ * what a freshly updated Claude Code actually reports.
+ */
+export declare const CLAUDE_RELEASE_CHANNEL_URL = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/latest";
+export declare const CLAUDE_NPM_DIST_TAG_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
+type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+export declare function compareClaudeCodeVersions(a: string, b: string): number;
+/**
+ * Latest published Claude Code version: the higher of the native-installer
+ * `latest` channel and the npm dist-tag, so one lagging or unavailable source
+ * cannot pin the fingerprint back. `null` when both sources fail.
+ */
+export declare function fetchLatestClaudeCodeVersion(fetchImpl?: FetchLike, userAgent?: string): Promise<string | null>;
+export interface ClaudeCodeVersionResolverOptions {
+    baseline: string;
+    /** Exact pin; disables network resolution when set. */
+    pinned?: string;
+    /** `null` disables both disk caching and network resolution. */
+    cachePath: string | null;
+    fetch?: FetchLike;
+    now?: () => number;
+    refreshIntervalMs?: number;
+}
+export interface ClaudeCodeVersionResolver {
+    /** Current fingerprint; schedules a background refresh when the cache is stale. */
+    get(): string;
+    /** Refresh now (deduplicated); resolves with the fingerprint afterwards. */
+    refresh(): Promise<string>;
+}
+export declare function createClaudeCodeVersionResolver(options: ClaudeCodeVersionResolverOptions): ClaudeCodeVersionResolver;
+/** Claude Code version the `claude-cli` fingerprint and billing attribution sign with. */
+export declare function getClaudeCodeVersion(): string;
+export {};

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.18.0",
+	"version": "0.18.5",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -41,8 +41,8 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/natives": "0.18.0",
-		"@gajae-code/utils": "0.18.0",
+		"@gajae-code/natives": "0.18.5",
+		"@gajae-code/utils": "0.18.5",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/index.ts

@@ -14,6 +14,7 @@ export * from "./provider-diagnostic";
 export * from "./provider-models";
 export * from "./providers/anthropic";
 export * from "./providers/azure-openai-responses";
+export * from "./providers/claude-code-version";
 export type * from "./providers/cursor";
 export * from "./providers/gitlab-duo";
 export type * from "./providers/google";
@@ -45,7 +46,6 @@ export * from "./utils/anthropic-auth";
 export * from "./utils/discovery";
 export * from "./utils/event-stream";
 export * from "./utils/fallback-transport";
-export * from "./utils/h2-fetch";
 export * from "./utils/oauth";
 export type {
 	OAuthCredentials,

package/src/model-pricing.ts

@@ -35,6 +35,15 @@ const GPT_6_SOL_PRICING: TieredPricing = {
 	},
 };
 
+// TODO(gpt-6.1-sol): cache-write and long-context prices not yet published; derived from gpt-6-sol / 2x-1.5x rule
+const GPT_6_1_SOL_PRICING: TieredPricing = {
+	cost: { input: 2, output: 10, cacheRead: 0.1, cacheWrite: 2.5 },
+	longContextPricing: {
+		threshold: LONG_CONTEXT_THRESHOLD,
+		cost: { input: 4, output: 15, cacheRead: 0.2, cacheWrite: 5 },
+	},
+};
+
 // GPT-6 Luna: $0.10/$0.50 standard, cache read $0.01, cache write $0.125;
 // inputs past 272K apply 2x to input/cache and 1.5x to output.
 const GPT_6_LUNA_PRICING: TieredPricing = {
@@ -49,6 +58,7 @@ const GPT_6_LUNA_PRICING: TieredPricing = {
 const OPENAI_GPT_5_6_PRICING: ReadonlyMap<string, TieredPricing> = new Map([
 	["gpt-6-astra", GPT_6_ASTRA_PRICING],
 	["gpt-6-sol", GPT_6_SOL_PRICING],
+	["gpt-6.1-sol", GPT_6_1_SOL_PRICING],
 	["gpt-6-luna", GPT_6_LUNA_PRICING],
 	["gpt-5.6", GPT_5_6_SOL_PRICING],
 	["gpt-5.6-sol", GPT_5_6_SOL_PRICING],

package/src/models.json

@@ -964,6 +964,31 @@
 				"maxLevel": "high"
 			}
 		},
+		"anthropic.claude-sonnet-5-5": {
+			"id": "anthropic.claude-sonnet-5-5",
+			"name": "Anthropic Sonnet 5.5",
+			"api": "bedrock-converse-stream",
+			"provider": "amazon-bedrock",
+			"baseUrl": "https://bedrock-runtime.us-east-1.amazonaws.com",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 2,
+				"output": 10,
+				"cacheRead": 0.2,
+				"cacheWrite": 2.5
+			},
+			"contextWindow": 1000000,
+			"maxTokens": 128000,
+			"thinking": {
+				"mode": "anthropic-budget-effort",
+				"minLevel": "minimal",
+				"maxLevel": "high"
+			}
+		},
 		"apac.amazon.nova-lite-v1:0": {
 			"id": "apac.amazon.nova-lite-v1:0",
 			"name": "Nova Lite (APAC)",
@@ -1308,6 +1333,31 @@
 				"maxLevel": "high"
 			}
 		},
+		"au.anthropic.claude-sonnet-5-5": {
+			"id": "au.anthropic.claude-sonnet-5-5",
+			"name": "Anthropic Sonnet 5.5 (AU)",
+			"api": "bedrock-converse-stream",
+			"provider": "amazon-bedrock",
+			"baseUrl": "https://bedrock-runtime.us-east-1.amazonaws.com",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 2.2,
+				"output": 11,
+				"cacheRead": 0.22,
+				"cacheWrite": 2.75
+			},
+			"contextWindow": 1000000,
+			"maxTokens": 128000,
+			"thinking": {
+				"mode": "anthropic-budget-effort",
+				"minLevel": "minimal",
+				"maxLevel": "high"
+			}
+		},
 		"ca.amazon.nova-lite-v1:0": {
 			"id": "ca.amazon.nova-lite-v1:0",
 			"name": "Nova Lite (CA)",
@@ -2072,6 +2122,31 @@
 				"maxLevel": "high"
 			}
 		},
+		"eu.anthropic.claude-sonnet-5-5": {
+			"id": "eu.anthropic.claude-sonnet-5-5",
+			"name": "Anthropic Sonnet 5.5 (EU)",
+			"api": "bedrock-converse-stream",
+			"provider": "amazon-bedrock",
+			"baseUrl": "https://bedrock-runtime.us-east-1.amazonaws.com",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 2.2,
+				"output": 11,
+				"cacheRead": 0.22,
+				"cacheWrite": 2.75
+			},
+			"contextWindow": 1000000,
+			"maxTokens": 128000,
+			"thinking": {
+				"mode": "anthropic-budget-effort",
+				"minLevel": "minimal",
+				"maxLevel": "high"
+			}
+		},
 		"eu.mistral.pixtral-large-2502-v1:0": {
 			"id": "eu.mistral.pixtral-large-2502-v1:0",
 			"name": "Pixtral Large (25.02) (EU)",
@@ -2477,6 +2552,31 @@
 				"maxLevel": "high"
 			}
 		},
+		"global.anthropic.claude-sonnet-5-5": {
+			"id": "global.anthropic.claude-sonnet-5-5",
+			"name": "Anthropic Sonnet 5.5 (Global)",
+			"api": "bedrock-converse-stream",
+			"provider": "amazon-bedrock",
+			"baseUrl": "https://bedrock-runtime.us-east-1.amazonaws.com",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 2,
+				"output": 10,
+				"cacheRead": 0.2,
+				"cacheWrite": 2.5
+			},
+			"contextWindow": 1000000,
+			"maxTokens": 128000,
+			"thinking": {
+				"mode": "anthropic-budget-effort",
+				"minLevel": "minimal",
+				"maxLevel": "high"
+			}
+		},
 		"global.openai.gpt-5.6-luna": {
 			"id": "global.openai.gpt-5.6-luna",
 			"name": "GPT-5.6 Luna (Global)",
@@ -3020,6 +3120,31 @@
 				"maxLevel": "high"
 			}
 		},
+		"jp.anthropic.claude-sonnet-5-5": {
+			"id": "jp.anthropic.claude-sonnet-5-5",
+			"name": "Anthropic Sonnet 5.5 (JP)",
+			"api": "bedrock-converse-stream",
+			"provider": "amazon-bedrock",
+			"baseUrl": "https://bedrock-runtime.us-east-1.amazonaws.com",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 2.2,
+				"output": 11,
+				"cacheRead": 0.22,
+				"cacheWrite": 2.75
+			},
+			"contextWindow": 1000000,
+			"maxTokens": 128000,
+			"thinking": {
+				"mode": "anthropic-budget-effort",
+				"minLevel": "minimal",
+				"maxLevel": "high"
+			}
+		},
 		"meta.llama3-1-405b-instruct-v1:0": {
 			"id": "meta.llama3-1-405b-instruct-v1:0",
 			"name": "Llama 3.1 405B Instruct",
@@ -4501,6 +4626,31 @@
 				"maxLevel": "high"
 			}
 		},
+		"us.anthropic.claude-sonnet-5-5": {
+			"id": "us.anthropic.claude-sonnet-5-5",
+			"name": "Anthropic Sonnet 5.5 (US)",
+			"api": "bedrock-converse-stream",
+			"provider": "amazon-bedrock",
+			"baseUrl": "https://bedrock-runtime.us-east-1.amazonaws.com",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 2.2,
+				"output": 11,
+				"cacheRead": 0.22,
+				"cacheWrite": 2.75
+			},
+			"contextWindow": 1000000,
+			"maxTokens": 128000,
+			"thinking": {
+				"mode": "anthropic-budget-effort",
+				"minLevel": "minimal",
+				"maxLevel": "high"
+			}
+		},
 		"us.deepseek.r1-v1:0": {
 			"id": "us.deepseek.r1-v1:0",
 			"name": "DeepSeek-R1 (US)",
@@ -5656,6 +5806,31 @@
 				"minLevel": "minimal",
 				"maxLevel": "max"
 			}
+		},
+		"claude-sonnet-5-5": {
+			"id": "claude-sonnet-5-5",
+			"name": "Anthropic Sonnet 5.5",
+			"api": "anthropic-messages",
+			"provider": "anthropic",
+			"baseUrl": "https://api.anthropic.com",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 2,
+				"output": 10,
+				"cacheRead": 0.2,
+				"cacheWrite": 2.5
+			},
+			"contextWindow": 1000000,
+			"maxTokens": 128000,
+			"thinking": {
+				"mode": "anthropic-adaptive",
+				"minLevel": "minimal",
+				"maxLevel": "max"
+			}
 		}
 	},
 	"azure-openai": {
@@ -68026,6 +68201,41 @@
 				}
 			}
 		},
+		"gpt-6.1-sol": {
+			"id": "gpt-6.1-sol",
+			"name": "GPT-6.1-Sol",
+			"api": "openai-codex-responses",
+			"provider": "openai-codex",
+			"baseUrl": "https://chatgpt.com/backend-api",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 2,
+				"output": 10,
+				"cacheRead": 0.1,
+				"cacheWrite": 2.5
+			},
+			"contextWindow": 272000,
+			"maxTokens": 128000,
+			"preferWebsockets": true,
+			"thinking": {
+				"mode": "effort",
+				"minLevel": "low",
+				"maxLevel": "max"
+			},
+			"longContextPricing": {
+				"threshold": 272000,
+				"cost": {
+					"input": 4,
+					"output": 15,
+					"cacheRead": 0.2,
+					"cacheWrite": 5
+				}
+			}
+		},
 		"gpt-daybreak-blue-latest": {
 			"id": "gpt-daybreak-blue-latest",
 			"name": "Daybreak Blue",

package/src/provider-models/openai-compat.ts

@@ -1175,15 +1175,52 @@ export interface OpenGatewayModelManagerConfig {
 	baseUrl?: string;
 }
 
+const OPENGATEWAY_BASE_URL = "https://apis.opengateway.ai/v1";
+/** OpenGateway serves accelerated deployments of an upstream model as `<upstream id>-ultrafast`. */
+const OPENGATEWAY_ULTRAFAST_SUFFIX = "-ultrafast";
+
 /**
  * OpenGateway by Sionic AI — an OpenAI-compatible gateway that fronts OpenAI,
- * Anthropic, and Google models behind one API key. Models are discovered from
- * the OpenAI-compatible `/v1/models` endpoint.
+ * Anthropic, Google, DeepSeek, Z.ai, Moonshot and Qwen models behind one API key.
+ * Models are discovered from the OpenAI-compatible `/v1/models` endpoint, which
+ * reports no capability metadata, so capabilities come from the bundled catalog:
+ * the OpenGateway entry first, then the same upstream id from any bundled
+ * provider, with `-ultrafast` deployments resolved to their upstream model.
  */
 export function opengatewayModelManagerOptions(
 	config?: OpenGatewayModelManagerConfig,
 ): ModelManagerOptions<"openai-completions"> {
-	return createSimpleOpenAICompletionsOptions("opengateway", "https://apis.opengateway.ai/v1", config);
+	const apiKey = config?.apiKey;
+	const baseUrl = config?.baseUrl ?? OPENGATEWAY_BASE_URL;
+	const resolveReference = createReferenceResolver(createBundledReferenceMap<"openai-completions">("opengateway"));
+	return {
+		providerId: "opengateway",
+		...(apiKey && {
+			fetchDynamicModels: () =>
+				fetchOpenAICompatibleModels({
+					api: "openai-completions",
+					provider: "opengateway",
+					baseUrl,
+					apiKey,
+					mapModel: (entry, defaults) => {
+						const reference =
+							resolveReference(defaults.id) ??
+							(defaults.id.endsWith(OPENGATEWAY_ULTRAFAST_SUFFIX)
+								? resolveReference(defaults.id.slice(0, -OPENGATEWAY_ULTRAFAST_SUFFIX.length))
+								: undefined);
+						const mapped = mapWithBundledReference(entry, defaults, reference);
+						return {
+							...mapped,
+							contextWindow: toPositiveNumber(entry.context_window, mapped.contextWindow),
+							maxTokens: toPositiveNumber(entry.max_output_tokens, mapped.maxTokens),
+							api: "openai-completions",
+							provider: "opengateway",
+							baseUrl,
+						};
+					},
+				}),
+		}),
+	};
 }
 
 // ---------------------------------------------------------------------------

package/src/providers/anthropic.d.ts

@@ -107,7 +107,6 @@ export interface CpaToolAliasRestoreFailure {
  */
 export declare function parseCpaToolAliasRestoreFailure(error: unknown): CpaToolAliasRestoreFailure | undefined;
 export declare function isCpaToolAliasRestoreFailure(error: unknown): boolean;
-export declare const claudeCodeVersion = "2.1.281";
 export declare const claudeCodeEntrypoint = "sdk-cli";
 export declare const claudeToolPrefix: string;
 export declare const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";

package/src/providers/anthropic.ts

@@ -113,6 +113,7 @@ import {
 	type ResolveToolChoiceResult,
 	resolveToolChoice,
 } from "../utils/tool-choice-capability";
+import { getClaudeCodeVersion } from "./claude-code-version";
 import {
 	buildCopilotDynamicHeaders,
 	hasCopilotVisionInput,
@@ -294,7 +295,7 @@ export function buildAnthropicHeaders(options: AnthropicHeaderOptions): Record<s
 		const incomingUserAgent = getHeaderCaseInsensitive(options.modelHeaders, "User-Agent");
 		const userAgent = isClaudeCodeClientUserAgent(incomingUserAgent)
 			? incomingUserAgent
-			: `claude-cli/${claudeCodeVersion} (external, cli)`;
+			: `claude-cli/${getClaudeCodeVersion()} (external, cli)`;
 		return {
 			...modelHeaders,
 			...claudeCodeHeaders,
@@ -851,7 +852,6 @@ function getCacheControl(
 }
 
 // Stealth mode: Mimic Anthropic Code headers and tool prefixing.
-export const claudeCodeVersion = "2.1.281";
 export const claudeCodeEntrypoint = "sdk-cli";
 export const claudeToolPrefix: string = "proxy_";
 export const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
@@ -928,7 +928,7 @@ function createClaudeBillingHeader(payload: unknown): string {
 	const buildHash = Array.from(randomBytes, byte => byte.toString(16).padStart(2, "0"))
 		.join("")
 		.slice(0, 3);
-	return `${CLAUDE_BILLING_HEADER_PREFIX} cc_version=${claudeCodeVersion}.${buildHash}; cc_entrypoint=${claudeCodeEntrypoint}; cch=${cch};`;
+	return `${CLAUDE_BILLING_HEADER_PREFIX} cc_version=${getClaudeCodeVersion()}.${buildHash}; cc_entrypoint=${claudeCodeEntrypoint}; cch=${cch};`;
 }
 
 const CLAUDE_CLOAKING_USER_ID_REGEX =
@@ -1764,6 +1764,23 @@ function isTransientStreamEnvelopeError(error: unknown): boolean {
 	);
 }
 
+/**
+ * A request whose connection failed before the server returned any response:
+ * the SDK's connection error, or a reset/closed/refused socket with no HTTP status.
+ */
+function isPreResponseConnectionFailure(error: unknown): boolean {
+	if (!(error instanceof Error)) return false;
+	if (extractHttpStatusFromError(error) !== undefined) return false;
+	if (error instanceof Anthropic.APIConnectionTimeoutError) return false;
+	if (error instanceof Anthropic.APIConnectionError) return true;
+	const code = (error as { code?: unknown }).code;
+	if (typeof code === "string" && /^(?:ECONNRESET|ECONNREFUSED|EPIPE|ENOTFOUND|EAI_AGAIN)$/.test(code)) return true;
+	return (
+		isUnexpectedSocketCloseMessage(error.message) ||
+		/\b(?:ECONNRESET|ECONNREFUSED|EPIPE)\b|^connection error\.?$|other side closed/i.test(error.message)
+	);
+}
+
 function isProviderRetryableStreamEnvelopeError(error: unknown): boolean {
 	if (!(error instanceof Error)) return false;
 	return /stream event order|before message_start/i.test(error.message);
@@ -2672,7 +2689,14 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 					// Otherwise the multi-megabyte body is re-uploaded up to the default
 					// streamMaxRetries budget despite the ceiling. Once iteration has
 					// begun, only the grace-clock path above decides.
-					if (requestUploadCeilingBound && firstEventWaitStartedAt === undefined) {
+					// A connection that dropped before any response (reset, socket closed,
+					// connect failure) is exempt: the server never answered, so a retry is
+					// not a re-upload after a stall, and a network blip must not end the turn.
+					if (
+						requestUploadCeilingBound &&
+						firstEventWaitStartedAt === undefined &&
+						!isPreResponseConnectionFailure(streamFailure)
+					) {
 						Object.assign(streamFailure as Error, {
 							requestBytes,
 							endpointClass,

package/src/providers/claude-code-version.d.ts

@@ -0,0 +1,39 @@
+/** Bundled floor; `scripts/check-spoofed-versions.ts --update` keeps it current. */
+export declare const CLAUDE_CODE_BASELINE_VERSION = "2.1.284";
+/** Pins the fingerprint and disables network resolution. */
+export declare const CLAUDE_CODE_VERSION_ENV = "GJC_CLAUDE_CODE_VERSION";
+/**
+ * Anthropic's native-installer release channel. `stable` deliberately lags the
+ * npm package during a staged rollout, so `latest` is the channel that matches
+ * what a freshly updated Claude Code actually reports.
+ */
+export declare const CLAUDE_RELEASE_CHANNEL_URL = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/latest";
+export declare const CLAUDE_NPM_DIST_TAG_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
+type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+export declare function compareClaudeCodeVersions(a: string, b: string): number;
+/**
+ * Latest published Claude Code version: the higher of the native-installer
+ * `latest` channel and the npm dist-tag, so one lagging or unavailable source
+ * cannot pin the fingerprint back. `null` when both sources fail.
+ */
+export declare function fetchLatestClaudeCodeVersion(fetchImpl?: FetchLike, userAgent?: string): Promise<string | null>;
+export interface ClaudeCodeVersionResolverOptions {
+    baseline: string;
+    /** Exact pin; disables network resolution when set. */
+    pinned?: string;
+    /** `null` disables both disk caching and network resolution. */
+    cachePath: string | null;
+    fetch?: FetchLike;
+    now?: () => number;
+    refreshIntervalMs?: number;
+}
+export interface ClaudeCodeVersionResolver {
+    /** Current fingerprint; schedules a background refresh when the cache is stale. */
+    get(): string;
+    /** Refresh now (deduplicated); resolves with the fingerprint afterwards. */
+    refresh(): Promise<string>;
+}
+export declare function createClaudeCodeVersionResolver(options: ClaudeCodeVersionResolverOptions): ClaudeCodeVersionResolver;
+/** Claude Code version the `claude-cli` fingerprint and billing attribution sign with. */
+export declare function getClaudeCodeVersion(): string;
+export {};

package/src/providers/claude-code-version.ts

@@ -0,0 +1,205 @@
+/**
+ * Claude Code client-version resolution for the `claude-cli` fingerprint.
+ *
+ * Anthropic gates newer models behind a minimum Claude Code version and answers
+ * stale fingerprints with HTTP 400 (`claude_code_version_too_old`). A version
+ * baked in at build time goes stale between releases, so the fingerprint is the
+ * higher of the bundled floor and the latest published Claude Code release,
+ * resolved in the background and cached on disk. Requests never wait on the
+ * network: they sign with whatever is known at that instant.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { getClaudeCodeVersionCachePath, isEnoent, logger } from "@gajae-code/utils";
+
+/** Bundled floor; `scripts/check-spoofed-versions.ts --update` keeps it current. */
+export const CLAUDE_CODE_BASELINE_VERSION = "2.1.284";
+
+/** Pins the fingerprint and disables network resolution. */
+export const CLAUDE_CODE_VERSION_ENV = "GJC_CLAUDE_CODE_VERSION";
+
+/**
+ * Anthropic's native-installer release channel. `stable` deliberately lags the
+ * npm package during a staged rollout, so `latest` is the channel that matches
+ * what a freshly updated Claude Code actually reports.
+ */
+export const CLAUDE_RELEASE_CHANNEL_URL =
+	"https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/latest";
+export const CLAUDE_NPM_DIST_TAG_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
+
+const REFRESH_INTERVAL_MS = 6 * 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 5_000;
+const EXACT_SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)$/;
+const EMBEDDED_SEMVER_RE = /(\d+\.\d+\.\d+)/;
+
+type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+
+export function compareClaudeCodeVersions(a: string, b: string): number {
+	const left = a.split(".").map(Number);
+	const right = b.split(".").map(Number);
+	for (let i = 0; i < 3; i++) {
+		const diff = (left[i] ?? 0) - (right[i] ?? 0);
+		if (diff !== 0) return diff;
+	}
+	return 0;
+}
+
+function isExactSemver(value: unknown): value is string {
+	return typeof value === "string" && EXACT_SEMVER_RE.test(value);
+}
+
+function highest(candidates: ReadonlyArray<string | null | undefined>): string | null {
+	let best: string | null = null;
+	for (const candidate of candidates) {
+		if (!isExactSemver(candidate)) continue;
+		if (best === null || compareClaudeCodeVersions(candidate, best) > 0) best = candidate;
+	}
+	return best;
+}
+
+async function fetchText(fetchImpl: FetchLike, url: string, userAgent: string): Promise<string | null> {
+	try {
+		const res = await fetchImpl(url, {
+			headers: { "User-Agent": userAgent },
+			signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+		});
+		if (!res.ok) return null;
+		return await res.text();
+	} catch {
+		return null;
+	}
+}
+
+async function fetchReleaseChannel(fetchImpl: FetchLike, userAgent: string): Promise<string | null> {
+	const text = await fetchText(fetchImpl, CLAUDE_RELEASE_CHANNEL_URL, userAgent);
+	return text === null ? null : (EMBEDDED_SEMVER_RE.exec(text.trim())?.[1] ?? null);
+}
+
+async function fetchNpmDistTag(fetchImpl: FetchLike, userAgent: string): Promise<string | null> {
+	const text = await fetchText(fetchImpl, CLAUDE_NPM_DIST_TAG_URL, userAgent);
+	if (text === null) return null;
+	try {
+		const data = JSON.parse(text) as { version?: unknown };
+		return typeof data.version === "string" ? (EMBEDDED_SEMVER_RE.exec(data.version)?.[1] ?? null) : null;
+	} catch {
+		return null;
+	}
+}
+
+/**
+ * Latest published Claude Code version: the higher of the native-installer
+ * `latest` channel and the npm dist-tag, so one lagging or unavailable source
+ * cannot pin the fingerprint back. `null` when both sources fail.
+ */
+export async function fetchLatestClaudeCodeVersion(
+	fetchImpl: FetchLike = fetch,
+	userAgent = "gajae-code/claude-code-version",
+): Promise<string | null> {
+	return highest(
+		await Promise.all([fetchReleaseChannel(fetchImpl, userAgent), fetchNpmDistTag(fetchImpl, userAgent)]),
+	);
+}
+
+interface CachedClaudeCodeVersion {
+	version: string;
+	checkedAt: number;
+}
+
+export interface ClaudeCodeVersionResolverOptions {
+	baseline: string;
+	/** Exact pin; disables network resolution when set. */
+	pinned?: string;
+	/** `null` disables both disk caching and network resolution. */
+	cachePath: string | null;
+	fetch?: FetchLike;
+	now?: () => number;
+	refreshIntervalMs?: number;
+}
+
+export interface ClaudeCodeVersionResolver {
+	/** Current fingerprint; schedules a background refresh when the cache is stale. */
+	get(): string;
+	/** Refresh now (deduplicated); resolves with the fingerprint afterwards. */
+	refresh(): Promise<string>;
+}
+
+export function createClaudeCodeVersionResolver(options: ClaudeCodeVersionResolverOptions): ClaudeCodeVersionResolver {
+	const { baseline, cachePath } = options;
+	const fetchImpl = options.fetch ?? fetch;
+	const now = options.now ?? Date.now;
+	const refreshIntervalMs = options.refreshIntervalMs ?? REFRESH_INTERVAL_MS;
+	const pinned = isExactSemver(options.pinned) ? options.pinned : undefined;
+
+	let loaded = false;
+	let resolved: string | undefined;
+	let checkedAt = 0;
+	let inflight: Promise<string> | undefined;
+
+	const current = (): string => (resolved && compareClaudeCodeVersions(resolved, baseline) > 0 ? resolved : baseline);
+
+	const loadCache = (): void => {
+		if (loaded || cachePath === null) return;
+		loaded = true;
+		try {
+			const data = JSON.parse(fs.readFileSync(cachePath, "utf-8")) as Partial<CachedClaudeCodeVersion>;
+			if (isExactSemver(data.version) && typeof data.checkedAt === "number" && Number.isFinite(data.checkedAt)) {
+				resolved = data.version;
+				checkedAt = data.checkedAt;
+			}
+		} catch (error) {
+			if (!isEnoent(error)) logger.debug("Ignoring unreadable Claude Code version cache", { error: String(error) });
+		}
+	};
+
+	const refresh = (): Promise<string> => {
+		if (pinned || cachePath === null) return Promise.resolve(pinned ?? current());
+		loadCache();
+		inflight ??= (async () => {
+			try {
+				const latest = await fetchLatestClaudeCodeVersion(fetchImpl);
+				// A failed lookup still counts as a check so an offline host does not
+				// retry on every request; the next attempt waits a full interval.
+				checkedAt = now();
+				if (latest && (!resolved || compareClaudeCodeVersions(latest, resolved) > 0)) resolved = latest;
+				if (resolved) {
+					const record: CachedClaudeCodeVersion = { version: resolved, checkedAt };
+					await Bun.write(cachePath, `${JSON.stringify(record)}\n`);
+				}
+			} catch (error) {
+				logger.debug("Claude Code version refresh failed", { error: String(error) });
+			} finally {
+				inflight = undefined;
+			}
+			return current();
+		})();
+		return inflight;
+	};
+
+	return {
+		get() {
+			if (pinned) return pinned;
+			if (cachePath === null) return baseline;
+			loadCache();
+			if (!inflight && now() - checkedAt >= refreshIntervalMs) void refresh();
+			return current();
+		},
+		refresh,
+	};
+}
+
+let defaultResolver: ClaudeCodeVersionResolver | undefined;
+
+function getDefaultResolver(): ClaudeCodeVersionResolver {
+	defaultResolver ??= createClaudeCodeVersionResolver({
+		baseline: CLAUDE_CODE_BASELINE_VERSION,
+		pinned: process.env[CLAUDE_CODE_VERSION_ENV]?.trim() || undefined,
+		// Tests must stay hermetic and deterministic: no network, no user cache.
+		cachePath: process.env.NODE_ENV === "test" ? null : path.resolve(getClaudeCodeVersionCachePath()),
+	});
+	return defaultResolver;
+}
+
+/** Claude Code version the `claude-cli` fingerprint and billing attribution sign with. */
+export function getClaudeCodeVersion(): string {
+	return getDefaultResolver().get();
+}

package/src/providers/kiro-codewhisperer.ts

@@ -58,11 +58,15 @@ interface WireToolSpec {
 }
 
 interface WireToolResult {
-	toolResultMessage: {
-		content: string;
-		toolUseId: string;
-		status?: "success" | "error";
-	};
+	toolUseId: string;
+	status: "success" | "error";
+	content: Array<{ text: string }>;
+}
+
+interface WireToolUse {
+	toolUseId: string;
+	name: string;
+	input: Record<string, unknown>;
 }
 
 interface WireUserMessage {
@@ -71,7 +75,7 @@ interface WireUserMessage {
 		modelId?: string;
 		userInputMessageContext?: {
 			tools?: { tools: WireToolSpec[] };
-			toolResults?: { toolResults: WireToolResult[][] };
+			toolResults?: WireToolResult[];
 			editorStateContext?: Record<string, unknown>;
 		};
 		origin?: string;
@@ -81,6 +85,7 @@ interface WireUserMessage {
 interface WireAssistantMessage {
 	assistantResponseMessage: {
 		content: string;
+		toolUses?: WireToolUse[];
 	};
 }
 
@@ -383,6 +388,21 @@ function buildConversationState(
 
 	for (let i = 0; i < messages.length - 1; i++) {
 		const msg = messages[i];
+		const previous = history[history.length - 1];
+		// Parallel tool calls produce consecutive toolResult messages; they answer one
+		// assistant turn, so their results share a single user entry.
+		if (
+			msg.role === "toolResult" &&
+			messages[i - 1]?.role === "toolResult" &&
+			previous &&
+			"userInputMessage" in previous
+		) {
+			previous.userInputMessage.userInputMessageContext ??= {};
+			const context = previous.userInputMessage.userInputMessageContext;
+			context.toolResults ??= [];
+			context.toolResults.push(convertToolResult(msg as ToolResultMessage));
+			continue;
+		}
 		history.push(convertToWireMessage(msg, modelId, i === 0 ? systemPrompt : undefined));
 	}
 
@@ -419,20 +439,27 @@ function convertToWireMessage(
 	if (msg.role === "toolResult") {
 		return convertToWireUserMessage(msg, modelId, systemPrompt);
 	}
-	// assistant → assistant response
+	// assistant → assistant response; tool calls stay structured so later tool
+	// results can reference the toolUseId they answer.
 	const textParts: string[] = [];
+	const toolUses: WireToolUse[] = [];
 	for (const block of msg.content) {
 		if (typeof block === "string") {
 			textParts.push(block);
 		} else if (block.type === "text") {
 			textParts.push(block.text);
 		} else if (block.type === "toolCall") {
-			textParts.push(JSON.stringify({ toolUseId: block.id, name: block.name, input: block.arguments }));
+			toolUses.push({
+				toolUseId: block.id,
+				name: block.name,
+				input: (block.arguments ?? {}) as Record<string, unknown>,
+			});
 		}
 	}
 	return {
 		assistantResponseMessage: {
-			content: textParts.join("\n") || "",
+			content: textParts.join("\n"),
+			...(toolUses.length > 0 ? { toolUses } : {}),
 		},
 	};
 }
@@ -442,7 +469,9 @@ function convertToWireUserMessage(
 	modelId: string,
 	systemPrompt?: string,
 ): WireUserMessage {
-	let content = extractTextContent(msg);
+	// A tool result travels in userInputMessageContext.toolResults; repeating it as
+	// message text would show the model each result twice.
+	let content = msg.role === "toolResult" ? "Tool results provided." : extractTextContent(msg);
 	if (systemPrompt) {
 		content = `${systemPrompt}\n\n${content}`;
 	}
@@ -454,27 +483,28 @@ function convertToWireUserMessage(
 		},
 	};
 
-	// Handle tool results
 	if (msg.role === "toolResult") {
-		const toolResultMsg = msg as ToolResultMessage;
-		const toolResults = (toolResultMsg.content ?? []).map(detail => ({
-			toolResultMessage: {
-				content: detail.type === "text" ? detail.text : "",
-				toolUseId: toolResultMsg.toolCallId,
-				status: toolResultMsg.isError ? ("error" as const) : ("success" as const),
-			},
-		}));
-		if (toolResults.length > 0) {
-			if (!userMsg.userInputMessage.userInputMessageContext) {
-				userMsg.userInputMessage.userInputMessageContext = {};
-			}
-			userMsg.userInputMessage.userInputMessageContext.toolResults = { toolResults: [toolResults] };
-		}
+		userMsg.userInputMessage.userInputMessageContext = {
+			toolResults: [convertToolResult(msg as ToolResultMessage)],
+		};
 	}
 
 	return userMsg;
 }
 
+/** One CodeWhisperer tool result per tool call, keyed by the toolUseId it answers. */
+function convertToolResult(msg: ToolResultMessage): WireToolResult {
+	const text = (msg.content ?? [])
+		.map(block => (block.type === "text" ? block.text : block.type === "image" ? "[image omitted]" : ""))
+		.filter(part => part.length > 0)
+		.join("\n");
+	return {
+		toolUseId: msg.toolCallId,
+		status: msg.isError ? "error" : "success",
+		content: [{ text }],
+	};
+}
+
 function extractTextContent(msg: Context["messages"][number]): string {
 	if (typeof msg.content === "string") return msg.content;
 	if (Array.isArray(msg.content)) {

package/src/providers/openai-codex-responses.ts

@@ -222,6 +222,14 @@ function isCodexStreamProgressEvent(event: unknown): boolean {
 	const delta = (event as { delta?: unknown }).delta;
 	return typeof delta === "string" && delta.length > 0;
 }
+
+function codexOutputHasMeaningfulProgress(output: AssistantMessage): boolean {
+	return output.content.some(
+		block =>
+			(block.type === "text" && block.text.length > 0) || (block.type === "thinking" && block.thinking.length > 0),
+	);
+}
+
 type CodexTransport = "sse" | "websocket";
 interface CodexInitialTransport {
 	eventStream: AsyncGenerator<Record<string, unknown>>;
@@ -412,7 +420,7 @@ function getCodexWebSocketIdleTimeoutMs(overrideMs?: number): number {
 		overrideMs ??
 		parseCodexPositiveInteger(
 			$env.GJC_OPENAI_CODE_WEBSOCKET_IDLE_TIMEOUT_MS ?? $env.PI_CODEX_WEBSOCKET_IDLE_TIMEOUT_MS,
-			CODEX_WEBSOCKET_IDLE_TIMEOUT_MS,
+			getOpenAIStreamIdleTimeoutMs() ?? CODEX_WEBSOCKET_IDLE_TIMEOUT_MS,
 		)
 	);
 }
@@ -1728,6 +1736,20 @@ async function recoverCodexStreamError(
 	error: unknown,
 ): Promise<boolean> {
 	if (isCodexFirstEventTimeout(error)) return false;
+	// A post-progress idle timeout has already consumed the stream's silence budget.
+	// Replaying it over another transport can leave the turn silent for another full window.
+	if (
+		(codexOutputHasMeaningfulProgress(context.output) ||
+			(context.output.content.some(block => block.type === "thinking") &&
+				context.output.content.some(
+					block => block.type === "toolCall" && !runtime.finalizedToolCallIds.has(block.id),
+				))) &&
+		error instanceof Error &&
+		isCodexWebSocketTransportError(error) &&
+		error.message.includes("idle timeout waiting for websocket")
+	) {
+		return false;
+	}
 	if (await tryRetryWithoutForcedToolChoice(context, runtime, error)) {
 		return true;
 	}

package/src/providers/openai-completions.ts

@@ -1,6 +1,6 @@
 import { scheduler } from "node:timers/promises";
 import { $credentialEnv, $env, extractHttpStatusFromError, logger } from "@gajae-code/utils";
-import OpenAI, { APIConnectionTimeoutError } from "openai";
+import OpenAI, { APIConnectionTimeoutError, type ClientOptions as OpenAIClientOptions } from "openai";
 import type {
 	ChatCompletionAssistantMessageParam,
 	ChatCompletionChunk,
@@ -1509,6 +1509,22 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 	return stream;
 };
 
+/**
+ * The OpenAI SDK retries pre-header timeouts and connection failures silently
+ * (its retry lines log at `info`, below the default `warn`, and go to console,
+ * which corrupts the TUI). Route them into the gjc log so a request stuck
+ * before response headers — where our stream watchdogs are not armed yet —
+ * leaves a trace instead of looking like a hung turn.
+ */
+const OPENAI_SDK_LOGGER: NonNullable<OpenAIClientOptions["logger"]> = {
+	error: message => logger.warn(`openai-sdk: ${message}`),
+	warn: message => logger.warn(`openai-sdk: ${message}`),
+	info: message => {
+		if (/retrying|timed out|connection failed/.test(message)) logger.warn(`openai-sdk: ${message}`);
+	},
+	debug: () => {},
+};
+
 async function createClient(
 	model: Model<"openai-completions">,
 	context: Context,
@@ -1680,6 +1696,8 @@ async function createClient(
 			defaultHeaders: headers,
 			fetch: debugFetch,
 			...(sdkTimeoutMs !== undefined ? { timeout: sdkTimeoutMs } : {}),
+			logLevel: "info",
+			logger: OPENAI_SDK_LOGGER,
 		}),
 		copilotPremiumRequests,
 		baseUrl,

package/src/usage/claude.ts

@@ -1,5 +1,5 @@
 import { scheduler } from "node:timers/promises";
-import { claudeCodeVersion } from "../providers/anthropic";
+import { getClaudeCodeVersion } from "../providers/claude-code-version";
 import type {
 	CredentialRankingStrategy,
 	UsageAmount,
@@ -32,7 +32,6 @@ const CLAUDE_HEADERS = {
 	"anthropic-beta":
 		"claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05",
 	"content-type": "application/json",
-	"user-agent": `claude-cli/${claudeCodeVersion} (external, cli)`,
 	connection: "keep-alive",
 } as const;
 
@@ -352,6 +351,7 @@ async function fetchClaudeUsage(params: UsageFetchParams, ctx: UsageFetchContext
 	const url = `${baseUrl}/usage`;
 	const headers: Record<string, string> = {
 		...CLAUDE_HEADERS,
+		"user-agent": `claude-cli/${getClaudeCodeVersion()} (external, cli)`,
 		authorization: `Bearer ${credential.accessToken}`,
 	};
 

package/dist/types/utils/h2-fetch.d.ts

@@ -1,35 +0,0 @@
-/**
- * Patch `globalThis.fetch` to advertise HTTP/2 in TLS ALPN, with transparent
- * HTTP/1.1 fallback when the server doesn't negotiate `h2`.
- *
- * Bun's HTTP/2 client is gated on `BUN_FEATURE_FLAG_EXPERIMENTAL_HTTP2_CLIENT`,
- * read by the native runtime before any JS executes; assigning to
- * `process.env` from inside JS is a no-op. Per-request `protocol: "http2"`
- * activates h2 over TLS ALPN and rejects with `error.code === "HTTP2Unsupported"`
- * if the server picks anything else, so we catch and retry without the hint.
- *
- * Some HTTPS endpoints (e.g. corporate API gateways behind reverse proxies)
- * advertise h2 via ALPN but then refuse or reset the connection at the HTTP/2
- * framing layer. Bun surfaces these as `ConnectionRefused`, `ConnectionReset`,
- * `ConnectionClosed`, or `HTTP2StreamReset` rather than `HTTP2Unsupported`.
- * `ConnectionRefused` is raised before the request is written, while
- * `HTTP2RefusedStream` is the explicit HTTP/2 promise that a stream was never
- * processed (including a stream above a graceful GOAWAY last-stream-id).
- * `ConnectionReset`, `ConnectionClosed`, and a generic `HTTP2StreamReset` do
- * not carry that promise: the peer may have consumed the body before the
- * connection failed. Retrying those codes would duplicate non-idempotent side
- * effects, so they preserve the original error instead of falling back.
- *
- * ALPN-refusing hosts (notably zcode.z.ai, the GLM ZCode OAuth broker) abort
- * the TLS handshake entirely when the client offers ALPN h2. Bun reports that
- * abort as `UNKNOWN_CERTIFICATE_VERIFICATION_ERROR` even though the host's
- * certificate chain verifies fine over h1 (issue #5178), so that code is a
- * fallback trigger too — never a reason to accept a bad certificate: the h1
- * attempt below performs full verification on its own.
- *
- * Bun negotiates h2 via ALPN over TLS only (no h2c), so plain `http://` URLs
- * skip the attempt entirely — avoids the throw/retry round-trip for localhost.
- *
- * Idempotent.
- */
-export declare function installH2Fetch(): void;

package/src/utils/h2-fetch.ts

@@ -1,133 +0,0 @@
-/**
- * Patch `globalThis.fetch` to advertise HTTP/2 in TLS ALPN, with transparent
- * HTTP/1.1 fallback when the server doesn't negotiate `h2`.
- *
- * Bun's HTTP/2 client is gated on `BUN_FEATURE_FLAG_EXPERIMENTAL_HTTP2_CLIENT`,
- * read by the native runtime before any JS executes; assigning to
- * `process.env` from inside JS is a no-op. Per-request `protocol: "http2"`
- * activates h2 over TLS ALPN and rejects with `error.code === "HTTP2Unsupported"`
- * if the server picks anything else, so we catch and retry without the hint.
- *
- * Some HTTPS endpoints (e.g. corporate API gateways behind reverse proxies)
- * advertise h2 via ALPN but then refuse or reset the connection at the HTTP/2
- * framing layer. Bun surfaces these as `ConnectionRefused`, `ConnectionReset`,
- * `ConnectionClosed`, or `HTTP2StreamReset` rather than `HTTP2Unsupported`.
- * `ConnectionRefused` is raised before the request is written, while
- * `HTTP2RefusedStream` is the explicit HTTP/2 promise that a stream was never
- * processed (including a stream above a graceful GOAWAY last-stream-id).
- * `ConnectionReset`, `ConnectionClosed`, and a generic `HTTP2StreamReset` do
- * not carry that promise: the peer may have consumed the body before the
- * connection failed. Retrying those codes would duplicate non-idempotent side
- * effects, so they preserve the original error instead of falling back.
- *
- * ALPN-refusing hosts (notably zcode.z.ai, the GLM ZCode OAuth broker) abort
- * the TLS handshake entirely when the client offers ALPN h2. Bun reports that
- * abort as `UNKNOWN_CERTIFICATE_VERIFICATION_ERROR` even though the host's
- * certificate chain verifies fine over h1 (issue #5178), so that code is a
- * fallback trigger too — never a reason to accept a bad certificate: the h1
- * attempt below performs full verification on its own.
- *
- * Bun negotiates h2 via ALPN over TLS only (no h2c), so plain `http://` URLs
- * skip the attempt entirely — avoids the throw/retry round-trip for localhost.
- *
- * Idempotent.
- */
-
-const installed: unique symbol = Symbol.for("gajae-code.h2fetch.installed");
-
-interface PatchedFetch {
-	[installed]?: true;
-}
-
-export function installH2Fetch(): void {
-	const original = globalThis.fetch as typeof fetch & PatchedFetch;
-	if (original[installed]) return;
-
-	/** Error codes that indicate h2 negotiation/transport failure (not an application error). */
-	const h2FallbackCodes: ReadonlySet<string> = new Set([
-		"HTTP2Unsupported", // Server selected h1 in ALPN
-		"ConnectionRefused", // Server refused the h2 connection
-		"HTTP2RefusedStream", // REFUSED_STREAM / never-processed h2 stream
-		// Bun's h2 client reports an ALPN-refusing host's TLS abort with this
-		// code; the h1 fallback below re-verifies the certificate itself.
-		"UNKNOWN_CERTIFICATE_VERIFICATION_ERROR",
-	]);
-	const wrapper = async function h2fetch(input: string | URL | Request, init?: RequestInit): Promise<Response> {
-		if (!isHttps(input)) return original(input, init);
-		const snapshot = snapshotRequest(input, init);
-		try {
-			return await original(snapshot.input, { ...snapshot.init, protocol: "http2" });
-		} catch (err) {
-			const code = (err as { code?: string }).code ?? "";
-			if (!h2FallbackCodes.has(code)) throw err;
-			if (code === "HTTP2RefusedStream" && !isReplayableRequest(snapshot.input, snapshot.init)) throw err;
-			return original(snapshot.input, snapshot.init);
-		}
-	} as typeof fetch & PatchedFetch;
-
-	// Preserve `fetch.preconnect` and any other statics SDK code might poke at.
-	Object.assign(wrapper, original);
-	wrapper[installed] = true;
-	globalThis.fetch = wrapper;
-}
-
-function snapshotRequest(
-	input: string | URL | Request,
-	init?: RequestInit,
-): { input: string | URL | Request; init?: RequestInit } {
-	const snapshotInput = input instanceof URL ? new URL(input.href) : input;
-	const requestLike = typeof input !== "string" && !(input instanceof URL);
-	if (init === undefined && !requestLike) {
-		return { input: snapshotInput };
-	}
-
-	const snapshotInit: RequestInit = { ...(init ?? {}) };
-	if (init?.headers !== undefined) {
-		snapshotInit.headers = snapshotHeaders(init.headers);
-	} else if (requestLike) {
-		snapshotInit.headers = new Headers(input.headers);
-	}
-	return { input: snapshotInput, init: snapshotInit };
-}
-
-function snapshotHeaders(headers: NonNullable<RequestInit["headers"]>): NonNullable<RequestInit["headers"]> {
-	if (headers instanceof Headers) return new Headers(headers);
-	if (Array.isArray(headers)) {
-		return headers.map(([name, value]) => [name, value] as [string, string]);
-	}
-	return { ...headers };
-}
-
-function isHttps(input: string | URL | Request): boolean {
-	if (typeof input === "string") return input.startsWith("https:");
-	if (input instanceof URL) return input.protocol === "https:";
-	return input.url.startsWith("https:");
-}
-
-/**
- * Whether the request body can be handed to fetch a second time. This is only
- * used after `HTTP2RefusedStream`, which proves that the peer did not consume
- * request bytes; a one-shot ReadableStream is still not reusable locally.
- */
-function isReplayableRequest(input: string | URL | Request, init?: RequestInit): boolean {
-	try {
-		if (init?.body !== undefined) return isReplayableBody(init.body);
-		if (typeof input === "string" || input instanceof URL) return true;
-		// Request bodies are exposed as ReadableStreams. The same Request object
-		// cannot be used for the second fetch once the first attempt touched it.
-		return input.body === null;
-	} catch {
-		// Cross-realm or proxy Request objects may throw while exposing their
-		// method/body. Do not retry when replayability cannot be established.
-		return false;
-	}
-}
-
-function isReplayableBody(body: RequestInit["body"]): boolean {
-	if (body === null || typeof body === "string") return true;
-	if (typeof Blob !== "undefined" && body instanceof Blob) return true;
-	// ArrayBuffer/views, FormData, and URLSearchParams are mutable caller-owned
-	// values. Fail closed instead of replaying a potentially changed payload if
-	// the asynchronous refusal arrives after the caller mutates one.
-	return false;
-}