@gajae-code/ai 0.18.1 → 0.18.6

package/src/providers/openai-completions.ts

@@ -1,6 +1,6 @@
 import { scheduler } from "node:timers/promises";
 import { $credentialEnv, $env, extractHttpStatusFromError, logger } from "@gajae-code/utils";
-import OpenAI, { APIConnectionTimeoutError } from "openai";
+import OpenAI, { APIConnectionTimeoutError, type ClientOptions as OpenAIClientOptions } from "openai";
 import type {
 	ChatCompletionAssistantMessageParam,
 	ChatCompletionChunk,
@@ -1509,6 +1509,22 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 	return stream;
 };
 
+/**
+ * The OpenAI SDK retries pre-header timeouts and connection failures silently
+ * (its retry lines log at `info`, below the default `warn`, and go to console,
+ * which corrupts the TUI). Route them into the gjc log so a request stuck
+ * before response headers — where our stream watchdogs are not armed yet —
+ * leaves a trace instead of looking like a hung turn.
+ */
+const OPENAI_SDK_LOGGER: NonNullable<OpenAIClientOptions["logger"]> = {
+	error: message => logger.warn(`openai-sdk: ${message}`),
+	warn: message => logger.warn(`openai-sdk: ${message}`),
+	info: message => {
+		if (/retrying|timed out|connection failed/.test(message)) logger.warn(`openai-sdk: ${message}`);
+	},
+	debug: () => {},
+};
+
 async function createClient(
 	model: Model<"openai-completions">,
 	context: Context,
@@ -1680,6 +1696,8 @@ async function createClient(
 			defaultHeaders: headers,
 			fetch: debugFetch,
 			...(sdkTimeoutMs !== undefined ? { timeout: sdkTimeoutMs } : {}),
+			logLevel: "info",
+			logger: OPENAI_SDK_LOGGER,
 		}),
 		copilotPremiumRequests,
 		baseUrl,

package/src/stream.ts

@@ -1022,8 +1022,28 @@ function mapOptionsForApi<TApi extends Api>(
 			// For older models: use budget-based thinking
 			if (model.thinking?.mode === "anthropic-adaptive") {
 				const effort = mapEffortToAnthropicAdaptiveEffort(model, reasoning);
+
+				// Adaptive mode sends effort directly (no explicit budget_tokens).
+				// However, the thinking consumes tokens from the overall max_tokens budget.
+				// If max_tokens is capped at DEFAULT_REQUEST_MAX_TOKENS (32k),
+				// high/xhigh/max reasoning consumes all 32k, leaving no output tokens.
+				// Solution: when caller did not explicitly set maxTokens,
+				// increase the cap to model.maxTokens to allow room for output.
+				let adaptiveMaxTokens = base.maxTokens ?? model.maxTokens;
+				const hasExplicitMaxTokens = Number.isSafeInteger(options?.maxTokens) && (options?.maxTokens as number) > 0;
+				if (
+					!hasExplicitMaxTokens &&
+					adaptiveMaxTokens === DEFAULT_REQUEST_MAX_TOKENS &&
+					Number.isSafeInteger(model.maxTokens) &&
+					model.maxTokens > DEFAULT_REQUEST_MAX_TOKENS
+				) {
+					// Increase to model.maxTokens to leave room for both thinking and output
+					adaptiveMaxTokens = model.maxTokens;
+				}
+
 				return castApi<"anthropic-messages">({
 					...base,
+					maxTokens: adaptiveMaxTokens,
 					thinkingEnabled: true,
 					effort,
 					toolChoice: mapAnthropicToolChoice(options?.toolChoice),

package/src/types.d.ts

@@ -746,7 +746,7 @@ export type TSchema = ZodType | TJsonSchema;
 export type Static<S> = S extends ZodType ? z.infer<S> : S extends {
     static: infer T;
 } ? T : unknown;
-export type RawArgumentRejectionCode = "ask-deep-interview-question-body-required" | "ask-intent-review-requires-positive-round" | "ask-intent-contract-requires-non-empty-authority" | "ask-deep-interview-metadata-requires-deep-interview-gate" | "ask-round-zero-metadata-requires-full-topology-fields" | "todo-write-unknown-root-key" | "todo-write-unknown-op-entry-key" | "todo-write-unknown-op-value" | "todo-write-done-drop-requires-target" | "todo-write-unknown-init-entry-key";
+export type RawArgumentRejectionCode = "ask-question-body-required" | "ask-deep-interview-metadata-required" | "ask-deep-interview-single-question-required" | "ask-deep-interview-question-body-required" | "ask-intent-review-requires-positive-round" | "ask-intent-contract-requires-non-empty-authority" | "ask-deep-interview-metadata-requires-deep-interview-gate" | "ask-round-zero-metadata-requires-full-topology-fields" | "todo-write-unknown-root-key" | "todo-write-unknown-op-entry-key" | "todo-write-unknown-op-value" | "todo-write-done-drop-requires-target" | "todo-write-unknown-init-entry-key";
 /**
  * Optional structured detail attached to a raw-argument rejection. The fixed
  * per-code guidance in `RAW_ARGUMENT_REJECTION_MESSAGES` explains the shape;

package/src/types.ts

@@ -1019,6 +1019,9 @@ export type TSchema = ZodType | TJsonSchema;
 export type Static<S> = S extends ZodType ? z.infer<S> : S extends { static: infer T } ? T : unknown;
 
 export type RawArgumentRejectionCode =
+	| "ask-question-body-required"
+	| "ask-deep-interview-metadata-required"
+	| "ask-deep-interview-single-question-required"
 	| "ask-deep-interview-question-body-required"
 	| "ask-intent-review-requires-positive-round"
 	| "ask-intent-contract-requires-non-empty-authority"

package/src/utils/fallback-transport.d.ts

@@ -23,6 +23,12 @@ export interface FallbackTrigger {
 export declare const STREAM_FIRST_EVENT_TIMEOUT_PROVIDER_CODE = "stream_first_event_timeout";
 /** Stable code for a nominally successful response with no content or token usage. */
 export declare const EMPTY_RESPONSE_PROVIDER_CODE = "empty_response";
+/**
+ * Terminal error code for a successful HTTP response whose body is not the protocol the
+ * provider speaks (for example a JSON or HTML error returned with 200). Deterministic for
+ * the request, so session retry and managed fallback must surface it instead of replaying.
+ */
+export declare const PROVIDER_PROTOCOL_MISMATCH_ERROR_CODE = "provider_protocol_mismatch";
 /**
  * OpenAI's typed capacity-overload code. It arrives without an HTTP status —
  * inside an HTTP 200 terminal Responses envelope or a Codex error event — so the

package/src/utils/fallback-transport.ts

@@ -26,6 +26,12 @@ export interface FallbackTrigger {
 export const STREAM_FIRST_EVENT_TIMEOUT_PROVIDER_CODE = "stream_first_event_timeout";
 /** Stable code for a nominally successful response with no content or token usage. */
 export const EMPTY_RESPONSE_PROVIDER_CODE = "empty_response";
+/**
+ * Terminal error code for a successful HTTP response whose body is not the protocol the
+ * provider speaks (for example a JSON or HTML error returned with 200). Deterministic for
+ * the request, so session retry and managed fallback must surface it instead of replaying.
+ */
+export const PROVIDER_PROTOCOL_MISMATCH_ERROR_CODE = "provider_protocol_mismatch";
 /**
  * OpenAI's typed capacity-overload code. It arrives without an HTTP status —
  * inside an HTTP 200 terminal Responses envelope or a Codex error event — so the

package/src/utils/idle-iterator.ts

@@ -202,6 +202,13 @@ export class FirstEventTimeoutError extends Error {
 	}
 }
 
+/**
+ * Longest delay setTimeout honors. Bun, like Node, fires any larger delay after 1 ms,
+ * so a very long timeout (for example an env value meant as "effectively never")
+ * would otherwise abort the stream immediately.
+ */
+const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+
 const dummyWatchdog = setTimeout(() => {}, 1);
 clearTimeout(dummyWatchdog);
 
@@ -211,7 +218,7 @@ clearTimeout(dummyWatchdog);
  */
 export function createWatchdog(timeoutMs: number | undefined, onTimeout: () => void): Watchdog {
 	if (timeoutMs !== undefined && timeoutMs > 0) {
-		return setTimeout(onTimeout, timeoutMs);
+		return setTimeout(onTimeout, Math.min(timeoutMs, MAX_TIMER_DELAY_MS));
 	}
 	return undefined;
 }
@@ -335,10 +342,10 @@ export async function* iterateWithIdleTimeout<T>(
 			let timer: NodeJS.Timeout | undefined;
 			let resolveTimeout: ((value: { kind: "timeout" }) => void) | undefined;
 			const enforceTimeout = !noTimeoutEnforced && activeTimeoutMs !== undefined && activeTimeoutMs >= 0;
-			if (enforceTimeout) {
+			if (enforceTimeout && activeTimeoutMs !== undefined) {
 				const { promise, resolve } = Promise.withResolvers<{ kind: "timeout" }>();
 				resolveTimeout = resolve;
-				timer = setTimeout(() => resolve({ kind: "timeout" }), activeTimeoutMs);
+				timer = setTimeout(() => resolve({ kind: "timeout" }), Math.min(activeTimeoutMs, MAX_TIMER_DELAY_MS));
 				racers.push(promise);
 			}
 

package/src/utils/oauth/glm-zcode.d.ts

@@ -57,6 +57,11 @@ export declare class GlmZcodeOAuthFlow extends OAuthCallbackFlow {
     }>;
     exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials>;
 }
+/**
+ * Manual-input prompt for the paste fallback. Repeats the redirect-URL shape and
+ * the DevTools pointer so a re-prompt after a rejected paste stays self-contained.
+ */
+export declare const GLM_ZCODE_MANUAL_INPUT_PROMPT = "Paste the full zcode://oauth/callback?code=\u2026&state=\u2026 URL (copy it from browser DevTools \u2192 Network tab; the address bar never shows it) or the authorization code:";
 export declare function loginGlmZcode(ctrl: OAuthController, options?: GlmZcodeOAuthFlowOptions): Promise<OAuthCredentials>;
 export interface GlmZcodeRefreshOptions {
     signal?: AbortSignal;

package/src/utils/oauth/glm-zcode.ts

@@ -387,7 +387,7 @@ export class GlmZcodeOAuthFlow extends OAuthCallbackFlow {
 		return {
 			url: `${authorizeUrl}?${params.toString()}`,
 			instructions:
-				"Complete Z.AI login in your browser. This is an UNOFFICIAL ZCode-based login — use at your own risk; it may stop working or violate ZCode/Z.AI Terms of Service. Because this CLI cannot receive the zcode:// redirect, paste the final redirect URL or authorization code when prompted. If the ZCode desktop app is installed, cancel the browser's prompt to open it: the app exchanges the single-use code itself and the pasted code is then rejected (broker error 2007).",
+				"Complete Z.AI login in your browser. This is an UNOFFICIAL ZCode-based login — use at your own risk; it may stop working or violate ZCode/Z.AI Terms of Service. If the ZCode desktop app is installed, cancel the browser's prompt to open it: the app exchanges the single-use code itself and the pasted code is then rejected (broker error 2007). After login the browser redirects to a zcode:// address, which never appears in the address bar — copy it from DevTools instead: open the browser DevTools Network tab (filter: zcode), select the zcode://oauth/callback?code=…&state=… request, and paste that full URL (or just the code) at the prompt.",
 		};
 	}
 
@@ -396,6 +396,13 @@ export class GlmZcodeOAuthFlow extends OAuthCallbackFlow {
 	}
 }
 
+/**
+ * Manual-input prompt for the paste fallback. Repeats the redirect-URL shape and
+ * the DevTools pointer so a re-prompt after a rejected paste stays self-contained.
+ */
+export const GLM_ZCODE_MANUAL_INPUT_PROMPT =
+	"Paste the full zcode://oauth/callback?code=…&state=… URL (copy it from browser DevTools → Network tab; the address bar never shows it) or the authorization code:";
+
 export async function loginGlmZcode(
 	ctrl: OAuthController,
 	options?: GlmZcodeOAuthFlowOptions,

package/src/utils/oauth/index.ts

@@ -9,6 +9,16 @@ import type {
 	OAuthProviderInterface,
 } from "./types";
 
+export class UnknownOAuthProviderError extends Error {
+	readonly provider: string;
+
+	constructor(provider: string) {
+		super(`Unknown OAuth provider: ${provider}`);
+		this.name = "UnknownOAuthProviderError";
+		this.provider = provider;
+	}
+}
+
 const builtInOAuthProviders: OAuthProviderInfo[] = [
 	{
 		id: "anthropic",
@@ -442,7 +452,7 @@ export async function refreshOAuthToken(
 			newCredentials = credentials;
 			break;
 		default:
-			throw new Error(`Unknown OAuth provider: ${provider}`);
+			throw new UnknownOAuthProviderError(provider);
 	}
 	return newCredentials;
 }

package/src/utils/validation.ts

@@ -960,6 +960,11 @@ export function validateToolCall(tools: Tool[], toolCall: ToolCall): ToolCall["a
 }
 
 const RAW_ARGUMENT_REJECTION_MESSAGES: Record<RawArgumentRejectionCode, string> = {
+	"ask-question-body-required": "ask question bodies must contain non-whitespace text; remove empty extra questions",
+	"ask-deep-interview-metadata-required":
+		"active deep-interview questions require structured deepInterview metadata; question prose and workflowGate do not record an answer",
+	"ask-deep-interview-single-question-required":
+		"active deep-interview asks require exactly one question; include metadata on that question, never as an extra question",
 	"ask-deep-interview-question-body-required":
 		"deep-interview question bodies must contain a specific question, not a placeholder",
 	"ask-intent-review-requires-positive-round":

package/dist/types/utils/h2-fetch.d.ts

@@ -1,35 +0,0 @@
-/**
- * Patch `globalThis.fetch` to advertise HTTP/2 in TLS ALPN, with transparent
- * HTTP/1.1 fallback when the server doesn't negotiate `h2`.
- *
- * Bun's HTTP/2 client is gated on `BUN_FEATURE_FLAG_EXPERIMENTAL_HTTP2_CLIENT`,
- * read by the native runtime before any JS executes; assigning to
- * `process.env` from inside JS is a no-op. Per-request `protocol: "http2"`
- * activates h2 over TLS ALPN and rejects with `error.code === "HTTP2Unsupported"`
- * if the server picks anything else, so we catch and retry without the hint.
- *
- * Some HTTPS endpoints (e.g. corporate API gateways behind reverse proxies)
- * advertise h2 via ALPN but then refuse or reset the connection at the HTTP/2
- * framing layer. Bun surfaces these as `ConnectionRefused`, `ConnectionReset`,
- * `ConnectionClosed`, or `HTTP2StreamReset` rather than `HTTP2Unsupported`.
- * `ConnectionRefused` is raised before the request is written, while
- * `HTTP2RefusedStream` is the explicit HTTP/2 promise that a stream was never
- * processed (including a stream above a graceful GOAWAY last-stream-id).
- * `ConnectionReset`, `ConnectionClosed`, and a generic `HTTP2StreamReset` do
- * not carry that promise: the peer may have consumed the body before the
- * connection failed. Retrying those codes would duplicate non-idempotent side
- * effects, so they preserve the original error instead of falling back.
- *
- * ALPN-refusing hosts (notably zcode.z.ai, the GLM ZCode OAuth broker) abort
- * the TLS handshake entirely when the client offers ALPN h2. Bun reports that
- * abort as `UNKNOWN_CERTIFICATE_VERIFICATION_ERROR` even though the host's
- * certificate chain verifies fine over h1 (issue #5178), so that code is a
- * fallback trigger too — never a reason to accept a bad certificate: the h1
- * attempt below performs full verification on its own.
- *
- * Bun negotiates h2 via ALPN over TLS only (no h2c), so plain `http://` URLs
- * skip the attempt entirely — avoids the throw/retry round-trip for localhost.
- *
- * Idempotent.
- */
-export declare function installH2Fetch(): void;

package/src/utils/h2-fetch.ts

@@ -1,133 +0,0 @@
-/**
- * Patch `globalThis.fetch` to advertise HTTP/2 in TLS ALPN, with transparent
- * HTTP/1.1 fallback when the server doesn't negotiate `h2`.
- *
- * Bun's HTTP/2 client is gated on `BUN_FEATURE_FLAG_EXPERIMENTAL_HTTP2_CLIENT`,
- * read by the native runtime before any JS executes; assigning to
- * `process.env` from inside JS is a no-op. Per-request `protocol: "http2"`
- * activates h2 over TLS ALPN and rejects with `error.code === "HTTP2Unsupported"`
- * if the server picks anything else, so we catch and retry without the hint.
- *
- * Some HTTPS endpoints (e.g. corporate API gateways behind reverse proxies)
- * advertise h2 via ALPN but then refuse or reset the connection at the HTTP/2
- * framing layer. Bun surfaces these as `ConnectionRefused`, `ConnectionReset`,
- * `ConnectionClosed`, or `HTTP2StreamReset` rather than `HTTP2Unsupported`.
- * `ConnectionRefused` is raised before the request is written, while
- * `HTTP2RefusedStream` is the explicit HTTP/2 promise that a stream was never
- * processed (including a stream above a graceful GOAWAY last-stream-id).
- * `ConnectionReset`, `ConnectionClosed`, and a generic `HTTP2StreamReset` do
- * not carry that promise: the peer may have consumed the body before the
- * connection failed. Retrying those codes would duplicate non-idempotent side
- * effects, so they preserve the original error instead of falling back.
- *
- * ALPN-refusing hosts (notably zcode.z.ai, the GLM ZCode OAuth broker) abort
- * the TLS handshake entirely when the client offers ALPN h2. Bun reports that
- * abort as `UNKNOWN_CERTIFICATE_VERIFICATION_ERROR` even though the host's
- * certificate chain verifies fine over h1 (issue #5178), so that code is a
- * fallback trigger too — never a reason to accept a bad certificate: the h1
- * attempt below performs full verification on its own.
- *
- * Bun negotiates h2 via ALPN over TLS only (no h2c), so plain `http://` URLs
- * skip the attempt entirely — avoids the throw/retry round-trip for localhost.
- *
- * Idempotent.
- */
-
-const installed: unique symbol = Symbol.for("gajae-code.h2fetch.installed");
-
-interface PatchedFetch {
-	[installed]?: true;
-}
-
-export function installH2Fetch(): void {
-	const original = globalThis.fetch as typeof fetch & PatchedFetch;
-	if (original[installed]) return;
-
-	/** Error codes that indicate h2 negotiation/transport failure (not an application error). */
-	const h2FallbackCodes: ReadonlySet<string> = new Set([
-		"HTTP2Unsupported", // Server selected h1 in ALPN
-		"ConnectionRefused", // Server refused the h2 connection
-		"HTTP2RefusedStream", // REFUSED_STREAM / never-processed h2 stream
-		// Bun's h2 client reports an ALPN-refusing host's TLS abort with this
-		// code; the h1 fallback below re-verifies the certificate itself.
-		"UNKNOWN_CERTIFICATE_VERIFICATION_ERROR",
-	]);
-	const wrapper = async function h2fetch(input: string | URL | Request, init?: RequestInit): Promise<Response> {
-		if (!isHttps(input)) return original(input, init);
-		const snapshot = snapshotRequest(input, init);
-		try {
-			return await original(snapshot.input, { ...snapshot.init, protocol: "http2" });
-		} catch (err) {
-			const code = (err as { code?: string }).code ?? "";
-			if (!h2FallbackCodes.has(code)) throw err;
-			if (code === "HTTP2RefusedStream" && !isReplayableRequest(snapshot.input, snapshot.init)) throw err;
-			return original(snapshot.input, snapshot.init);
-		}
-	} as typeof fetch & PatchedFetch;
-
-	// Preserve `fetch.preconnect` and any other statics SDK code might poke at.
-	Object.assign(wrapper, original);
-	wrapper[installed] = true;
-	globalThis.fetch = wrapper;
-}
-
-function snapshotRequest(
-	input: string | URL | Request,
-	init?: RequestInit,
-): { input: string | URL | Request; init?: RequestInit } {
-	const snapshotInput = input instanceof URL ? new URL(input.href) : input;
-	const requestLike = typeof input !== "string" && !(input instanceof URL);
-	if (init === undefined && !requestLike) {
-		return { input: snapshotInput };
-	}
-
-	const snapshotInit: RequestInit = { ...(init ?? {}) };
-	if (init?.headers !== undefined) {
-		snapshotInit.headers = snapshotHeaders(init.headers);
-	} else if (requestLike) {
-		snapshotInit.headers = new Headers(input.headers);
-	}
-	return { input: snapshotInput, init: snapshotInit };
-}
-
-function snapshotHeaders(headers: NonNullable<RequestInit["headers"]>): NonNullable<RequestInit["headers"]> {
-	if (headers instanceof Headers) return new Headers(headers);
-	if (Array.isArray(headers)) {
-		return headers.map(([name, value]) => [name, value] as [string, string]);
-	}
-	return { ...headers };
-}
-
-function isHttps(input: string | URL | Request): boolean {
-	if (typeof input === "string") return input.startsWith("https:");
-	if (input instanceof URL) return input.protocol === "https:";
-	return input.url.startsWith("https:");
-}
-
-/**
- * Whether the request body can be handed to fetch a second time. This is only
- * used after `HTTP2RefusedStream`, which proves that the peer did not consume
- * request bytes; a one-shot ReadableStream is still not reusable locally.
- */
-function isReplayableRequest(input: string | URL | Request, init?: RequestInit): boolean {
-	try {
-		if (init?.body !== undefined) return isReplayableBody(init.body);
-		if (typeof input === "string" || input instanceof URL) return true;
-		// Request bodies are exposed as ReadableStreams. The same Request object
-		// cannot be used for the second fetch once the first attempt touched it.
-		return input.body === null;
-	} catch {
-		// Cross-realm or proxy Request objects may throw while exposing their
-		// method/body. Do not retry when replayability cannot be established.
-		return false;
-	}
-}
-
-function isReplayableBody(body: RequestInit["body"]): boolean {
-	if (body === null || typeof body === "string") return true;
-	if (typeof Blob !== "undefined" && body instanceof Blob) return true;
-	// ArrayBuffer/views, FormData, and URLSearchParams are mutable caller-owned
-	// values. Fail closed instead of replaying a potentially changed payload if
-	// the asynchronous refusal arrives after the caller mutates one.
-	return false;
-}