@juspay/neurolink 11.17.3 → 11.18.1

package/dist/cli/commands/proxy.js

@@ -1158,6 +1158,7 @@ export async function createProxyStartApp(params) {
     const { createClaudeProxyRoutes } = await import("../../server/routes/claudeProxyRoutes.js");
     const { createOpenAIProxyRoutes } = await import("../../server/routes/openaiProxyRoutes.js");
     const { createCodexProxyRoutes } = await import("../../server/routes/codexProxyRoutes.js");
+    const { createGeminiProxyRoutes } = await import("../../server/routes/geminiProxyRoutes.js");
     const { logBodyCapture, logRequest } = await import("../../proxy/requestLogger.js");
     const { recordFinalError } = await import("../../proxy/usageStats.js");
     const { Hono } = await import("hono");
@@ -1279,10 +1280,12 @@ export async function createProxyStartApp(params) {
         : params.accountAllowlist);
     const openaiRouteGroup = createOpenAIProxyRoutes(params.modelRouter, "", params.port, runtimeConfigProvider);
     const codexRouteGroup = createCodexProxyRoutes("");
+    const geminiRouteGroup = createGeminiProxyRoutes(params.modelRouter, "", params.port, runtimeConfigProvider);
     const allProxyRoutes = [
         ...routeGroup.routes,
         ...openaiRouteGroup.routes,
         ...codexRouteGroup.routes,
+        ...geminiRouteGroup.routes,
     ];
     for (const route of allProxyRoutes) {
         const method = route.method.toLowerCase();

package/dist/cli/proxy-clients/claudeCode.js

@@ -8,7 +8,7 @@
 import { homedir } from "os";
 import { join } from "path";
 import { logger } from "../../utils/logger.js";
-import { isProxyOwnedValue, shouldCaptureSnapshot } from "./snapshot.js";
+import { isProxyOwnedValue, shouldCaptureSnapshot, writeFileAtomic, } from "./snapshot.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.
@@ -63,7 +63,7 @@ export async function setClaudeProxySettings(baseUrl) {
         ANTHROPIC_BASE_URL: baseUrl,
         ENABLE_TOOL_SEARCH: "true",
     };
-    fs.writeFileSync(getClaudeSettingsPath(), JSON.stringify(settings, null, 2));
+    await writeFileAtomic(getClaudeSettingsPath(), JSON.stringify(settings, null, 2));
 }
 export async function clearClaudeProxySettings(expectedBaseUrl) {
     const fs = await import("fs");
@@ -128,7 +128,7 @@ export async function clearClaudeProxySettings(expectedBaseUrl) {
     else {
         settings.env = env;
     }
-    fs.writeFileSync(getClaudeSettingsPath(), JSON.stringify(settings, null, 2));
+    await writeFileAtomic(getClaudeSettingsPath(), JSON.stringify(settings, null, 2));
     return hadBaseUrl || hadToolSearch;
 }
 export const claudeCodeConfigurator = {

package/dist/cli/proxy-clients/codex.js

@@ -7,6 +7,7 @@
 import { homedir } from "os";
 import { join } from "path";
 import { logger } from "../../utils/logger.js";
+import { writeFileAtomic } from "./snapshot.js";
 //
 // Points the Codex CLI at the proxy by managing `~/.codex/config.toml`:
 //   - appends a marker-delimited `[model_providers.neurolink]` table
@@ -92,7 +93,7 @@ export async function setCodexProxySettings(baseUrl) {
                 ? providerMatch[0]
                 : null;
             fs.mkdirSync(join(homedir(), ".neurolink"), { recursive: true });
-            fs.writeFileSync(getCodexSnapshotPath(), JSON.stringify({ originalProviderLine }, null, 2), { mode: 0o600 });
+            await writeFileAtomic(getCodexSnapshotPath(), JSON.stringify({ originalProviderLine }, null, 2), 0o600);
         }
         let text = stripCodexManagedConfig(original);
         // Set the selector: replace an existing top-level model_provider or insert
@@ -113,7 +114,7 @@ export async function setCodexProxySettings(baseUrl) {
             text = `model_provider = "neurolink"\n${text}`;
         }
         const trimmed = text.replace(/\s*$/, "\n");
-        fs.writeFileSync(getCodexConfigPath(), `${trimmed}\n${buildCodexProviderBlock(baseUrl)}`);
+        await writeFileAtomic(getCodexConfigPath(), `${trimmed}\n${buildCodexProviderBlock(baseUrl)}`);
         return true;
     }
     catch (error) {
@@ -182,7 +183,7 @@ export async function clearCodexProxySettings(expectedBaseUrl) {
             }
             return false;
         }
-        fs.writeFileSync(getCodexConfigPath(), text.replace(/\s*$/, "\n"));
+        await writeFileAtomic(getCodexConfigPath(), text.replace(/\s*$/, "\n"));
         try {
             fs.rmSync(getCodexSnapshotPath(), { force: true });
         }

package/dist/cli/proxy-clients/copilot.js

@@ -24,6 +24,7 @@
 import { homedir } from "os";
 import { join } from "path";
 import { logger } from "../../utils/logger.js";
+import { writeFileAtomic } from "./snapshot.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.
@@ -61,12 +62,11 @@ export async function setCopilotProxySettings(baseUrl, proxyKey) {
     try {
         const envPath = getCopilotEnvPath();
         fs.mkdirSync(join(homedir(), ".neurolink"), { recursive: true });
-        fs.writeFileSync(envPath, buildCopilotEnvScript(baseUrl, proxyKey || "neurolink-proxy"), { mode: 0o600 });
-        // The mode option above only applies when open() creates the file. On an
-        // overwrite it is ignored, so a pre-existing file keeps whatever
-        // permissions it had — which for a file holding a proxy key could be
-        // world-readable. Enforce it on both paths.
-        fs.chmodSync(envPath, 0o600);
+        // 0600 is applied to the temp file before the rename, so the script never
+        // exists at the destination with wider permissions — not even briefly.
+        // writeFileSync's own mode option would not do this: it applies only when
+        // open() creates the file, so an overwrite kept whatever mode was there.
+        await writeFileAtomic(envPath, buildCopilotEnvScript(baseUrl, proxyKey || "neurolink-proxy"), 0o600);
         return true;
     }
     catch (error) {

package/dist/cli/proxy-clients/openCode.js

@@ -7,7 +7,7 @@
 import { homedir } from "os";
 import { join } from "path";
 import { logger } from "../../utils/logger.js";
-import { cloneForSnapshot, isProxyOwnedValue, shouldCaptureSnapshot, } from "./snapshot.js";
+import { cloneForSnapshot, isProxyOwnedValue, shouldCaptureSnapshot, writeFileAtomic, } from "./snapshot.js";
 function getOpenCodeConfigDir() {
     // OpenCode resolves this with the unmodified `xdg-basedir` package —
     // `XDG_CONFIG_HOME || ~/.config` — on every platform, macOS included. There
@@ -82,7 +82,7 @@ export async function setOpenCodeProxySettings(baseUrl, proxyKey) {
     provider.neurolink = block;
     config[OPENCODE_WRITTEN_KEY] = cloneForSnapshot(block);
     config.provider = provider;
-    fs.writeFileSync(getOpenCodeConfigPath(), JSON.stringify(config, null, 2));
+    await writeFileAtomic(getOpenCodeConfigPath(), JSON.stringify(config, null, 2));
     return true;
 }
 export async function clearOpenCodeProxySettings(expectedBaseUrl) {
@@ -146,7 +146,7 @@ export async function clearOpenCodeProxySettings(expectedBaseUrl) {
         return false;
     }
     config.provider = provider;
-    fs.writeFileSync(getOpenCodeConfigPath(), JSON.stringify(config, null, 2));
+    await writeFileAtomic(getOpenCodeConfigPath(), JSON.stringify(config, null, 2));
     return hadNeurolink;
 }
 /**

package/dist/cli/proxy-clients/qwenCode.js

@@ -20,7 +20,7 @@
 import { homedir } from "os";
 import { join } from "path";
 import { logger } from "../../utils/logger.js";
-import { cloneForSnapshot, isProxyOwnedValue, shouldCaptureSnapshot, } from "./snapshot.js";
+import { cloneForSnapshot, isProxyOwnedValue, shouldCaptureSnapshot, writeFileAtomic, } from "./snapshot.js";
 /**
  * Resolved per call rather than at module load so `detect()` and `apply()`
  * agree when HOME changes — under test, and on the `--dev` isolation path.
@@ -87,7 +87,7 @@ export async function setQwenProxySettings(baseUrl, proxyKey) {
     security.auth = auth;
     settings.security = security;
     settings[QWEN_WRITTEN_KEY] = cloneForSnapshot(auth);
-    fs.writeFileSync(getQwenSettingsPath(), JSON.stringify(settings, null, 2));
+    await writeFileAtomic(getQwenSettingsPath(), JSON.stringify(settings, null, 2));
     return true;
 }
 export async function clearQwenProxySettings(expectedBaseUrl) {
@@ -133,7 +133,7 @@ export async function clearQwenProxySettings(expectedBaseUrl) {
     delete settings[QWEN_ORIGINAL_KEY];
     delete settings[QWEN_WRITTEN_KEY];
     settings.security = security;
-    fs.writeFileSync(getQwenSettingsPath(), JSON.stringify(settings, null, 2));
+    await writeFileAtomic(getQwenSettingsPath(), JSON.stringify(settings, null, 2));
     return true;
 }
 export const qwenCodeConfigurator = {

package/dist/cli/proxy-clients/snapshot.d.ts

@@ -50,3 +50,54 @@ export declare function isProxyOwnedValue(args: {
     written: unknown;
     current: unknown;
 }): boolean;
+/**
+ * Replace a file's contents without ever exposing a partial one.
+ *
+ * `writeFileSync` opens with `O_TRUNC`, so from the truncate until the last
+ * byte lands the user's config is short — and a real config spans several
+ * syscalls, not an instant. Anything reading concurrently, the CLI the config
+ * belongs to included, can load a truncated file; a crash in that window leaves
+ * it truncated permanently. Both Qwen and OpenCode keep live API keys there.
+ *
+ * Writing to a sibling temp file and renaming closes it: `rename(2)` within a
+ * directory is atomic, so a reader sees either the whole old file or the whole
+ * new one. The temp file must be a sibling — a rename across filesystems is a
+ * copy, which reintroduces exactly the window this removes.
+ *
+ * PERMISSIONS ARE THE SUBTLE PART, and getting them wrong here leaks API keys.
+ *
+ * Writing through a temp file changes who decides the destination's mode. A
+ * plain `writeFileSync` over an existing file leaves that file's mode alone, so
+ * a config the user had locked to 0600 stayed 0600. A rename replaces the inode,
+ * so the destination inherits the TEMP file's mode instead — and a temp file
+ * created without an explicit mode lands at 0666 minus umask, i.e. 0644 on a
+ * default system. Left unhandled, making the write atomic would have quietly
+ * widened every credential file it touched from 0600 to 0644.
+ *
+ * So when the caller does not specify a mode, the destination's current mode is
+ * carried over, which reproduces `writeFileSync`'s behaviour exactly; a file
+ * that does not exist yet starts at 0600 rather than whatever umask allows.
+ *
+ * The mode is applied at CREATE time, not after. `writeFileSync` followed by
+ * `chmodSync` would put the credential bytes on disk at 0644 first and tighten
+ * them a moment later — a window a local reader can win. The trailing `chmod`
+ * remains only to pin the exact mode, since umask masks the create mode; by
+ * then the file has never been readable more widely than its final mode.
+ *
+ * On Windows the guarantee holds but the failure mode differs, which is worth
+ * stating because the obvious worry there is the wrong one. Node's `renameSync`
+ * is `MoveFileExW` with `MOVEFILE_REPLACE_EXISTING`; replacing a file on the
+ * same volume is an atomic directory-entry update, so a concurrent reader still
+ * sees the whole old file or the whole new one and never a torn one. What
+ * Windows adds is that the rename can *fail* — `EPERM`/`EBUSY` when a reader
+ * holds the destination open — where POSIX would succeed. That path is safe:
+ * the catch below removes the temp file and rethrows, leaving the previous
+ * config intact for the caller to report on.
+ *
+ * The sibling rule above is what makes that true. `MOVEFILE_COPY_ALLOWED` is
+ * also set, so a cross-volume rename silently degrades to copy-then-delete and
+ * is NOT atomic. Moving the temp file to `os.tmpdir()` would look like a
+ * tidy-up and would quietly restore the exact window this function exists to
+ * close, on Windows only, where nobody here would see it.
+ */
+export declare function writeFileAtomic(filePath: string, contents: string, mode?: number): Promise<void>;

package/dist/cli/proxy-clients/snapshot.js

@@ -95,4 +95,101 @@ export function isProxyOwnedValue(args) {
     }
     return valuesMatch(args.current, args.written);
 }
+/** Distinguishes concurrent writers within one process. */
+let atomicWriteCounter = 0;
+/**
+ * Replace a file's contents without ever exposing a partial one.
+ *
+ * `writeFileSync` opens with `O_TRUNC`, so from the truncate until the last
+ * byte lands the user's config is short — and a real config spans several
+ * syscalls, not an instant. Anything reading concurrently, the CLI the config
+ * belongs to included, can load a truncated file; a crash in that window leaves
+ * it truncated permanently. Both Qwen and OpenCode keep live API keys there.
+ *
+ * Writing to a sibling temp file and renaming closes it: `rename(2)` within a
+ * directory is atomic, so a reader sees either the whole old file or the whole
+ * new one. The temp file must be a sibling — a rename across filesystems is a
+ * copy, which reintroduces exactly the window this removes.
+ *
+ * PERMISSIONS ARE THE SUBTLE PART, and getting them wrong here leaks API keys.
+ *
+ * Writing through a temp file changes who decides the destination's mode. A
+ * plain `writeFileSync` over an existing file leaves that file's mode alone, so
+ * a config the user had locked to 0600 stayed 0600. A rename replaces the inode,
+ * so the destination inherits the TEMP file's mode instead — and a temp file
+ * created without an explicit mode lands at 0666 minus umask, i.e. 0644 on a
+ * default system. Left unhandled, making the write atomic would have quietly
+ * widened every credential file it touched from 0600 to 0644.
+ *
+ * So when the caller does not specify a mode, the destination's current mode is
+ * carried over, which reproduces `writeFileSync`'s behaviour exactly; a file
+ * that does not exist yet starts at 0600 rather than whatever umask allows.
+ *
+ * The mode is applied at CREATE time, not after. `writeFileSync` followed by
+ * `chmodSync` would put the credential bytes on disk at 0644 first and tighten
+ * them a moment later — a window a local reader can win. The trailing `chmod`
+ * remains only to pin the exact mode, since umask masks the create mode; by
+ * then the file has never been readable more widely than its final mode.
+ *
+ * On Windows the guarantee holds but the failure mode differs, which is worth
+ * stating because the obvious worry there is the wrong one. Node's `renameSync`
+ * is `MoveFileExW` with `MOVEFILE_REPLACE_EXISTING`; replacing a file on the
+ * same volume is an atomic directory-entry update, so a concurrent reader still
+ * sees the whole old file or the whole new one and never a torn one. What
+ * Windows adds is that the rename can *fail* — `EPERM`/`EBUSY` when a reader
+ * holds the destination open — where POSIX would succeed. That path is safe:
+ * the catch below removes the temp file and rethrows, leaving the previous
+ * config intact for the caller to report on.
+ *
+ * The sibling rule above is what makes that true. `MOVEFILE_COPY_ALLOWED` is
+ * also set, so a cross-volume rename silently degrades to copy-then-delete and
+ * is NOT atomic. Moving the temp file to `os.tmpdir()` would look like a
+ * tidy-up and would quietly restore the exact window this function exists to
+ * close, on Windows only, where nobody here would see it.
+ */
+export async function writeFileAtomic(filePath, contents, mode) {
+    const fs = await import("fs");
+    const { dirname, join, basename } = await import("path");
+    atomicWriteCounter += 1;
+    const tempPath = join(dirname(filePath), `.${basename(filePath)}.neurolink-${process.pid}-${atomicWriteCounter}.tmp`);
+    // Which step failed changes what the user should do about it: a failed write
+    // is usually a missing directory or a full disk and the config is untouched,
+    // while a failed rename is a locked destination and the config is intact but
+    // stale. The bare errno is the same shape for both, so the stage is recorded
+    // as it advances and named in the rethrow.
+    let stage = "write";
+    // Resolved before the first byte is written — see the permissions note above.
+    let effectiveMode = mode;
+    if (effectiveMode === undefined) {
+        try {
+            effectiveMode = fs.statSync(filePath).mode & 0o777;
+        }
+        catch {
+            effectiveMode = 0o600;
+        }
+    }
+    try {
+        fs.writeFileSync(tempPath, contents, { mode: effectiveMode });
+        stage = "chmod";
+        fs.chmodSync(tempPath, effectiveMode);
+        stage = "rename";
+        fs.renameSync(tempPath, filePath);
+    }
+    catch (error) {
+        // Never leave scratch in the user's config directory.
+        try {
+            fs.rmSync(tempPath, { force: true });
+        }
+        catch {
+            // best effort
+        }
+        const reason = error instanceof Error ? error.message : String(error);
+        // The original is attached as `cause`, not discarded: wrapping moves the
+        // errno off the thrown object, and `cause` is where anything that needs
+        // ENOENT/EPERM finds it. No caller reads it today — every call site either
+        // lets this propagate or swallows it — so nothing breaks, but a future one
+        // should not have to re-derive the syscall from a string.
+        throw new Error(`atomic write to ${filePath} failed at the ${stage} step: ${reason}`, { cause: error });
+    }
+}
 //# sourceMappingURL=snapshot.js.map

package/dist/providers/googleNativeGemini3/utils.d.ts

@@ -28,55 +28,6 @@ export declare class DedupExecuteMap extends Map<string, Tool["execute"]> {
     private readonly resultCache;
     get(name: string): Tool["execute"] | undefined;
 }
-export declare function sanitizeForGoogleFunctionName(name: string): string;
-/**
- * Resolve a sanitized Gemini tool name to one that is both unique within
- * the current request and at most 128 characters. When the candidate
- * collides with an already-used name we append `_2`, `_3`, … — but
- * reserve room for the suffix by truncating the base first so the
- * resolved name never exceeds Google's `function_declarations[].name`
- * limit.
- *
- * @param base       The already-sanitized candidate name.
- * @param isTaken    Predicate that returns true if `name` is already used.
- */
-export declare function resolveUniqueGoogleFunctionName(base: string, isTaken: (name: string) => boolean): string;
-/**
- * Sanitize a JSON Schema for Gemini's proto-based API.
- *
- * Gemini cannot handle `anyOf`/`oneOf` union types in function declarations
- * because its proto format expects a single `type` field, not a list of types.
- * This function recursively converts unions to `string` type (the most
- * permissive primitive that can represent any value as text).
- *
- * Also removes `$schema`, `additionalProperties`, and `default` keys that
- * Gemini's proto format doesn't support.
- */
-export declare function sanitizeSchemaForGemini(schema: Record<string, unknown>): Record<string, unknown>;
-/**
- * Sanitize Vercel AI SDK tools for Gemini compatibility.
- *
- * For the Vercel AI SDK path (non-native), tool parameters are Zod schemas that
- * get converted to JSON Schema internally by @ai-sdk/google. This conversion
- * doesn't sanitize union types (anyOf/oneOf), causing Gemini proto errors.
- *
- * This function pre-converts each tool's Zod parameters to sanitized JSON Schema
- * and re-wraps with the Vercel AI SDK's jsonSchema() helper.
- */
-export declare function sanitizeToolsForGemini(tools: Record<string, Tool>): {
-    tools: Record<string, Tool>;
-    dropped: string[];
-    /**
-     * Reverse map: Google-safe sanitized name → original consumer-supplied
-     * name. Lets the calling layer translate tool-call results back so the
-     * sanitization stays transport-only (see CodeRabbit thread, PR #1006).
-     */
-    originalNameMap: Map<string, string>;
-};
-export declare function normalizeToolsForJsonSchemaProvider(tools: Record<string, Tool>): {
-    tools: Record<string, Tool>;
-    normalized: string[];
-};
 /**
  * Convert Vercel AI SDK tools to @google/genai FunctionDeclarations and an execute map.
  *

package/dist/providers/googleNativeGemini3/utils.js

@@ -15,11 +15,10 @@ import { DEFAULT_CONTEXT_GUARD_RATIO, DEFAULT_MAX_STEPS, DEFAULT_TOOL_MAX_RETRIE
 import { needsAudioTranscode, toProviderCompatibleAudio, } from "../../adapters/audioFormatSupport.js";
 import { logger } from "../../utils/logger.js";
 import { resolveSamplingParams } from "../../models/modelRegistry.js";
-import { convertZodToJsonSchema, ensureNestedSchemaTypes, inlineJsonSchema, isZodSchema, normalizeJsonSchemaObject, } from "../../utils/schemaConversion.js";
+import { convertZodToJsonSchema, ensureNestedSchemaTypes, inlineJsonSchema, isZodSchema, } from "../../utils/schemaConversion.js";
 import { createNativeThinkingConfig } from "../../utils/thinkingConfig.js";
 import { resolveLiveTool } from "../../tools/toolDiscovery.js";
 import { raceWithAbort, withTimeout } from "../../utils/async/index.js";
-import { jsonSchema as aiJsonSchema, tool as createAISDKTool, } from "../../utils/tool.js";
 // ── Functions ──
 /** Stable, key-order-independent serialization of tool args for the dedup key. */
 function stableStringifyForDedup(value) {
@@ -83,7 +82,7 @@ export class DedupExecuteMap extends Map {
  */
 const GOOGLE_FN_NAME_REGEX = /^[A-Za-z_][A-Za-z0-9_.:-]{0,127}$/;
 const GOOGLE_FN_NAME_MAX_LENGTH = 128;
-export function sanitizeForGoogleFunctionName(name) {
+function sanitizeForGoogleFunctionName(name) {
     if (GOOGLE_FN_NAME_REGEX.test(name)) {
         return name;
     }
@@ -107,7 +106,7 @@ export function sanitizeForGoogleFunctionName(name) {
  * @param base       The already-sanitized candidate name.
  * @param isTaken    Predicate that returns true if `name` is already used.
  */
-export function resolveUniqueGoogleFunctionName(base, isTaken) {
+function resolveUniqueGoogleFunctionName(base, isTaken) {
     if (!isTaken(base)) {
         return base;
     }
@@ -133,7 +132,7 @@ export function resolveUniqueGoogleFunctionName(base, isTaken) {
  * Also removes `$schema`, `additionalProperties`, and `default` keys that
  * Gemini's proto format doesn't support.
  */
-export function sanitizeSchemaForGemini(schema) {
+function sanitizeSchemaForGemini(schema) {
     // If this node has anyOf/oneOf, collapse to string type
     if (Array.isArray(schema.anyOf) || Array.isArray(schema.oneOf)) {
         const unionKey = schema.anyOf ? "anyOf" : "oneOf";
@@ -243,129 +242,6 @@ export function sanitizeSchemaForGemini(schema) {
     }
     return result;
 }
-/**
- * Sanitize Vercel AI SDK tools for Gemini compatibility.
- *
- * For the Vercel AI SDK path (non-native), tool parameters are Zod schemas that
- * get converted to JSON Schema internally by @ai-sdk/google. This conversion
- * doesn't sanitize union types (anyOf/oneOf), causing Gemini proto errors.
- *
- * This function pre-converts each tool's Zod parameters to sanitized JSON Schema
- * and re-wraps with the Vercel AI SDK's jsonSchema() helper.
- */
-export function sanitizeToolsForGemini(tools) {
-    const sanitized = {};
-    const dropped = [];
-    const renamed = [];
-    const originalNameMap = new Map();
-    for (const [name, tool] of Object.entries(tools)) {
-        try {
-            // Sanitize the tool name to fit Google's function_declarations regex.
-            // Without this, MCP-imported or user-registered tools whose names contain
-            // characters outside [A-Za-z_][A-Za-z0-9_.:-]{0,127} cause the entire
-            // request to 400 with "Invalid function name", surfacing as a misleading
-            // tool-calling failure. Distinct originals that collapse onto the same
-            // sanitized name (e.g. "my/tool" and "my-tool" → "my_tool") are
-            // disambiguated with a numeric suffix that preserves Google's 128-char
-            // ceiling.
-            const candidate = sanitizeForGoogleFunctionName(name);
-            const safeName = resolveUniqueGoogleFunctionName(candidate, (n) => n in sanitized);
-            // Always record the mapping so downstream code can translate every
-            // safeName back to the original — including the no-rename identity
-            // mapping, which simplifies the lookup path.
-            originalNameMap.set(safeName, name);
-            if (safeName !== name) {
-                renamed.push({ from: name, to: safeName });
-            }
-            // Access the legacy `parameters` field that may exist on older AI SDK tools.
-            // AI SDK v6 uses `inputSchema`, but v3/v4 tools and third-party wrappers use `parameters`.
-            const legacyTool = tool;
-            const params = legacyTool.parameters;
-            if (params &&
-                typeof params === "object" &&
-                "_def" in params &&
-                typeof params.parse === "function") {
-                const rawJsonSchema = convertZodToJsonSchema(params, "openApi3");
-                const inlined = inlineJsonSchema(rawJsonSchema);
-                // Gemini sanitization strips Zod-only features not supported by the Gemini API:
-                // union types (anyOf/oneOf) are collapsed to string, default values and
-                // additionalProperties are removed. The resulting schema is Gemini-compatible
-                // but loses some type constraints from the original Zod schema.
-                const sanitizedSchema = sanitizeSchemaForGemini(inlined);
-                sanitized[safeName] = createAISDKTool({
-                    description: tool.description || `Tool: ${safeName}`,
-                    inputSchema: aiJsonSchema(sanitizedSchema),
-                    execute: tool.execute,
-                });
-            }
-            else if (params &&
-                typeof params === "object" &&
-                "jsonSchema" in params) {
-                // Non-Zod JSON schema (e.g., from ai SDK jsonSchema() helper) — still needs sanitization
-                const rawSchema = params
-                    .jsonSchema;
-                const sanitizedSchema = sanitizeSchemaForGemini(inlineJsonSchema(rawSchema));
-                sanitized[safeName] = createAISDKTool({
-                    description: tool.description || `Tool: ${safeName}`,
-                    inputSchema: aiJsonSchema(sanitizedSchema),
-                    execute: tool.execute,
-                });
-            }
-            else {
-                sanitized[safeName] = tool;
-            }
-        }
-        catch (error) {
-            logger.warn(`[Gemini] Failed to sanitize tool "${name}", skipping: ${error instanceof Error ? error.message : String(error)}`);
-            // Don't fall back to the original tool — an incompatible schema would fail the Gemini request
-            dropped.push(name);
-        }
-    }
-    if (renamed.length > 0) {
-        logger.warn(`[Gemini] ${renamed.length} tool name(s) sanitized for Google's function-name regex: ${renamed
-            .map((r) => `"${r.from}" -> "${r.to}"`)
-            .join(", ")}`);
-    }
-    return { tools: sanitized, dropped, originalNameMap };
-}
-export function normalizeToolsForJsonSchemaProvider(tools) {
-    const normalizedTools = {};
-    const normalized = [];
-    for (const [name, tool] of Object.entries(tools)) {
-        const legacyTool = tool;
-        const toolParams = legacyTool.parameters || tool.inputSchema;
-        let rawSchema;
-        if (isZodSchema(toolParams)) {
-            rawSchema = convertZodToJsonSchema(toolParams, "openApi3");
-        }
-        else if (toolParams && typeof toolParams === "object") {
-            rawSchema = toolParams;
-        }
-        else {
-            rawSchema = { type: "object", properties: {} };
-        }
-        if (rawSchema.jsonSchema &&
-            typeof rawSchema.jsonSchema === "object" &&
-            !rawSchema.type) {
-            rawSchema = rawSchema.jsonSchema;
-        }
-        const schemaBefore = JSON.stringify(rawSchema);
-        const normalizedSchema = normalizeJsonSchemaObject(rawSchema);
-        if (JSON.stringify(normalizedSchema) !== schemaBefore) {
-            normalized.push(name);
-        }
-        const wrappedSchema = aiJsonSchema(normalizedSchema);
-        normalizedTools[name] = {
-            ...tool,
-            inputSchema: wrappedSchema,
-            ...(legacyTool.parameters ? { parameters: wrappedSchema } : {}),
-        };
-    }
-    return {
-        tools: normalizedTools,
-        normalized,
-    };
-}
 /**
  * Convert Vercel AI SDK tools to @google/genai FunctionDeclarations and an execute map.
  *

package/dist/proxy/accountLedger.js

@@ -144,6 +144,7 @@ async function advanceCursor(fileName, cursor) {
             outputTokens: finiteNumber(record.outputTokens),
             cacheReadTokens: finiteNumber(record.cacheReadTokens),
             cacheCreationTokens: finiteNumber(record.cacheCreationTokens),
+            clientApp: resolveClientApp(record),
         };
         // A later record for the same request enriches the earlier one — it must
         // replace it, never add to it. But token fields take the MAX rather than
@@ -214,6 +215,27 @@ function resolveSlotKey(cursor, entryKey, next) {
     }
     return slot;
 }
+/**
+ * Which CLI a log row came from.
+ *
+ * Prefers the derived name the proxy recorded. Falls back to the raw
+ * User-Agent's leading token so an unclassified client is still attributable
+ * instead of collapsing into one bucket with everything else. Rows written
+ * before attribution existed carry neither and are reported as "unattributed"
+ * — distinct from "unknown", which means a client we saw but could not name.
+ */
+function resolveClientApp(record) {
+    if (typeof record.clientApp === "string" && record.clientApp) {
+        return record.clientApp;
+    }
+    if (typeof record.userAgent === "string" && record.userAgent) {
+        const token = record.userAgent.trim().split(/[\s/]/)[0];
+        if (token) {
+            return token;
+        }
+    }
+    return "unattributed";
+}
 /** UTC date stamp of the log file the totals cover. */
 export function currentUsageDate(now = new Date()) {
     return now.toISOString().slice(0, 10);
@@ -228,6 +250,7 @@ function emptyTotals() {
         costUsd: 0,
         unpricedRequests: 0,
         unpricedModels: [],
+        byClient: {},
     };
 }
 /**
@@ -267,16 +290,31 @@ export async function readAccountUsage(date = currentUsageDate()) {
         row.outputTokens += entry.outputTokens;
         row.cacheReadTokens += entry.cacheReadTokens;
         row.cacheCreationTokens += entry.cacheCreationTokens;
+        const client = (row.byClient[entry.clientApp] ??= {
+            requests: 0,
+            inputTokens: 0,
+            outputTokens: 0,
+            cacheReadTokens: 0,
+            cacheCreationTokens: 0,
+            costUsd: 0,
+        });
+        client.requests += 1;
+        client.inputTokens += entry.inputTokens;
+        client.outputTokens += entry.outputTokens;
+        client.cacheReadTokens += entry.cacheReadTokens;
+        client.cacheCreationTokens += entry.cacheCreationTokens;
         const provider = resolveProvider(entry);
         if (entry.model && entry.model !== "-") {
             if (hasPricing(provider, entry.model)) {
-                row.costUsd += calculateCost(provider, entry.model, {
+                const cost = calculateCost(provider, entry.model, {
                     input: entry.inputTokens,
                     output: entry.outputTokens,
                     total: entry.inputTokens + entry.outputTokens,
                     cacheReadTokens: entry.cacheReadTokens,
                     cacheCreationTokens: entry.cacheCreationTokens,
                 });
+                row.costUsd += cost;
+                client.costUsd += cost;
             }
             else {
                 row.unpricedRequests += 1;
@@ -289,6 +327,9 @@ export async function readAccountUsage(date = currentUsageDate()) {
     }
     for (const [account, row] of totals) {
         row.costUsd = Number(row.costUsd.toFixed(6));
+        for (const slice of Object.values(row.byClient)) {
+            slice.costUsd = Number(slice.costUsd.toFixed(6));
+        }
         row.unpricedModels = [...(unpriced.get(account) ?? [])].sort();
     }
     return totals;