@kenkaiiii/gg-ai 5.16.0 → 5.17.0

package/dist/index.cjs

@@ -33,8 +33,11 @@ __export(index_exports, {
   EventStream: () => EventStream,
   GGAIError: () => GGAIError,
   ProviderError: () => ProviderError,
+  REDACTION_MARKER: () => REDACTED,
   StreamResult: () => StreamResult,
+  clampProviderContextImages: () => clampProviderContextImages,
   classifyProviderError: () => classifyProviderError,
+  environmentSecrets: () => environmentSecrets,
   formatError: () => formatError,
   formatErrorForDisplay: () => formatErrorForDisplay,
   isHardBillingMessage: () => isHardBillingMessage,
@@ -45,6 +48,8 @@ __export(index_exports, {
   palsuToolCall: () => palsuToolCall,
   prewarmAnthropicCache: () => prewarmAnthropicCache,
   providerRegistry: () => providerRegistry,
+  redactText: () => redactText,
+  redactValue: () => redactValue,
   registerPalsuProvider: () => registerPalsuProvider,
   setProviderDiagnostic: () => setProviderDiagnostic,
   stream: () => stream,
@@ -157,13 +162,20 @@ function isRawJsonErrorEcho(message) {
     return false;
   }
 }
+function isRawHtmlErrorEcho(message) {
+  const withoutStatus = message.trimStart().replace(/^\d{3}\s+/, "").trimStart();
+  return /^<!doctype\s+html(?:\s|>)/i.test(withoutStatus) || /^<html(?:\s|>)/i.test(withoutStatus);
+}
+function providerHtmlErrorMessage(statusCode) {
+  return statusCode ? `The provider returned an HTML error page (HTTP ${statusCode}) instead of an API response.` : "The provider returned an HTML error page instead of an API response.";
+}
 function emptyProviderErrorMessage(statusCode) {
   return statusCode ? `The provider returned an empty error response (HTTP ${statusCode}), with no further detail.` : "The provider returned an empty error response, with no further detail.";
 }
 function formatError(err) {
   if (err instanceof ProviderError) {
     const name = providerDisplayName(err.provider);
-    const cleanMessage = cleanProviderMessage(err.message);
+    const cleanMessage = cleanProviderMessage(err.message, err.statusCode);
     if (isMythosAccessError(cleanMessage)) {
       return {
         headline: "Claude Mythos 5 is invitation-only.",
@@ -258,8 +270,9 @@ function formatErrorForDisplay(err) {
   lines.push(`  \u2192 ${f.guidance}`);
   return lines.join("\n");
 }
-function cleanProviderMessage(message) {
-  return message.replace(/^\[[^\]]+\]\s*/, "").trim();
+function cleanProviderMessage(message, statusCode) {
+  const clean = message.replace(/^\[[^\]]+\]\s*/, "").trim();
+  return isRawHtmlErrorEcho(clean) ? providerHtmlErrorMessage(statusCode) : clean;
 }
 function inferSource(err) {
   const msg = err.message.toLowerCase();
@@ -620,6 +633,66 @@ function toAnthropicAssistantContent(content, preserveThinking, idMap) {
     return true;
   }).map((part) => toAnthropicAssistantPart(part, idMap)).filter((b) => b !== null);
 }
+var PROVIDER_IMAGE_LIMIT_PLACEHOLDER = "[image omitted: provider image limit]";
+var PROVIDER_IMAGE_BUDGETS = {
+  anthropic: 90,
+  minimax: 90,
+  openai: 200,
+  gemini: 200,
+  openrouter: 90
+};
+function countContextImages(messages) {
+  let count = 0;
+  for (const message of messages) {
+    if (message.role === "user" && Array.isArray(message.content)) {
+      count += message.content.filter((part) => part.type === "image").length;
+    } else if (message.role === "tool") {
+      for (const result of message.content) {
+        if (Array.isArray(result.content)) {
+          count += result.content.filter((part) => part.type === "image").length;
+        }
+      }
+    }
+  }
+  return count;
+}
+function clampProviderContextImages(messages, provider, supportsImages) {
+  if (supportsImages === false) return messages;
+  const budget = PROVIDER_IMAGE_BUDGETS[provider] ?? 5;
+  let remainingToRemove = countContextImages(messages) - budget;
+  if (remainingToRemove <= 0) return messages;
+  return messages.map((message) => {
+    if (message.role === "user" && Array.isArray(message.content)) {
+      const content = message.content.filter((part) => {
+        if (part.type !== "image" || remainingToRemove <= 0) return true;
+        remainingToRemove--;
+        return false;
+      });
+      return {
+        ...message,
+        content: content.length > 0 ? content : [{ type: "text", text: PROVIDER_IMAGE_LIMIT_PLACEHOLDER }]
+      };
+    }
+    if (message.role === "tool") {
+      return {
+        ...message,
+        content: message.content.map((result) => {
+          if (!Array.isArray(result.content)) return result;
+          const content = result.content.filter((part) => {
+            if (part.type !== "image" || remainingToRemove <= 0) return true;
+            remainingToRemove--;
+            return false;
+          });
+          return {
+            ...result,
+            content: content.length > 0 ? content : [{ type: "text", text: PROVIDER_IMAGE_LIMIT_PLACEHOLDER }]
+          };
+        })
+      };
+    }
+    return message;
+  });
+}
 var NON_VISION_USER_IMAGE_PLACEHOLDER = "(image omitted: model does not support images)";
 var NON_VISION_TOOL_IMAGE_PLACEHOLDER = "(tool image omitted: model does not support images)";
 var NON_VIDEO_USER_PLACEHOLDER = "(video omitted: model does not support video)";
@@ -1636,7 +1709,8 @@ function toError(err) {
     const bodyMessage = typeof nestedError?.message === "string" && nestedError.message.trim() ? nestedError.message.trim() : typeof errorBody?.message === "string" && errorBody.message.trim() ? errorBody.message.trim() : void 0;
     const bodyType = typeof nestedError?.type === "string" ? nestedError.type : typeof errorBody?.type === "string" ? errorBody.type : typeof err.type === "string" ? err.type : void 0;
     const fallbackMessage = isRawJsonErrorEcho(err.message) ? emptyProviderErrorMessage(err.status) : err.message;
-    const message = bodyType && bodyMessage ? `${bodyType}: ${bodyMessage}` : bodyMessage ?? fallbackMessage;
+    const messageCandidate = bodyMessage ?? err.message;
+    const message = isRawHtmlErrorEcho(messageCandidate) ? providerHtmlErrorMessage(err.status) : bodyType && bodyMessage ? `${bodyType}: ${bodyMessage}` : bodyMessage ?? fallbackMessage;
     if (err.status === 429) {
       const limit = readUnifiedRateLimit(err.headers);
       const farOff = limit.resetsAt != null && limit.resetsAt * 1e3 - Date.now() > 6e4;
@@ -2104,7 +2178,8 @@ function toError2(err, provider = "openai") {
     const body = err.error;
     const bodyMessage = typeof body?.message === "string" && body.message.trim() ? body.message.trim() : void 0;
     const modelName = typeof body?.model === "string" ? body.model : "";
-    const cleanMessage = bodyMessage ?? (isRawJsonErrorEcho(err.message) ? emptyProviderErrorMessage(err.status) : err.message);
+    const messageCandidate = bodyMessage ?? err.message;
+    const cleanMessage = isRawHtmlErrorEcho(messageCandidate) ? providerHtmlErrorMessage(err.status) : bodyMessage ? bodyMessage : isRawJsonErrorEcho(err.message) ? emptyProviderErrorMessage(err.status) : err.message;
     let hint;
     if (modelName === "codex-mini-latest" || cleanMessage.includes("codex-mini-latest")) {
       hint = "codex-mini-latest requires an OpenAI Pro or Max subscription. Your account currently has access to GPT-5.4 and GPT-5.4 Mini.";
@@ -2218,6 +2293,21 @@ function outputTextKey(itemId, contentIndex) {
 function isVisibleOutputItem(itemType) {
   return itemType === "message";
 }
+function toCodexToolChoice(choice, tools) {
+  const resolved = choice ?? "auto";
+  if (typeof resolved === "object") {
+    throw new GGAIError(
+      `OpenAI Codex does not support selecting the named tool \`${resolved.name}\`; use auto, none, or required.`,
+      { source: "capability" }
+    );
+  }
+  if (resolved === "required" && !tools?.length) {
+    throw new GGAIError("OpenAI Codex cannot require a tool call when no tools are configured.", {
+      source: "capability"
+    });
+  }
+  return resolved;
+}
 function streamOpenAICodex(options) {
   return new StreamResult(runStream3(options), options.signal);
 }
@@ -2234,7 +2324,7 @@ async function* runStream3(options) {
     stream: true,
     instructions: system,
     input,
-    tool_choice: "auto",
+    tool_choice: toCodexToolChoice(options.toolChoice, options.tools),
     parallel_tool_calls: !responsesLite,
     include: ["reasoning.encrypted_content"]
   };
@@ -2267,8 +2357,9 @@ async function* runStream3(options) {
     headers["chatgpt-account-id"] = options.accountId;
   }
   if (options.transportSessionId) {
-    headers["session_id"] = options.transportSessionId;
-    headers["x-client-request-id"] = options.transportSessionId;
+    const transportSessionId = normalizePromptCacheKey(options.transportSessionId);
+    headers["session_id"] = transportSessionId;
+    headers["x-client-request-id"] = transportSessionId;
   }
   const response = await fetch(url, {
     method: "POST",
@@ -2278,7 +2369,7 @@ async function* runStream3(options) {
   });
   if (!response.ok) {
     const text = await response.text().catch(() => "");
-    const parsed = parseCodexErrorBody(text);
+    const parsed = parseCodexErrorBody(text, response.status);
     const message = parsed.message ?? `Codex API returned HTTP ${response.status}.`;
     const requestId = parsed.requestId ?? readHeader(response.headers, "x-request-id", "openai-request-id", "x-oai-request-id");
     const usageLimit = codexUsageLimitError(parsed.errorObj, response.status, requestId);
@@ -2672,13 +2763,14 @@ function toCodexTools(tools) {
     strict: null
   }));
 }
-function parseCodexErrorBody(text) {
+function parseCodexErrorBody(text, statusCode) {
   if (!text) return {};
   try {
     const parsed = JSON.parse(text);
     const error = parsed.error;
     const detail = parsed.detail;
-    const message = error?.message ?? parsed.message ?? (typeof detail === "string" ? detail : void 0);
+    const rawMessage = error?.message ?? parsed.message ?? (typeof detail === "string" ? detail : void 0);
+    const message = rawMessage && isRawHtmlErrorEcho(rawMessage) ? providerHtmlErrorMessage(statusCode) : rawMessage;
     const requestId = parsed.request_id ?? error?.request_id ?? (message ? extractRequestIdFromMessage(message) : void 0);
     const errorObj = error ?? parsed;
     return {
@@ -2687,8 +2779,12 @@ function parseCodexErrorBody(text) {
       ...errorObj ? { errorObj } : {}
     };
   } catch {
-    const trimmed = text.trim().slice(0, 240);
-    return trimmed ? { message: trimmed } : {};
+    const trimmed = text.trim();
+    if (isRawHtmlErrorEcho(trimmed)) {
+      return { message: providerHtmlErrorMessage(statusCode) };
+    }
+    const bounded = trimmed.slice(0, 240);
+    return bounded ? { message: bounded } : {};
   }
 }
 var CODEX_USAGE_LIMIT_CODE = /usage_limit_reached|usage_not_included/i;
@@ -3323,7 +3419,12 @@ function stream(options) {
   if (options.supportsVideo !== true && messagesContainVideo(options.messages)) {
     throw new VideoUnsupportedError();
   }
-  return entry.stream(options);
+  const messages = clampProviderContextImages(
+    options.messages,
+    options.provider,
+    options.supportsImages
+  );
+  return entry.stream(messages === options.messages ? options : { ...options, messages });
 }
 function messagesContainVideo(messages) {
   for (const msg of messages) {
@@ -3428,6 +3529,125 @@ Original: ${message}`;
   return message;
 }
 
+// src/redaction.ts
+var REDACTED = "[REDACTED]";
+var TRUNCATED = "[TRUNCATED]";
+var CIRCULAR = "[CIRCULAR]";
+var SENSITIVE_NAME = /(?:^|[_-])(?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|key|auth(?:orization)?|bearer|cookie|credential|private[_-]?key|password|passwd|secret)(?:$|[_-])/i;
+var SENSITIVE_ASSIGNMENT = /\b((?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|key|auth(?:orization)?|bearer|cookie|credential|private[_-]?key|password|passwd|secret))\b(\s*[=:]\s*)(["']?)([^\s,"';}]+)\3/gi;
+function escaped(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function normalizedSecrets(secrets) {
+  if (!secrets) return [];
+  return [...new Set([...secrets].filter((value) => value.length >= 8 && value !== REDACTED))].sort(
+    (a, b) => b.length - a.length
+  );
+}
+function environmentSecrets(env) {
+  const values = /* @__PURE__ */ new Set();
+  for (const [name, value] of Object.entries(env)) {
+    if (!value || value.length < 8 || value === REDACTED || !SENSITIVE_NAME.test(name)) continue;
+    values.add(value);
+  }
+  return [...values].sort((a, b) => b.length - a.length);
+}
+function redactText(text, options = {}) {
+  let result = text;
+  result = result.replace(
+    /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY-----/g,
+    REDACTED
+  );
+  result = result.replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi, `$1${REDACTED}@`);
+  result = result.replace(
+    /\b(authorization\s*[:=]\s*)(?:bearer|basic)\s+[^\s,;]+/gi,
+    `$1${REDACTED}`
+  );
+  result = result.replace(/\b(bearer|basic)\s+[A-Za-z0-9+/_.=-]{8,}/gi, `$1 ${REDACTED}`);
+  result = result.replace(/\b(cookie|set-cookie)(\s*[:=]\s*)[^\r\n]+/gi, `$1$2${REDACTED}`);
+  result = result.replace(
+    /\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,
+    REDACTED
+  );
+  result = result.replace(
+    /\b(?:sk-(?:ant-|proj-)?|xox[baprs]-|gh[pousr]_|github_pat_|AIza)[A-Za-z0-9_-]{12,}\b/g,
+    REDACTED
+  );
+  result = result.replace(
+    SENSITIVE_ASSIGNMENT,
+    (_match, name, separator) => `${name}${separator}${REDACTED}`
+  );
+  for (const secret of normalizedSecrets(options.secrets)) {
+    result = result.replace(new RegExp(escaped(secret), "g"), REDACTED);
+  }
+  const maxStringLength = options.maxStringLength ?? 1e6;
+  if (result.length > maxStringLength) {
+    result = `${result.slice(0, maxStringLength)}${TRUNCATED}`;
+  }
+  return result;
+}
+function isBinary(value) {
+  return value instanceof ArrayBuffer || ArrayBuffer.isView(value) || typeof Blob !== "undefined" && value instanceof Blob;
+}
+function isMediaObject(value) {
+  return (value.type === "image" || value.type === "video") && (typeof value.data === "string" || typeof value.url === "string");
+}
+function redactValue(value, options = {}) {
+  const maxDepth = options.maxDepth ?? 20;
+  const maxEntries = options.maxEntries ?? 1e4;
+  const seen = /* @__PURE__ */ new WeakSet();
+  let entries = 0;
+  const visit = (current, depth, sensitive = false) => {
+    if (typeof current === "string") {
+      if (sensitive && current.length > 0 && current !== REDACTED) return REDACTED;
+      return redactText(current, options);
+    }
+    if (current === null || current === void 0 || typeof current === "number" || typeof current === "boolean" || typeof current === "bigint") {
+      return current;
+    }
+    if (typeof current !== "object") return current;
+    if (isBinary(current)) return current;
+    if (current instanceof Date) return new Date(current.getTime());
+    if (depth >= maxDepth) return TRUNCATED;
+    if (seen.has(current)) return CIRCULAR;
+    seen.add(current);
+    if (current instanceof Error) {
+      const error = {
+        name: current.name,
+        message: visit(current.message, depth + 1),
+        stack: visit(current.stack, depth + 1)
+      };
+      for (const [key, child] of Object.entries(current)) {
+        error[key] = visit(child, depth + 1, SENSITIVE_NAME.test(key));
+      }
+      return error;
+    }
+    if (Array.isArray(current)) {
+      const clone2 = [];
+      for (const child of current) {
+        if (++entries > maxEntries) {
+          clone2.push(TRUNCATED);
+          break;
+        }
+        clone2.push(visit(child, depth + 1));
+      }
+      return clone2;
+    }
+    const record = current;
+    if (isMediaObject(record)) return { ...record };
+    const clone = {};
+    for (const [key, child] of Object.entries(record)) {
+      if (++entries > maxEntries) {
+        clone[TRUNCATED] = true;
+        break;
+      }
+      clone[key] = visit(child, depth + 1, SENSITIVE_NAME.test(key));
+    }
+    return clone;
+  };
+  return visit(value, 0);
+}
+
 // src/providers/palsu.ts
 function palsuText(text) {
   return { role: "assistant", content: text ? [{ type: "text", text }] : [] };
@@ -3584,8 +3804,11 @@ function registerPalsuProvider(config) {
   EventStream,
   GGAIError,
   ProviderError,
+  REDACTION_MARKER,
   StreamResult,
+  clampProviderContextImages,
   classifyProviderError,
+  environmentSecrets,
   formatError,
   formatErrorForDisplay,
   isHardBillingMessage,
@@ -3596,6 +3819,8 @@ function registerPalsuProvider(config) {
   palsuToolCall,
   prewarmAnthropicCache,
   providerRegistry,
+  redactText,
+  redactValue,
   registerPalsuProvider,
   setProviderDiagnostic,
   stream,