@oh-my-pi/pi-ai 15.10.3 → 15.10.5

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 ## [Unreleased]
 
+## [15.10.5] - 2026-06-08
+
+### Breaking Changes
+
+- Renamed the OAuth subpath export `@oh-my-pi/pi-ai/utils/oauth` → `@oh-my-pi/pi-ai/oauth` (and `@oh-my-pi/pi-ai/utils/oauth/*` → `@oh-my-pi/pi-ai/oauth/*`, e.g. `oauth/types`, `oauth/callback-server`, `oauth/openai-codex`) after relocating the OAuth implementation out of `utils/oauth/` into `registry/oauth/`. The high-level OAuth API (`getOAuthProviders`, `refreshOAuthToken`, `getOAuthApiKey`, `registerOAuthProvider`, `unregisterOAuthProviders`, `getOAuthProvider`) and the `OAuth*` types stay exported from the package root, unchanged.
+
+### Changed
+
+- Changed Anthropic retry handling to avoid retrying 4xx responses other than 408 and 429
+- Optimized the Anthropic `cch` attestation patch to locate the billing-header placeholder with native `Buffer.indexOf` (memmem) instead of a hand-rolled byte loop. The marker sits ~99% through the body (`messages` serializes before `system`), so the old scan walked almost the entire payload; output bytes are unchanged but the patch is ~7.5x faster (563µs -> 75µs on a 1MB body).
+- Refactored provider configuration to a single-source registry (`registry/`, renamed from `provider-registry/` with its `providers/` subdir flattened up). The `KnownProvider`/`OAuthProvider` type unions, `PROVIDER_DESCRIPTORS`, `DEFAULT_MODEL_PER_PROVIDER`, the `serviceProviderMap` env-key fallbacks, the `/login` provider list (`builtInOAuthProviders`), and the `refreshOAuthToken`/`AuthStorage.login` dispatch are all derived from it. Provider defs live directly under `registry/`; thin provider-specific login flows are inlined into the def file, while heavier provider-local OAuth flows and the shared OAuth flow infra (`callback-server`, `pkce`, `google-oauth-shared`, `types`, runtime `index`) now live together under `registry/oauth/` (previously split across `provider-registry/providers/oauth/` and `utils/oauth/`). The non-OAuth API-key paste/validation helpers (`api-key-login`, `api-key-validation`) sit beside the defs in `registry/`. Adding a provider that reuses an existing wire API is now one new provider def plus one registry entry in the common case. Exposes `PROVIDER_REGISTRY`, `getProviderDefinition`, `ProviderDefinition`, and `PASTE_CODE_LOGIN_PROVIDERS`.
+
+### Fixed
+
+- Disabled OpenAI Codex Responses stream obfuscation by sending `stream_options.include_obfuscation=false`, reducing raw WebSocket/SSE debug noise and bandwidth.
+- Interrupted OpenAI Codex Responses streams that emit long runs of whitespace-only tool-call argument deltas, preventing degenerate WebSocket/SSE responses from filling the raw stream buffer indefinitely.
+- Preserved streaming responses when Anthropic emits unrecognized content_block envelopes by ignoring unknown blocks and continuing to emit known content
+- Applied cache control to the most recent tool result block when building Anthropic OAuth payloads without a preceding text block, enabling ephemeral caching for tool-result-only messages
+- Kept Anthropic sampling parameters (temperature, top_p, top_k) when thinking is explicitly disabled
+- Fixed raw Anthropic SSE handling by parsing event frames with strict JSON parsing and matching event-type validation, surfacing malformed frames as stream errors instead of repairing them
+- Fixed Anthropic stream envelope handling to reject duplicate `content_block_start` indexes and block deltas/stops for unopened blocks, preventing malformed envelope states from producing partial output
+- Fixed Anthropic image conversion to normalize `image/jpg` to `image/jpeg` and emit a placeholder for unsupported image MIME types
+- Fixed Anthropic thinking request preparation by clamping `max_tokens` to provider/model limits and adjusting thinking budgets to a valid value
+- Fixed Anthropic request shaping around forced tool choice, unsigned thinking replay, prompt-cache marker placement, non-Anthropic bearer gateways, Foundry TLS loading, and strict tool-schema normalization so malformed or incompatible request payloads are rejected locally or shaped consistently before streaming
+- Fixed the Anthropic stream parser shipping a truncated tool call as a completed turn. When a transport drop cut the SSE stream mid-`tool_use` and a transparent reconnect spliced a fresh message envelope onto the same stream, the duplicate `message_start` was deduped but the orphaned tool block — which never received its `content_block_stop` — survived in the assistant message with its seed `{}` (or partially-parsed) arguments. The terminal stop signal from the reconnect then let it flow through as a normal tool call, so e.g. a `read` dispatched with `{}` failed downstream validation (`path: expected string, received undefined`). The parser now treats any tool block left open at stream end as a truncated envelope and routes it through the existing retry/error path instead of emitting bogus arguments.
+- Fixed the Zhipu Coding Plan login prompt advertising a misleading `sk-...` placeholder. Zhipu API keys are formatted `<id>.<secret>` (no `sk-` prefix), so the placeholder now matches the actual format instead of suggesting the wrong shape. ([#2106](https://github.com/can1357/oh-my-pi/issues/2106))
+- Fixed Moonshot `kimi-k2.6` (and any future `kimi-k2.x`) discovered via `MOONSHOT_API_KEY` stalling on first turn with no output. The `moonshotModelManagerOptions` discovery mapper only marked ids containing `"thinking"` as `reasoning: true`, so dynamic `kimi-k2.6` entries fell through with `reasoning: false`; the openai-completions z.ai branch was then skipped and the request reached Moonshot with no `thinking` parameter at all. Moonshot K2.6 requires an explicit `thinking: {type}` field (the same native-API wire shape #1838 introduced `thinking.keep` for), so the server held the stream silently. The mapper now stamps `reasoning: true`, vision input, and default `thinking` metadata on every `kimi-k2.x` id, restoring the explicit `thinking: {type: "disabled"|"enabled"}` wire body the Moonshot endpoint expects. ([#2113](https://github.com/can1357/oh-my-pi/issues/2113))
+
+## [15.10.4] - 2026-06-08
+
+### Added
+
+- Added `anthropic-client-platform` (`desktop_app`) and `anthropic-client-version` (`1.11187.4`) headers to the Anthropic request fingerprint for OAuth sessions
+
+### Changed
+
+- Changed non-built-in tool names sent to Anthropic from `proxy_` prefixing to `_` prefixing (for example `bash` to `_bash`) while built-in tool names remain unchanged
+- Updated the Anthropic OAuth stealth fingerprint to track Claude Code 2.1.165: `claudeCodeVersion` bumped to `2.1.165` (flows into both the `cc_version` billing header and the `claude-cli/<version>` user-agent), `claudeCodeSystemInstruction` changed to `"You are a Claude agent, built on Anthropic's Claude Agent SDK."`, and the billing-header `cc_entrypoint` changed from `cli` to `local-agent`.
+- Clamped the Anthropic request `max_tokens` to `Math.min(CLAUDE_CODE_MAX_OUTPUT_TOKENS, options.maxTokens || model.maxTokens)` (64k) so OAuth requests match Claude Code's requested output cap instead of sending the model's full ceiling (e.g. 128k for Opus 4.8).
+
 ## [15.10.3] - 2026-06-08
 
 ### Removed
@@ -9,8 +49,8 @@
 - Removed the synthetic `<turn-aborted>` developer guidance note that `transformMessages` injected after an aborted/errored assistant turn (and its `turn-aborted-guidance.md` prompt). The per-call synthetic `"aborted"` tool results already tell the model the turn's tools were terminated, so the extra "verify current state before retrying" note was redundant — and it biased the model toward second-guessing a deliberate user interrupt when the turn was resumed.
 - Removed the legacy Anthropic first-user-message skip for `<system-reminder>` blocks now that synthetic reminders no longer travel as user messages.
 
-
 ## [15.10.2] - 2026-06-08
+
 ### Added
 
 - Added support for `impersonated_service_account` Application Default Credentials (ADC) in Vertex AI to enable chained impersonation without failing via 401 `invalid_client`.
@@ -3034,4 +3074,4 @@ _Dedicated to Peter's shoulder ([@steipete](https://twitter.com/steipete))_
 
 ## [0.9.4] - 2025-11-26
 
-Initial release with multi-provider LLM support.
+Initial release with multi-provider LLM support.

package/dist/types/auth-broker/remote-store.d.ts

@@ -1,7 +1,7 @@
 import { type AuthCredential, type AuthCredentialStore, type OAuthCredential, type StoredAuthCredential } from "../auth-storage";
+import type { OAuthCredentials } from "../registry/oauth/types";
 import type { Provider } from "../types";
 import type { UsageReport } from "../usage";
-import type { OAuthCredentials } from "../utils/oauth/types";
 import { type AuthBrokerClient } from "./client";
 import type { SnapshotResponse } from "./types";
 export interface RemoteAuthCredentialStoreOptions {

package/dist/types/auth-storage.d.ts

@@ -9,9 +9,9 @@
  */
 import { Database } from "bun:sqlite";
 import type { ApiKeyResolver } from "./auth-retry";
+import type { OAuthController, OAuthCredentials, OAuthProviderId } from "./registry/oauth/types";
 import type { Provider } from "./types";
 import type { CredentialRankingStrategy, UsageLogger, UsageProvider, UsageReport } from "./usage";
-import type { OAuthController, OAuthCredentials, OAuthProviderId } from "./utils/oauth/types";
 export type ApiKeyCredential = {
     type: "api_key";
     key: string;

package/dist/types/index.d.ts

@@ -29,6 +29,7 @@ export * from "./providers/openai-completions";
 export * from "./providers/openai-responses";
 export * from "./providers/synthetic";
 export * from "./rate-limit-utils";
+export * from "./registry";
 export * from "./stream";
 export * from "./types";
 export * from "./usage";
@@ -43,8 +44,6 @@ export * from "./usage/zai";
 export * from "./utils/anthropic-auth";
 export * from "./utils/discovery";
 export * from "./utils/event-stream";
-export * from "./utils/oauth";
-export type { OAuthCredentials, OAuthProvider, OAuthProviderId, OAuthProviderInfo, } from "./utils/oauth/types";
 export * from "./utils/overflow";
 export * from "./utils/retry";
 export * from "./utils/schema";

package/dist/types/provider-models/descriptors.d.ts

@@ -1,50 +1,12 @@
+import type { ProviderDescriptor } from "../registry/types";
+import type { KnownProvider } from "../types";
+export * from "../registry/types";
 /**
- * Unified provider descriptors — single source of truth for provider metadata
- * used by both runtime model discovery (model-registry.ts) and catalog
- * generation (generate-models.ts).
- */
-import type { ModelManagerOptions } from "../model-manager";
-import type { Api, KnownProvider } from "../types";
-import type { OAuthProvider } from "../utils/oauth/types";
-/** Catalog discovery configuration for providers that support endpoint-based model listing. */
-export interface CatalogDiscoveryConfig {
-    /** Human-readable name for log messages. */
-    label: string;
-    /** Environment variables to check for API keys during catalog generation. */
-    envVars: string[];
-    /** OAuth provider for credential refresh during catalog generation. */
-    oauthProvider?: OAuthProvider;
-    /** When true, catalog discovery proceeds even without credentials. */
-    allowUnauthenticated?: boolean;
-}
-/** Unified provider descriptor used by both runtime discovery and catalog generation. */
-export interface ProviderDescriptor {
-    providerId: KnownProvider;
-    createModelManagerOptions(config: {
-        apiKey?: string;
-        baseUrl?: string;
-    }): ModelManagerOptions<Api>;
-    /** Preferred model ID when no explicit selection is made. */
-    defaultModel: string;
-    /** When true, the runtime creates a model manager even without a valid API key (e.g. ollama). */
-    allowUnauthenticated?: boolean;
-    /** When true, successful runtime discovery replaces bundled provider models instead of merging fallback-only IDs. */
-    dynamicModelsAuthoritative?: boolean;
-    /** Catalog discovery configuration. Only providers with this field participate in generate-models.ts. */
-    catalogDiscovery?: CatalogDiscoveryConfig;
-}
-/** A provider descriptor that has catalog discovery configured. */
-export type CatalogProviderDescriptor = ProviderDescriptor & {
-    catalogDiscovery: CatalogDiscoveryConfig;
-};
-/** Type guard for descriptors with catalog discovery. */
-export declare function isCatalogDescriptor(d: ProviderDescriptor): d is CatalogProviderDescriptor;
-/** Whether catalog discovery may run without provider credentials. */
-export declare function allowsUnauthenticatedCatalogDiscovery(descriptor: CatalogProviderDescriptor): boolean;
-/**
- * All standard providers. Special providers (google-antigravity, google-gemini-cli,
- * openai-codex) are handled separately because they require different config shapes.
+ * Runtime model-discovery descriptors: every registry provider that exposes a
+ * standard model-manager factory. Special-managed providers
+ * (`google-antigravity`/`google-gemini-cli`/`openai-codex`) are built bespoke in
+ * the coding-agent runtime and are excluded here.
  */
 export declare const PROVIDER_DESCRIPTORS: readonly ProviderDescriptor[];
-/** Default model IDs for all known providers, built from descriptors + special providers. */
+/** Default model IDs for all known providers, derived from the registry. */
 export declare const DEFAULT_MODEL_PER_PROVIDER: Record<KnownProvider, string>;

package/dist/types/provider-models/discovery-constants.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Fallback context-window / max-output-token values for models discovered
+ * without limit metadata.
+ *
+ * Kept in a dependency-free leaf module (rather than `openai-compat.ts`) so the
+ * model-discovery helpers in `utils/discovery/*` can import them without pulling
+ * the package root barrel (`@oh-my-pi/pi-ai`) into the model-manager init graph,
+ * which would otherwise form an import cycle through the provider registry.
+ */
+export declare const UNK_CONTEXT_WINDOW = 222222;
+export declare const UNK_MAX_TOKENS = 8888;

package/dist/types/provider-models/openai-compat.d.ts

@@ -1,4 +1,5 @@
 import type { ModelManagerOptions } from "../model-manager";
+import { getBundledModels } from "../models";
 import type { Api, Model, Provider } from "../types";
 export interface ModelsDevModel {
     id?: string;
@@ -23,6 +24,11 @@ export interface ModelsDevModel {
         npm?: string;
     };
 }
+type SimpleProviderConfig = {
+    apiKey?: string;
+    baseUrl?: string;
+};
+export declare function createSimpleOpenAICompletionsOptions(providerId: Parameters<typeof getBundledModels>[0], defaultBaseUrl: string, config?: SimpleProviderConfig): ModelManagerOptions<"openai-completions">;
 export interface OpenAIModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;
@@ -281,8 +287,7 @@ export interface AnthropicModelManagerConfig {
     baseUrl?: string;
 }
 export declare function anthropicModelManagerOptions(config?: AnthropicModelManagerConfig): ModelManagerOptions<"anthropic-messages">;
-export declare const UNK_CONTEXT_WINDOW = 222222;
-export declare const UNK_MAX_TOKENS = 8888;
+export { UNK_CONTEXT_WINDOW, UNK_MAX_TOKENS } from "./discovery-constants";
 /** Describes how to map models.dev API data for a single provider. */
 export interface ModelsDevProviderDescriptor {
     /** Key in the models.dev API response JSON (e.g., "anthropic", "amazon-bedrock") */
@@ -325,4 +330,3 @@ export interface ModelsDevProviderDescriptor {
 export declare function mapModelsDevToModels(data: Record<string, unknown>, descriptors: readonly ModelsDevProviderDescriptor[]): Model<Api>[];
 /** All provider descriptors for models.dev data mapping in generate-models.ts. */
 export declare const MODELS_DEV_PROVIDER_DESCRIPTORS: readonly ModelsDevProviderDescriptor[];
-export {};

package/dist/types/providers/anthropic.d.ts

@@ -26,9 +26,12 @@ type AnthropicCacheControl = NonNullable<TextBlockParam["cache_control"]>;
  */
 export declare function clearAnthropicFastModeFallback(providerSessionState: Map<string, ProviderSessionState> | undefined): void;
 export declare function isAnthropicFastModeUnsupportedError(error: unknown): boolean;
-export declare const claudeCodeVersion = "2.1.160";
+export declare const claudeCodeVersion = "2.1.165";
+export declare const claudeAgentSdkVersion = "0.3.165";
+export declare const claudeClientVersion = "1.11187.4";
 export declare const claudeToolPrefix: string;
-export declare const claudeCodeSystemInstruction = "You are Claude Code, Anthropic's official CLI for Claude.";
+export declare const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+export declare const CLAUDE_CODE_MAX_OUTPUT_TOKENS = 64000;
 export declare function mapStainlessOs(platform: string): "MacOS" | "Windows" | "Linux" | "FreeBSD" | `Other::${string}`;
 export declare function mapStainlessArch(arch: string): "x64" | "arm64" | "x86" | `other::${string}`;
 export declare const claudeCodeHeaders: {
@@ -40,11 +43,14 @@ export declare const claudeCodeHeaders: {
     "X-Stainless-Arch": "arm64" | "x64" | "x86" | `other::${string}`;
     "X-Stainless-OS": "FreeBSD" | "Linux" | "MacOS" | "Windows" | `Other::${string}`;
     "X-Stainless-Timeout": string;
+    "anthropic-client-platform": string;
+    "anthropic-client-version": string;
 };
 export declare function isClaudeCloakingUserId(userId: string): boolean;
 export declare function generateClaudeCloakingUserId(): string;
-export declare const applyClaudeToolPrefix: (name: string, prefixOverride?: string) => string;
-export declare const stripClaudeToolPrefix: (name: string, prefixOverride?: string) => string;
+export declare function deriveClaudeDeviceId(installId: string, accountId?: string): string;
+export declare const applyClaudeToolPrefix: (name: string) => string;
+export declare const stripClaudeToolPrefix: (name: string) => string;
 export type AnthropicEffort = "low" | "medium" | "high" | "xhigh" | "max";
 export type AnthropicThinkingDisplay = "summarized" | "omitted";
 export interface AnthropicOptions extends StreamOptions {
@@ -154,9 +160,8 @@ export type AnthropicUsageLike = {
 };
 /**
  * Capture Anthropic's optional cache-creation TTL breakdown and server-tool-use
- * counters into the harness Usage shape. Only sets fields that were reported, so
- * a `message_delta` that omits `cache_creation` does not clobber the breakdown
- * established at `message_start`.
+ * counters into the harness Usage shape. Omitted/null fields are no-ops; explicit
+ * zero-valued objects clear prior extras from earlier stream usage snapshots.
  */
 export declare function applyAnthropicUsageExtras(usage: Usage, source: AnthropicUsageLike): void;
 export declare const streamAnthropic: StreamFunction<"anthropic-messages">;
@@ -180,26 +185,6 @@ export declare function buildAnthropicClientOptions(args: AnthropicClientOptions
  * `system` role (Opus 4.8+).
  */
 export type AnthropicMessageParam = MessageParam;
-export declare function convertAnthropicMessages(messages: Message[], model: Model<"anthropic-messages">, isOAuthToken: boolean): AnthropicMessageParam[];
-/**
- * Normalize a JSON Schema node for Anthropic tool `input_schema`.
- *
- * Applies the full whitelist semantics from the Anthropic Python SDK's
- * `lib/_parse/_transform.py::transform_schema`:
- *
- * 1. Universal keys (`$ref`, `$defs`, `type`, `anyOf`/`oneOf`/`allOf`, `enum`, `const`,
- *    `description`, `title`, `default`, `nullable`) are preserved on every node.
- * 2. Per-type keys are kept additively (object → `properties`/`required`/`additionalProperties`,
- *    array → `items`/`prefixItems` plus `minItems` only when 0 or 1, string → `format`
- *    only when in the supported value set).
- * 3. Everything else is demoted into the node's `description` as `\n\n{key: value, ...}`
- *    so the model still sees the constraint as a natural-language hint.
- *
- * Object nodes default to `additionalProperties: false`, but explicit open-map
- * declarations (`additionalProperties: true` or a schema literal — Zod's
- * `z.record(z.string(), z.unknown())` produces `{}`) are preserved. The strict-mode
- * pass downstream demotes those shapes to non-strict instead of fabricating a closed
- * object, so callers like the resolve tool keep working open-map semantics.
- */
+export declare function convertAnthropicMessages(messages: Message[], model: Model<"anthropic-messages">, isOAuthToken: boolean, baseUrl?: string | undefined): AnthropicMessageParam[];
 export declare function normalizeAnthropicToolSchema(schema: unknown): unknown;
 export {};

package/dist/types/registry/alibaba-coding-plan.d.ts

@@ -0,0 +1,15 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import type { ModelManagerConfig } from "./types";
+export declare function loginAlibabaCodingPlan(options: OAuthController): Promise<string>;
+export declare const alibabaCodingPlanProvider: {
+    readonly id: "alibaba-coding-plan";
+    readonly name: "Alibaba Coding Plan";
+    readonly defaultModel: "qwen3.5-plus";
+    readonly createModelManagerOptions: (config: ModelManagerConfig) => import("..").ModelManagerOptions<"openai-completions", unknown>;
+    readonly catalogDiscovery: {
+        readonly label: "Alibaba Coding Plan";
+        readonly envVars: readonly ["ALIBABA_CODING_PLAN_API_KEY"];
+    };
+    readonly envKeys: "ALIBABA_CODING_PLAN_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/amazon-bedrock.d.ts

@@ -0,0 +1,6 @@
+export declare const amazonBedrockProvider: {
+    readonly id: "amazon-bedrock";
+    readonly name: "Amazon Bedrock";
+    readonly defaultModel: "us.anthropic.claude-opus-4-6-v1";
+    readonly envKeys: () => "<authenticated>" | undefined;
+};

package/dist/types/registry/anthropic.d.ts

@@ -0,0 +1,13 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ModelManagerConfig } from "./types";
+export declare const anthropicProvider: {
+    readonly id: "anthropic";
+    readonly name: "Anthropic (Claude Pro/Max)";
+    readonly defaultModel: "claude-opus-4-6";
+    readonly createModelManagerOptions: (config: ModelManagerConfig) => import("..").ModelManagerOptions<"anthropic-messages", unknown>;
+    readonly envKeys: () => string | undefined;
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+    readonly callbackPort: 54545;
+    readonly pasteCodeFlow: true;
+};

package/dist/types/{utils/oauth → registry}/api-key-login.d.ts

@@ -5,13 +5,19 @@
  * don't actually implement OAuth — they just ask the user to paste an API key,
  * optionally validate it, and return the trimmed key.
  */
-import type { OAuthController } from "./types";
+import type { OAuthController } from "./oauth/types";
 type ChatCompletionsValidation = {
     kind: "chat-completions";
     provider: string;
     baseUrl: string;
     model: string;
 };
+type AnthropicMessagesValidation = {
+    kind: "anthropic-messages";
+    provider: string;
+    baseUrl: string;
+    model: string;
+};
 type ModelsEndpointValidation = {
     kind: "models-endpoint";
     provider: string;
@@ -29,7 +35,7 @@ export type ApiKeyLoginConfig = {
     /** Placeholder string for the prompt (e.g. "sk-...", "csk-..."). */
     placeholder: string;
     /** Validation strategy, or `null` to skip validation. */
-    validation: ChatCompletionsValidation | ModelsEndpointValidation | null;
+    validation: ChatCompletionsValidation | AnthropicMessagesValidation | ModelsEndpointValidation | null;
 };
 export declare function createApiKeyLogin(config: ApiKeyLoginConfig): (options: OAuthController) => Promise<string>;
 export {};

package/dist/types/{utils/oauth → registry}/api-key-validation.d.ts

@@ -5,6 +5,13 @@ type OpenAICompatibleValidationOptions = {
     model: string;
     signal?: AbortSignal;
 };
+type AnthropicCompatibleValidationOptions = {
+    provider: string;
+    apiKey: string;
+    baseUrl: string;
+    model: string;
+    signal?: AbortSignal;
+};
 type ModelListValidationOptions = {
     provider: string;
     apiKey: string;
@@ -17,6 +24,10 @@ type ModelListValidationOptions = {
  * Performs a minimal request to verify credentials and endpoint access.
  */
 export declare function validateOpenAICompatibleApiKey(options: OpenAICompatibleValidationOptions): Promise<void>;
+/**
+ * Validate an API key against an Anthropic-compatible messages endpoint.
+ */
+export declare function validateAnthropicCompatibleApiKey(options: AnthropicCompatibleValidationOptions): Promise<void>;
 /**
  * Validate an API key against a provider models endpoint.
  *

package/dist/types/registry/cerebras.d.ts

@@ -0,0 +1,15 @@
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ModelManagerConfig } from "./types";
+export declare const loginCerebras: (options: import("./oauth").OAuthController) => Promise<string>;
+export declare const cerebrasProvider: {
+    readonly id: "cerebras";
+    readonly name: "Cerebras";
+    readonly defaultModel: "zai-glm-4.6";
+    readonly createModelManagerOptions: (config: ModelManagerConfig) => import("..").ModelManagerOptions<"openai-completions", unknown>;
+    readonly catalogDiscovery: {
+        readonly label: "Cerebras";
+        readonly envVars: readonly ["CEREBRAS_API_KEY"];
+    };
+    readonly envKeys: "CEREBRAS_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/cloudflare-ai-gateway.d.ts

@@ -0,0 +1,21 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import type { ModelManagerConfig } from "./types";
+/**
+ * Login to Cloudflare AI Gateway.
+ *
+ * Opens browser to Cloudflare AI Gateway authentication docs and prompts for a gateway token/API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginCloudflareAiGateway(options: OAuthController): Promise<string>;
+export declare const cloudflareAiGatewayProvider: {
+    readonly id: "cloudflare-ai-gateway";
+    readonly name: "Cloudflare AI Gateway";
+    readonly defaultModel: "claude-sonnet-4-5";
+    readonly createModelManagerOptions: (config: ModelManagerConfig) => import("..").ModelManagerOptions<"anthropic-messages", unknown>;
+    readonly catalogDiscovery: {
+        readonly label: "Cloudflare AI Gateway";
+        readonly envVars: readonly ["CLOUDFLARE_AI_GATEWAY_API_KEY"];
+    };
+    readonly envKeys: "CLOUDFLARE_AI_GATEWAY_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/cursor.d.ts

@@ -0,0 +1,16 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ModelManagerConfig } from "./types";
+export declare const cursorProvider: {
+    readonly id: "cursor";
+    readonly name: "Cursor (Claude, GPT, etc.)";
+    readonly defaultModel: "claude-sonnet-4-6";
+    readonly createModelManagerOptions: (config: ModelManagerConfig) => import("..").ModelManagerOptions<"cursor-agent", unknown>;
+    readonly catalogDiscovery: {
+        readonly label: "Cursor";
+        readonly envVars: readonly ["CURSOR_API_KEY"];
+        readonly oauthProvider: "cursor";
+    };
+    readonly envKeys: "CURSOR_ACCESS_TOKEN";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+};

package/dist/types/registry/deepseek.d.ts

@@ -0,0 +1,16 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import type { ModelManagerConfig } from "./types";
+export declare function normalizeDeepSeekApiKey(raw: string): string;
+export declare const loginDeepSeek: (options: OAuthController) => Promise<string>;
+export declare const deepseekProvider: {
+    readonly id: "deepseek";
+    readonly name: "DeepSeek";
+    readonly defaultModel: "deepseek-v4-pro";
+    readonly createModelManagerOptions: (config: ModelManagerConfig) => import("..").ModelManagerOptions<"openai-completions", unknown>;
+    readonly catalogDiscovery: {
+        readonly label: "DeepSeek";
+        readonly envVars: readonly ["DEEPSEEK_API_KEY"];
+    };
+    readonly envKeys: "DEEPSEEK_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/derived.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Providers whose OAuth flow needs a pasted code/redirect URL rather than a
+ * local callback server. Consumed by the coding-agent login UX.
+ */
+export declare const PASTE_CODE_LOGIN_PROVIDERS: ReadonlySet<string>;

package/dist/types/registry/firepass.d.ts

@@ -0,0 +1,20 @@
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ModelManagerConfig } from "./types";
+/**
+ * Fire Pass login flow.
+ *
+ * Fire Pass is a Fireworks subscription product whose dedicated `fpk_…` API
+ * keys are scoped to the `accounts/fireworks/routers/kimi-k2p6-turbo` router
+ * (Kimi K2.6 Turbo). The key does NOT authorize `/v1/models`, so validation
+ * pings the chat completions endpoint with the router id directly.
+ * See https://docs.fireworks.ai/firepass.
+ */
+export declare const loginFirepass: (options: import("./oauth").OAuthController) => Promise<string>;
+export declare const firepassProvider: {
+    readonly id: "firepass";
+    readonly name: "Fire Pass (Fireworks Kimi K2.6 Turbo subscription)";
+    readonly defaultModel: "kimi-k2.6-turbo";
+    readonly createModelManagerOptions: (config: ModelManagerConfig) => import("..").ModelManagerOptions<"openai-completions", unknown>;
+    readonly envKeys: "FIREPASS_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/fireworks.d.ts

@@ -0,0 +1,15 @@
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ModelManagerConfig } from "./types";
+export declare const loginFireworks: (options: import("./oauth").OAuthController) => Promise<string>;
+export declare const fireworksProvider: {
+    readonly id: "fireworks";
+    readonly name: "Fireworks";
+    readonly defaultModel: "kimi-k2.6";
+    readonly createModelManagerOptions: (config: ModelManagerConfig) => import("..").ModelManagerOptions<"openai-completions", unknown>;
+    readonly catalogDiscovery: {
+        readonly label: "Fireworks";
+        readonly envVars: readonly ["FIREWORKS_API_KEY"];
+    };
+    readonly envKeys: "FIREWORKS_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/github-copilot.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ModelManagerConfig } from "./types";
+export declare const githubCopilotProvider: {
+    readonly id: "github-copilot";
+    readonly name: "GitHub Copilot";
+    readonly defaultModel: "gpt-4o";
+    readonly createModelManagerOptions: (config: ModelManagerConfig) => import("..").ModelManagerOptions<import("..").Api, unknown>;
+    readonly envKeys: "COPILOT_GITHUB_TOKEN";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+};

package/dist/types/registry/gitlab-duo.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+export declare const gitlabDuoProvider: {
+    readonly id: "gitlab-duo";
+    readonly name: "GitLab Duo";
+    readonly defaultModel: "duo-chat-sonnet-4-5";
+    readonly envKeys: "GITLAB_TOKEN";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+    readonly callbackPort: 8080;
+    readonly pasteCodeFlow: true;
+};

package/dist/types/registry/google-antigravity.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+export declare const googleAntigravityProvider: {
+    readonly id: "google-antigravity";
+    readonly name: "Antigravity (Gemini 3, Claude, GPT-OSS)";
+    readonly defaultModel: "gemini-3-pro-high";
+    readonly specialModelManager: true;
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+    readonly callbackPort: 51121;
+    readonly pasteCodeFlow: true;
+};

package/dist/types/registry/google-gemini-cli.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+export declare const googleGeminiCliProvider: {
+    readonly id: "google-gemini-cli";
+    readonly name: "Google Cloud Code Assist (Gemini CLI)";
+    readonly defaultModel: "gemini-2.5-pro";
+    readonly specialModelManager: true;
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+    readonly callbackPort: 8085;
+    readonly pasteCodeFlow: true;
+};

package/dist/types/registry/google-vertex.d.ts

@@ -0,0 +1,9 @@
+import type { ModelManagerConfig } from "./types";
+export declare const googleVertexProvider: {
+    readonly id: "google-vertex";
+    readonly name: "Google Vertex AI";
+    readonly defaultModel: "gemini-3-pro-preview";
+    readonly createModelManagerOptions: (config: ModelManagerConfig) => import("..").ModelManagerOptions<import("..").Api, unknown>;
+    readonly allowUnauthenticated: true;
+    readonly envKeys: () => string | undefined;
+};

package/dist/types/registry/google.d.ts

@@ -0,0 +1,8 @@
+import type { ModelManagerConfig } from "./types";
+export declare const googleProvider: {
+    readonly id: "google";
+    readonly name: "Google Gemini";
+    readonly defaultModel: "gemini-2.5-pro";
+    readonly createModelManagerOptions: (config: ModelManagerConfig) => import("..").ModelManagerOptions<"google-generative-ai", unknown>;
+    readonly envKeys: "GEMINI_API_KEY";
+};

package/dist/types/registry/groq.d.ts

@@ -0,0 +1,8 @@
+import type { ModelManagerConfig } from "./types";
+export declare const groqProvider: {
+    readonly id: "groq";
+    readonly name: "Groq";
+    readonly defaultModel: "openai/gpt-oss-120b";
+    readonly createModelManagerOptions: (config: ModelManagerConfig) => import("..").ModelManagerOptions<"openai-completions", unknown>;
+    readonly envKeys: "GROQ_API_KEY";
+};

package/dist/types/registry/huggingface.d.ts

@@ -0,0 +1,15 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import type { ModelManagerConfig } from "./types";
+export declare function loginHuggingface(options: OAuthController): Promise<string>;
+export declare const huggingfaceProvider: {
+    readonly id: "huggingface";
+    readonly name: "Hugging Face Inference";
+    readonly defaultModel: "deepseek-ai/DeepSeek-R1";
+    readonly createModelManagerOptions: (config: ModelManagerConfig) => import("..").ModelManagerOptions<"openai-completions", unknown>;
+    readonly catalogDiscovery: {
+        readonly label: "Hugging Face";
+        readonly envVars: readonly ["HUGGINGFACE_HUB_TOKEN", "HF_TOKEN"];
+    };
+    readonly envKeys: () => string | undefined;
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./derived";
+export * from "./oauth";
+export * from "./registry";
+export * from "./types";

package/dist/types/registry/kagi.d.ts

@@ -0,0 +1,14 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+/**
+ * Login to Kagi.
+ *
+ * Opens browser to API settings and prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginKagi(options: OAuthController): Promise<string>;
+export declare const kagiProvider: {
+    readonly id: "kagi";
+    readonly name: "Kagi";
+    readonly envKeys: "KAGI_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};