@oh-my-pi/pi-ai 16.1.13 → 16.1.14

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## [Unreleased]
 
+## [16.1.14] - 2026-06-22
+
+### Added
+
+- Added proxy support for model providers via `PI_PROXY` and `PI_PROXY_<PROVIDER>` variables
+- Added `NO_PROXY` environment variable support for bypassing proxy configuration
+- Added support for Sakana AI provider
+- Added Sakana AI login and request base URL support for `SAKANA_*` / `FUGU_*` environment variables
+
+### Changed
+
+- Consolidated API key authentication logic across registry providers
+- Disabled parallel tool calls for Devin provider requests
+
+### Fixed
+
+- Improved proxy bypass logic to correctly handle private IP ranges and local metadata services
+- Enhanced memoization for proxy environment variable lookups to improve performance
+
 ## [16.1.13] - 2026-06-22
 
 ### Added

package/dist/types/providers/aws-credentials.d.ts

@@ -18,6 +18,7 @@
  * Resolved credentials are cached process-wide per profile and refreshed
  * 60 s before `Expiration` to absorb clock skew.
  */
+import type { FetchImpl } from "../types";
 import type { AwsCredentials } from "./aws-sigv4";
 export interface ResolvedCredentials extends AwsCredentials {
     /** Absolute expiration timestamp in ms. `undefined` for non-expiring static creds. */
@@ -29,6 +30,7 @@ export interface CredentialResolveOptions {
     /** Falls back to env (`AWS_REGION` / `AWS_DEFAULT_REGION`) and finally `us-east-1`. */
     region?: string;
     signal?: AbortSignal;
+    fetch?: FetchImpl;
 }
 export declare function resolveAwsCredentials(opts?: CredentialResolveOptions): Promise<ResolvedCredentials>;
 /** POSIX-shell-style tokenizer used by the AWS CLI for `credential_process`.

package/dist/types/registry/huggingface.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
-export declare function loginHuggingface(options: OAuthController): Promise<string>;
+import type { OAuthLoginCallbacks } from "./oauth/types";
+export declare const loginHuggingface: (options: import("./oauth").OAuthController) => Promise<string>;
 export declare const huggingfaceProvider: {
     readonly id: "huggingface";
     readonly name: "Hugging Face Inference";

package/dist/types/registry/oauth/minimax-code.d.ts

@@ -12,17 +12,16 @@
  * International: https://api.minimax.io/v1
  * China: https://api.minimaxi.com/v1
  */
-import type { OAuthController } from "./types";
 /**
  * Login to MiniMax Token Plan (international).
  *
  * Opens browser to subscription page, prompts user to paste their API key.
  * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
  */
-export declare function loginMiniMaxCode(options: OAuthController): Promise<string>;
+export declare const loginMiniMaxCode: (options: import("./types").OAuthController) => Promise<string>;
 /**
  * Login to MiniMax Token Plan (China).
  *
  * Same flow as international but uses China endpoint.
  */
-export declare function loginMiniMaxCodeCn(options: OAuthController): Promise<string>;
+export declare const loginMiniMaxCodeCn: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/registry/qianfan.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
-export declare function loginQianfan(options: OAuthController): Promise<string>;
+import type { OAuthLoginCallbacks } from "./oauth/types";
+export declare const loginQianfan: (options: import("./oauth").OAuthController) => Promise<string>;
 export declare const qianfanProvider: {
     readonly id: "qianfan";
     readonly name: "Qianfan";

package/dist/types/registry/registry.d.ts

@@ -208,6 +208,10 @@ declare const ALL: ({
     readonly id: "qwen-portal";
     readonly name: "Qwen Portal";
     readonly login: (cb: import("./oauth").OAuthLoginCallbacks) => Promise<string>;
+} | {
+    readonly id: "sakana";
+    readonly name: "Sakana AI";
+    readonly login: (cb: import("./oauth").OAuthLoginCallbacks) => Promise<string>;
 } | {
     readonly id: "synthetic";
     readonly name: "Synthetic";

package/dist/types/registry/sakana.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types";
+export declare const loginSakana: (options: import("./oauth").OAuthController) => Promise<string>;
+export declare const sakanaProvider: {
+    readonly id: "sakana";
+    readonly name: "Sakana AI";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/venice.d.ts

@@ -1,11 +1,11 @@
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import type { OAuthLoginCallbacks } from "./oauth/types";
 /**
  * Login to Venice.
  *
  * Opens browser to API keys page, prompts user to paste their API key.
  * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
  */
-export declare function loginVenice(options: OAuthController): Promise<string>;
+export declare const loginVenice: (options: import("./oauth").OAuthController) => Promise<string>;
 export declare const veniceProvider: {
     readonly id: "venice";
     readonly name: "Venice";

package/dist/types/registry/zai.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
-export declare function loginZai(options: OAuthController): Promise<string>;
+import type { OAuthLoginCallbacks } from "./oauth/types";
+export declare const loginZai: (options: import("./oauth").OAuthController) => Promise<string>;
 export declare const zaiProvider: {
     readonly id: "zai";
     readonly name: "Z.AI (GLM Coding Plan)";

package/dist/types/registry/zhipu-coding-plan.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
-export declare function loginZhipuCodingPlan(options: OAuthController): Promise<string>;
+import type { OAuthLoginCallbacks } from "./oauth/types";
+export declare const loginZhipuCodingPlan: (options: import("./oauth").OAuthController) => Promise<string>;
 export declare const zhipuCodingPlanProvider: {
     readonly id: "zhipu-coding-plan";
     readonly name: "Zhipu Coding Plan (智谱)";

package/dist/types/utils/deterministic-id.d.ts

@@ -0,0 +1,16 @@
+/**
+ * A UUID-shaped string: five hex groups in the canonical 8-4-4-4-12 layout.
+ *
+ * NOT a spec-compliant RFC 4122 UUID — the version/variant nibbles are left as
+ * raw hash output — but the shape passes everywhere a UUID string is expected.
+ */
+export type DeterministicUuid = `${string}-${string}-${string}-${string}-${string}`;
+/**
+ * Format the leading 128 bits of `seed`'s SHA-256 digest as a v4-shape UUID
+ * (8-4-4-4-12 hex groups).
+ *
+ * Deterministic: identical seeds always map to the same id, so callers get
+ * stable ids across requests / conversation turns (reusing message-blob ids,
+ * keying prompt caches) without persisting a seed→id mapping.
+ */
+export declare function deterministicUuid(seed: string): DeterministicUuid;

package/dist/types/utils/proxy.d.ts

@@ -0,0 +1,29 @@
+import * as tls from "node:tls";
+import type { FetchImpl } from "../types";
+/**
+ * Checks if a host is local or cloud metadata, which should always bypass the proxy
+ * (e.g. localhost, 127/8, ::1, 169.254.169.254, metadata.google.internal).
+ */
+export declare function isLocalOrMetadataHost(host: string): boolean;
+/**
+ * Check if the url should bypass the proxy due to hard-coded localhost/metadata checks
+ * or custom NO_PROXY/no_proxy environment variables rules.
+ */
+export declare function shouldBypassProxy(urlObj: URL): boolean;
+/** Test seam: clears the provider proxy cache. */
+export declare function __resetProxyCache(): void;
+/**
+ * Normalizes provider id (e.g. github-copilot -> PI_PROXY_GITHUB_COPILOT) and looks it up.
+ * If not found, falls back to PI_PROXY. Results are memoized because env values are static
+ * for the lifetime of the process and this function is called for every outgoing request.
+ */
+export declare function getProxyForProvider(provider: string): string | undefined;
+/**
+ * Wraps a fetch implementation to inject proxy options for non-local hosts.
+ */
+export declare function wrapFetchForProxy(fetchImpl: FetchImpl, provider: string): FetchImpl;
+/**
+ * Tunnel a socket connection through an HTTP CONNECT proxy.
+ * This is used specifically to wrap Node's `http2.connect(baseUrl, { createConnection })` for Cursor.
+ */
+export declare function connectProxiedSocket(proxyUrlStr: string, targetUrlStr: string): Promise<tls.TLSSocket>;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "16.1.13",
+	"version": "16.1.14",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.0",
-		"@oh-my-pi/pi-catalog": "16.1.13",
-		"@oh-my-pi/pi-utils": "16.1.13",
-		"@oh-my-pi/pi-wire": "16.1.13",
+		"@oh-my-pi/pi-catalog": "16.1.14",
+		"@oh-my-pi/pi-utils": "16.1.14",
+		"@oh-my-pi/pi-wire": "16.1.14",
 		"arktype": "^2.2.0",
 		"zod": "^4"
 	},

package/src/auth-gateway/server.ts

@@ -29,6 +29,7 @@ import * as piNative from "../providers/pi-native-server";
 import { isUsageLimitError } from "../rate-limit-utils";
 import { streamSimple } from "../stream";
 import type { Api, AssistantMessageEventStream, Context, Model, SimpleStreamOptions } from "../types";
+import { deterministicUuid } from "../utils/deterministic-id";
 import { parseBind } from "../utils/parse-bind";
 import { captureRequestHeaders, corsHeaders, isAuthorized, json, resolvePeer, withCors } from "./http";
 import type {
@@ -110,11 +111,9 @@ function deriveSessionId(modelId: string, context: Context): string {
 		parts.push(JSON.stringify({ role: first.role, content: first.content }));
 	}
 	const seed = parts.join("\u0000");
-	const hex = new Bun.CryptoHasher("sha256").update(seed).digest("hex");
-	// Format the leading 128 bits as a v4-shape UUID (8-4-4-4-12). Codex's
-	// `normalizeOpenAIResponsesPromptCacheKey` accepts ≤64 chars verbatim, so
-	// the 36-char UUID flows through unchanged.
-	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+	// The 36-char UUID flows through unchanged: Codex's
+	// `normalizeOpenAIResponsesPromptCacheKey` accepts ≤64 chars verbatim.
+	return deterministicUuid(seed);
 }
 
 function buildStreamOptions(parsed: ParsedFormatRequest, api: Api, signal: AbortSignal): SimpleStreamOptions {

package/src/providers/amazon-bedrock.ts

@@ -302,6 +302,7 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 						profile: options.profile,
 						region,
 						signal: options.signal,
+						fetch: options.fetch,
 					});
 				}
 				const signed = await signRequest({

package/src/providers/aws-credentials.ts

@@ -23,6 +23,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { $env, isEnoent, logger } from "@oh-my-pi/pi-utils";
+import type { FetchImpl } from "../types";
 import { raceWithSignal } from "../utils/abort";
 import type { AwsCredentials } from "./aws-sigv4";
 
@@ -37,6 +38,7 @@ export interface CredentialResolveOptions {
 	/** Falls back to env (`AWS_REGION` / `AWS_DEFAULT_REGION`) and finally `us-east-1`. */
 	region?: string;
 	signal?: AbortSignal;
+	fetch?: FetchImpl;
 }
 
 const REFRESH_SKEW_MS = 60_000;
@@ -75,9 +77,10 @@ export async function resolveAwsCredentials(opts: CredentialResolveOptions = {})
 	const existing = inflight.get(cacheKey);
 	if (existing) return raceWithSignal(existing, opts.signal);
 
+	const fetchImpl = opts.fetch ?? (globalThis.fetch as FetchImpl);
 	const promise = (async () => {
 		try {
-			const creds = await resolveFresh(profile, region, AbortSignal.timeout(SHARED_RESOLVE_TIMEOUT_MS));
+			const creds = await resolveFresh(profile, region, AbortSignal.timeout(SHARED_RESOLVE_TIMEOUT_MS), fetchImpl);
 			cache.set(cacheKey, { creds, expiresAt: creds.expiresAt ?? Number.POSITIVE_INFINITY });
 			return creds;
 		} finally {
@@ -88,18 +91,23 @@ export async function resolveAwsCredentials(opts: CredentialResolveOptions = {})
 	return raceWithSignal(promise, opts.signal);
 }
 
-async function resolveFresh(profile: string, region: string, signal?: AbortSignal): Promise<ResolvedCredentials> {
+async function resolveFresh(
+	profile: string,
+	region: string,
+	signal?: AbortSignal,
+	fetchImpl: FetchImpl = globalThis.fetch as FetchImpl,
+): Promise<ResolvedCredentials> {
 	// 1. Environment first — matches the AWS SDK chain order.
 	const envCreds = readEnvCredentials();
 	if (envCreds) return envCreds;
 
 	// 2. Profile (static or SSO).
-	const profileCreds = await readProfileCredentials(profile, region, signal);
+	const profileCreds = await readProfileCredentials(profile, region, signal, fetchImpl);
 	if (profileCreds) return profileCreds;
 
 	// 3. EC2 IMDSv2.
 	if ($env.AWS_EC2_METADATA_DISABLED?.toLowerCase() !== "true") {
-		const imdsCreds = await readImdsCredentials(signal);
+		const imdsCreds = await readImdsCredentials(signal, fetchImpl);
 		if (imdsCreds) return imdsCreds;
 	}
 
@@ -167,6 +175,7 @@ async function readProfileCredentials(
 	profile: string,
 	region: string,
 	signal: AbortSignal | undefined,
+	fetchImpl: FetchImpl,
 ): Promise<ResolvedCredentials | undefined> {
 	const home = os.homedir();
 	const credentialsPath = $env.AWS_SHARED_CREDENTIALS_FILE || path.join(home, ".aws", "credentials");
@@ -195,7 +204,7 @@ async function readProfileCredentials(
 	}
 
 	if (merged.sso_account_id && merged.sso_role_name) {
-		return readSsoCredentials(merged, configIni, region, signal);
+		return readSsoCredentials(merged, configIni, region, signal, fetchImpl);
 	}
 
 	if (merged.credential_process) {
@@ -217,6 +226,7 @@ async function readSsoCredentials(
 	configIni: IniFile | undefined,
 	defaultRegion: string,
 	signal: AbortSignal | undefined,
+	fetchImpl: FetchImpl,
 ): Promise<ResolvedCredentials | undefined> {
 	// Two SSO profile shapes:
 	//   - legacy: `sso_start_url` + `sso_region` directly on the profile
@@ -246,7 +256,7 @@ async function readSsoCredentials(
 		`https://portal.sso.${ssoRegion}.amazonaws.com/federation/credentials` +
 		`?account_id=${encodeURIComponent(profileCfg.sso_account_id)}` +
 		`&role_name=${encodeURIComponent(profileCfg.sso_role_name)}`;
-	const response = await fetch(url, {
+	const response = await fetchImpl(url, {
 		method: "GET",
 		headers: { "x-amz-sso_bearer_token": token.accessToken },
 		signal,
@@ -480,11 +490,14 @@ export function tokenizeCredentialProcessCommand(cmd: string): string[] {
 const IMDS_HOST = "169.254.169.254";
 const IMDS_TIMEOUT_MS = 1000;
 
-async function readImdsCredentials(parentSignal: AbortSignal | undefined): Promise<ResolvedCredentials | undefined> {
+async function readImdsCredentials(
+	parentSignal: AbortSignal | undefined,
+	fetchImpl: FetchImpl,
+): Promise<ResolvedCredentials | undefined> {
 	const timeout = AbortSignal.timeout(IMDS_TIMEOUT_MS);
 	const signal = parentSignal ? AbortSignal.any([parentSignal, timeout]) : timeout;
 	try {
-		const tokenRes = await fetch(`http://${IMDS_HOST}/latest/api/token`, {
+		const tokenRes = await fetchImpl(`http://${IMDS_HOST}/latest/api/token`, {
 			method: "PUT",
 			headers: { "x-aws-ec2-metadata-token-ttl-seconds": "21600" },
 			signal,
@@ -492,7 +505,7 @@ async function readImdsCredentials(parentSignal: AbortSignal | undefined): Promi
 		if (!tokenRes.ok) return undefined;
 		const token = await tokenRes.text();
 
-		const roleRes = await fetch(`http://${IMDS_HOST}/latest/meta-data/iam/security-credentials/`, {
+		const roleRes = await fetchImpl(`http://${IMDS_HOST}/latest/meta-data/iam/security-credentials/`, {
 			headers: { "x-aws-ec2-metadata-token": token },
 			signal,
 		});
@@ -500,7 +513,7 @@ async function readImdsCredentials(parentSignal: AbortSignal | undefined): Promi
 		const role = (await roleRes.text()).trim();
 		if (!role) return undefined;
 
-		const credsRes = await fetch(
+		const credsRes = await fetchImpl(
 			`http://${IMDS_HOST}/latest/meta-data/iam/security-credentials/${encodeURIComponent(role)}`,
 			{
 				headers: { "x-aws-ec2-metadata-token": token },

package/src/providers/cursor.ts

@@ -124,8 +124,10 @@ import type {
 	ToolResultMessage,
 } from "../types";
 import { normalizeSystemPrompts } from "../utils";
+import { deterministicUuid } from "../utils/deterministic-id";
 import { AssistantMessageEventStream } from "../utils/event-stream";
 import { parseJsonWithRepair, parseStreamingJson } from "../utils/json-parse";
+import { connectProxiedSocket, getProxyForProvider, shouldBypassProxy } from "../utils/proxy";
 import { createRequestDebugSession, isRequestDebugEnabled, type RequestDebugResponseLog } from "../utils/request-debug";
 import { formatErrorMessageWithRetryAfter } from "../utils/retry-after";
 import { toolWireSchema } from "../utils/schema/wire";
@@ -376,7 +378,15 @@ export const streamCursor: StreamFunction<"cursor-agent"> = (
 					})
 				: undefined;
 
-			h2Client = http2.connect(baseUrl);
+			const proxyUrl = shouldBypassProxy(new URL(baseUrl)) ? undefined : getProxyForProvider(model.provider);
+			if (proxyUrl) {
+				const tlsSocket = await connectProxiedSocket(proxyUrl, baseUrl);
+				h2Client = http2.connect(baseUrl, {
+					createConnection: () => tlsSocket,
+				});
+			} else {
+				h2Client = http2.connect(baseUrl);
+			}
 
 			h2Request = h2Client.request(requestHeaders);
 
@@ -2258,19 +2268,6 @@ function extractAssistantMessageText(msg: Message): string {
 		.join("\n");
 }
 
-/**
- * Derive a stable, UUID-formatted `message_id` from a content key.
- * Ensures identical historical messages hash to the same blob IDs across
- * requests, so `conversationBlobStores` does not grow unboundedly and
- * unchanged history reuses existing blob IDs.
- */
-type CursorMessageId = `${string}-${string}-${string}-${string}-${string}`;
-
-function deterministicMessageId(key: string): CursorMessageId {
-	const hex = createHash("sha256").update(key).digest("hex");
-	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
-}
-
 /**
  * Index of the last user/developer message in `messages`, or -1 if none.
  * Used to exclude the current user turn from history builders — it goes in
@@ -2394,7 +2391,7 @@ function buildConversationTurns(
 		const userMessage = createCursorUserMessage(
 			msg.content,
 			userText,
-			deterministicMessageId(`u:${turns.length}:${cursorUserContentKey(msg.content)}`),
+			deterministicUuid(`u:${turns.length}:${cursorUserContentKey(msg.content)}`),
 		);
 		const userMessageBytes = toBinary(UserMessageSchema, userMessage);
 		const userMessageBlobId = storeCursorBlob(blobStore, userMessageBytes);

package/src/providers/devin.ts

@@ -42,6 +42,7 @@ import type {
 	Tool,
 	ToolCall,
 } from "../types";
+import { deterministicUuid } from "../utils/deterministic-id";
 import { AssistantMessageEventStream } from "../utils/event-stream";
 import { parseStreamingJson } from "../utils/json-parse";
 import { formatErrorMessageWithRetryAfter } from "../utils/retry-after";
@@ -427,7 +428,7 @@ function buildDevinChatRequest(
 		plannerMode: ConversationalPlannerMode.DEFAULT,
 		toolChoice: create(ChatToolChoiceSchema, { choice: { case: "optionName", value: "auto" } }),
 		systemPromptCacheOptions: create(PromptCacheOptionsSchema, { type: CacheControlType.EPHEMERAL }),
-		disableParallelToolCalls: false,
+		disableParallelToolCalls: true,
 		cascadeId,
 		executionId: crypto.randomUUID(),
 		configuration: create(CompletionConfigurationSchema, {
@@ -455,6 +456,8 @@ function buildDevinChatRequest(
 /** Map omp `Message` history onto Cascade `ChatMessagePrompt`s (USER / SYSTEM / TOOL channels). */
 function buildChatMessagePrompts(messages: Message[], cascadeId: string): ChatMessagePrompt[] {
 	const prompts: ChatMessagePrompt[] = [];
+	// messageId seeds are `cascadeId\0index\0role[...]` — prompt text is excluded
+	// so ids stay stable across content edits / history rebuilds.
 	for (const [index, msg] of messages.entries()) {
 		if (msg.role === "user" || msg.role === "developer") {
 			let promptText = "";
@@ -472,7 +475,7 @@ function buildChatMessagePrompts(messages: Message[], cascadeId: string): ChatMe
 			}
 			prompts.push(
 				create(ChatMessagePromptSchema, {
-					messageId: deterministicMessageId(`${cascadeId}\0${index}\0${msg.role}`),
+					messageId: deterministicUuid(`${cascadeId}\0${index}\0${msg.role}`),
 					source: ChatMessageSource.USER,
 					prompt: promptText,
 					images,
@@ -501,7 +504,7 @@ function buildChatMessagePrompts(messages: Message[], cascadeId: string): ChatMe
 			}
 			prompts.push(
 				create(ChatMessagePromptSchema, {
-					messageId: msg.responseId ?? `bot-${deterministicMessageId(`${cascadeId}\0${index}\0assistant`)}`,
+					messageId: msg.responseId ?? `bot-${deterministicUuid(`${cascadeId}\0${index}\0assistant`)}`,
 					source: ChatMessageSource.SYSTEM,
 					prompt: promptText,
 					thinking: thinkingText,
@@ -522,7 +525,7 @@ function buildChatMessagePrompts(messages: Message[], cascadeId: string): ChatMe
 			}
 			prompts.push(
 				create(ChatMessagePromptSchema, {
-					messageId: deterministicMessageId(`${cascadeId}\0${index}\0tool\0${msg.toolCallId}`),
+					messageId: deterministicUuid(`${cascadeId}\0${index}\0tool\0${msg.toolCallId}`),
 					source: ChatMessageSource.TOOL,
 					toolCallId: msg.toolCallId,
 					toolResultIsError: msg.isError,
@@ -535,16 +538,6 @@ function buildChatMessagePrompts(messages: Message[], cascadeId: string): ChatMe
 	return prompts;
 }
 
-/**
- * Deterministic UUID-shaped message id derived from a stable per-message seed.
- * Seed is `${cascadeId}\0${index}\0${role}[...]` — prompt text is intentionally
- * excluded so ids stay stable across content edits / history rebuilds.
- */
-function deterministicMessageId(seed: string): string {
-	const hex = new Bun.CryptoHasher("sha256").update(seed).digest("hex");
-	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
-}
-
 /**
  * Parse a Connect end-of-stream JSON trailer and return a human-readable error
  * string when it carries `{ error: { code, message } }`, else `null`. The trailer

package/src/providers/openai-responses.ts

@@ -436,7 +436,8 @@ const streamOpenAIResponsesOnce = (
 					? buildOpenAIResponsesChainedParams(params, trailingScaffoldingItems, chainState)
 					: { params };
 			sentPreviousResponseId = chained.previousResponseId;
-			const idleTimeoutMs = options?.streamIdleTimeoutMs ?? getOpenAIStreamIdleTimeoutMs();
+			const idleTimeoutMs =
+				options?.streamIdleTimeoutMs ?? getOpenAIStreamIdleTimeoutMs(model.compat.streamIdleTimeoutMs);
 			const firstEventTimeoutMs =
 				options?.streamFirstEventTimeoutMs ?? getOpenAIStreamFirstEventTimeoutMs(idleTimeoutMs);
 			const requestTimeoutMs =

package/src/providers/openai-shared.ts

@@ -130,6 +130,17 @@ export interface OpenAIRequestSetup {
 	requestHeaders: Record<string, string>;
 }
 
+function normalizeSakanaRequestBaseUrl(baseUrl: string | undefined): string | undefined {
+	const value = baseUrl?.trim();
+	if (!value) return undefined;
+	const normalized = value.replace(/\/+$/, "");
+	return normalized.endsWith("/v1") ? normalized : `${normalized}/v1`;
+}
+
+function resolveSakanaRequestBaseUrl(): string | undefined {
+	return normalizeSakanaRequestBaseUrl($env.SAKANA_BASE_URL) ?? normalizeSakanaRequestBaseUrl($env.FUGU_BASE_URL);
+}
+
 export function resolveOpenAIRequestSetup(
 	model: OpenAIRequestSetupModel,
 	options: OpenAIRequestSetupOptions,
@@ -165,6 +176,12 @@ export function resolveOpenAIRequestSetup(
 			baseUrl = moonshotBaseUrl;
 		}
 	}
+	if (model.provider === "sakana") {
+		const sakanaBaseUrl = resolveSakanaRequestBaseUrl();
+		if (sakanaBaseUrl) {
+			baseUrl = sakanaBaseUrl;
+		}
+	}
 	if (model.provider === "github-copilot") {
 		apiKey = parseGitHubCopilotApiKey(rawApiKey).accessToken;
 		const copilot = buildCopilotDynamicHeaders({

package/src/registry/huggingface.ts

@@ -1,5 +1,5 @@
-import { validateOpenAICompatibleApiKey } from "./api-key-validation";
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
 import type { ProviderDefinition } from "./types";
 
 const AUTH_URL =
@@ -7,42 +7,20 @@ const AUTH_URL =
 const API_BASE_URL = "https://router.huggingface.co/v1";
 const VALIDATION_MODEL = "openai/gpt-oss-120b";
 
-export async function loginHuggingface(options: OAuthController): Promise<string> {
-	if (!options.onPrompt) {
-		throw new Error("Hugging Face login requires onPrompt callback");
-	}
-
-	options.onAuth?.({
-		url: AUTH_URL,
-		instructions:
-			"Create/copy a token with Make calls to Inference Providers permission (usable as HUGGINGFACE_HUB_TOKEN or HF_TOKEN)",
-	});
-
-	const apiKey = await options.onPrompt({
-		message: "Paste your Hugging Face token (HUGGINGFACE_HUB_TOKEN / HF_TOKEN)",
-		placeholder: "hf_...",
-	});
-
-	if (options.signal?.aborted) {
-		throw new Error("Login cancelled");
-	}
-
-	const trimmed = apiKey.trim();
-	if (!trimmed) {
-		throw new Error("API key is required");
-	}
-
-	options.onProgress?.("Validating API key...");
-	await validateOpenAICompatibleApiKey({
+export const loginHuggingface = createApiKeyLogin({
+	providerLabel: "Hugging Face",
+	authUrl: AUTH_URL,
+	instructions:
+		"Create/copy a token with Make calls to Inference Providers permission (usable as HUGGINGFACE_HUB_TOKEN or HF_TOKEN)",
+	promptMessage: "Paste your Hugging Face token (HUGGINGFACE_HUB_TOKEN / HF_TOKEN)",
+	placeholder: "hf_...",
+	validation: {
+		kind: "chat-completions",
 		provider: "Hugging Face",
-		apiKey: trimmed,
 		baseUrl: API_BASE_URL,
 		model: VALIDATION_MODEL,
-		signal: options.signal,
-	});
-
-	return trimmed;
-}
+	},
+});
 
 export const huggingfaceProvider = {
 	id: "huggingface",