@psnext/slingcli 2.4.20260601-1 → 2.5.20260602-2

package/node_modules/@earendil-works/pi-ai/dist/providers/amazon-bedrock.js

@@ -7,6 +7,7 @@ import { createHttpProxyAgentsForTarget } from "../utils/node-http-proxy.js";
 import { sanitizeSurrogates } from "../utils/sanitize-unicode.js";
 import { adjustMaxTokensForThinking, buildBaseOptions, clampReasoning } from "./simple-options.js";
 import { transformMessages } from "./transform-messages.js";
+const EMPTY_TEXT_PLACEHOLDER = "<empty>";
 export const streamBedrock = (model, context, options = {}) => {
     const stream = new AssistantMessageEventStream();
     (async () => {
@@ -89,6 +90,9 @@ export const streamBedrock = (model, context, options = {}) => {
         }
         try {
             const client = new BedrockRuntimeClient(config);
+            if (options.headers && Object.keys(options.headers).length > 0) {
+                addCustomHeadersMiddleware(client, options.headers);
+            }
             const cacheRetention = resolveCacheRetention(options.cacheRetention);
             const inferenceMaxTokens = options.maxTokens ?? (isAnthropicClaudeModel(model) ? model.maxTokens : undefined);
             let commandInput = {
@@ -205,6 +209,39 @@ function formatBedrockError(error) {
     }
     return message;
 }
+/**
+ * Header keys that must never be overwritten by caller-supplied headers.
+ * `host` and `x-amz-*` participate in the SigV4 canonical request; `authorization`
+ * is owned by SigV4 or the bearer-token path (config.token + authSchemePreference).
+ * Compared case-insensitively (caller key is lower-cased before lookup).
+ */
+const RESERVED_HEADER_EXACT = new Set(["authorization", "host"]);
+function isReservedHeader(key) {
+    const lower = key.toLowerCase();
+    return lower.startsWith("x-amz-") || RESERVED_HEADER_EXACT.has(lower);
+}
+/**
+ * Attach caller-supplied headers to the outgoing Bedrock request via a Smithy
+ * `build`-step middleware. The `build` step runs after request serialisation but
+ * before SigV4 signing, so injected headers are covered by the signature. Reserved
+ * SigV4 / auth headers (`x-amz-*`, `authorization`, `host`) are silently skipped;
+ * all other caller headers override any existing same-named header on the request.
+ */
+function addCustomHeadersMiddleware(client, headers) {
+    const middleware = (next) => async (args) => {
+        const request = args.request;
+        if (request && typeof request === "object" && "headers" in request) {
+            const requestHeaders = request.headers;
+            for (const [key, value] of Object.entries(headers)) {
+                if (!isReservedHeader(key)) {
+                    requestHeaders[key] = value;
+                }
+            }
+        }
+        return next(args);
+    };
+    client.middlewareStack.add(middleware, { step: "build", name: "pi-ai-custom-headers", priority: "low" });
+}
 export const streamSimpleBedrock = (model, context, options) => {
     const base = buildBaseOptions(model, options, undefined);
     if (!options?.reasoning) {
@@ -350,11 +387,11 @@ function getModelMatchCandidates(modelId, modelName) {
 }
 function supportsAdaptiveThinking(modelId, modelName) {
     const candidates = getModelMatchCandidates(modelId, modelName);
-    return candidates.some((s) => s.includes("opus-4-6") || s.includes("opus-4-7") || s.includes("sonnet-4-6"));
+    return candidates.some((s) => s.includes("opus-4-6") || s.includes("opus-4-7") || s.includes("opus-4-8") || s.includes("sonnet-4-6"));
 }
 function supportsNativeXhighEffort(model) {
     const candidates = getModelMatchCandidates(model.id, model.name);
-    return candidates.some((s) => s.includes("opus-4-7"));
+    return candidates.some((s) => s.includes("opus-4-7") || s.includes("opus-4-8"));
 }
 function mapThinkingLevelToEffort(model, level) {
     if (level === "xhigh" && supportsNativeXhighEffort(model))
@@ -461,6 +498,29 @@ function normalizeToolCallId(id) {
     const sanitized = id.replace(/[^a-zA-Z0-9_-]/g, "_");
     return sanitized.length > 64 ? sanitized.slice(0, 64) : sanitized;
 }
+function createNonBlankTextBlock(text) {
+    const sanitized = sanitizeSurrogates(text);
+    return sanitized.trim().length === 0 ? undefined : { text: sanitized };
+}
+function createRequiredTextBlock(text) {
+    return createNonBlankTextBlock(text) ?? { text: EMPTY_TEXT_PLACEHOLDER };
+}
+function convertToolResultContent(content) {
+    const result = [];
+    for (const c of content) {
+        if (c.type === "image") {
+            result.push({ image: createImageBlock(c.mimeType, c.data) });
+        }
+        else {
+            const textBlock = createNonBlankTextBlock(c.text);
+            if (textBlock)
+                result.push(textBlock);
+        }
+    }
+    if (result.length === 0)
+        result.push({ text: EMPTY_TEXT_PLACEHOLDER });
+    return result;
+}
 function convertMessages(context, model, cacheRetention) {
     const result = [];
     const transformedMessages = transformMessages(context.messages, model, normalizeToolCallId);
@@ -470,14 +530,17 @@ function convertMessages(context, model, cacheRetention) {
             case "user": {
                 const content = [];
                 if (typeof m.content === "string") {
-                    content.push({ text: sanitizeSurrogates(m.content) });
+                    content.push(createRequiredTextBlock(m.content));
                 }
                 else {
                     for (const c of m.content) {
                         switch (c.type) {
-                            case "text":
-                                content.push({ text: sanitizeSurrogates(c.text) });
+                            case "text": {
+                                const textBlock = createNonBlankTextBlock(c.text);
+                                if (textBlock)
+                                    content.push(textBlock);
                                 break;
+                            }
                             case "image":
                                 content.push({ image: createImageBlock(c.mimeType, c.data) });
                                 break;
@@ -485,9 +548,9 @@ function convertMessages(context, model, cacheRetention) {
                                 continue;
                         }
                     }
+                    if (content.length === 0)
+                        content.push({ text: EMPTY_TEXT_PLACEHOLDER });
                 }
-                if (content.length === 0)
-                    continue;
                 result.push({
                     role: ConversationRole.USER,
                     content,
@@ -503,20 +566,23 @@ function convertMessages(context, model, cacheRetention) {
                 const contentBlocks = [];
                 for (const c of m.content) {
                     switch (c.type) {
-                        case "text":
+                        case "text": {
                             // Skip empty text blocks
-                            if (c.text.trim().length === 0)
+                            const textBlock = createNonBlankTextBlock(c.text);
+                            if (!textBlock)
                                 continue;
-                            contentBlocks.push({ text: sanitizeSurrogates(c.text) });
+                            contentBlocks.push(textBlock);
                             break;
+                        }
                         case "toolCall":
                             contentBlocks.push({
                                 toolUse: { toolUseId: c.id, name: c.name, input: c.arguments },
                             });
                             break;
-                        case "thinking":
+                        case "thinking": {
                             // Skip empty thinking blocks
-                            if (c.thinking.trim().length === 0)
+                            const thinking = sanitizeSurrogates(c.thinking);
+                            if (thinking.trim().length === 0)
                                 continue;
                             // Only Anthropic models support the signature field in reasoningText.
                             // For other models, we omit the signature to avoid errors like:
@@ -526,13 +592,13 @@ function convertMessages(context, model, cacheRetention) {
                                 // persisted message lacks a signature, Bedrock rejects the replayed
                                 // reasoning block. Fall back to plain text, matching Anthropic.
                                 if (!c.thinkingSignature || c.thinkingSignature.trim().length === 0) {
-                                    contentBlocks.push({ text: sanitizeSurrogates(c.thinking) });
+                                    contentBlocks.push({ text: thinking });
                                 }
                                 else {
                                     contentBlocks.push({
                                         reasoningContent: {
                                             reasoningText: {
-                                                text: sanitizeSurrogates(c.thinking),
+                                                text: thinking,
                                                 signature: c.thinkingSignature,
                                             },
                                         },
@@ -542,11 +608,12 @@ function convertMessages(context, model, cacheRetention) {
                             else {
                                 contentBlocks.push({
                                     reasoningContent: {
-                                        reasoningText: { text: sanitizeSurrogates(c.thinking) },
+                                        reasoningText: { text: thinking },
                                     },
                                 });
                             }
                             break;
+                        }
                         default:
                             continue;
                     }
@@ -569,9 +636,7 @@ function convertMessages(context, model, cacheRetention) {
                 toolResults.push({
                     toolResult: {
                         toolUseId: m.toolCallId,
-                        content: m.content.map((c) => c.type === "image"
-                            ? { image: createImageBlock(c.mimeType, c.data) }
-                            : { text: sanitizeSurrogates(c.text) }),
+                        content: convertToolResultContent(m.content),
                         status: m.isError ? ToolResultStatus.ERROR : ToolResultStatus.SUCCESS,
                     },
                 });
@@ -582,9 +647,7 @@ function convertMessages(context, model, cacheRetention) {
                     toolResults.push({
                         toolResult: {
                             toolUseId: nextMsg.toolCallId,
-                            content: nextMsg.content.map((c) => c.type === "image"
-                                ? { image: createImageBlock(c.mimeType, c.data) }
-                                : { text: sanitizeSurrogates(c.text) }),
+                            content: convertToolResultContent(nextMsg.content),
                             status: nextMsg.isError ? ToolResultStatus.ERROR : ToolResultStatus.SUCCESS,
                         },
                     });

package/node_modules/@earendil-works/pi-ai/dist/providers/anthropic.js

@@ -1,5 +1,4 @@
 import Anthropic from "@anthropic-ai/sdk";
-import { getEnvApiKey } from "../env-api-keys.js";
 import { calculateCost } from "../models.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
 import { headersToRecord } from "../utils/headers.js";
@@ -116,6 +115,8 @@ function getAnthropicCompat(model) {
         supportsLongCacheRetention: model.compat?.supportsLongCacheRetention ?? !isFireworks,
         sendSessionAffinityHeaders: model.compat?.sendSessionAffinityHeaders ?? !!(isFireworks || isCloudflareAiGatewayAnthropic),
         supportsCacheControlOnTools: model.compat?.supportsCacheControlOnTools ?? !isFireworks,
+        supportsTemperature: model.compat?.supportsTemperature ?? true,
+        allowEmptySignature: model.compat?.allowEmptySignature ?? false,
     };
 }
 function mergeHeaders(...headerSources) {
@@ -306,7 +307,10 @@ export const streamAnthropic = (model, context, options) => {
                 isOAuth = false;
             }
             else {
-                const apiKey = options?.apiKey ?? getEnvApiKey(model.provider) ?? "";
+                const apiKey = options?.apiKey;
+                if (!apiKey) {
+                    throw new Error(`No API key for provider: ${model.provider}`);
+                }
                 let copilotDynamicHeaders;
                 if (model.provider === "github-copilot") {
                     const hasImages = hasCopilotVisionInput(context.messages);
@@ -548,7 +552,7 @@ function mapThinkingLevelToEffort(model, level) {
     }
 }
 export const streamSimpleAnthropic = (model, context, options) => {
-    const apiKey = options?.apiKey || getEnvApiKey(model.provider);
+    const apiKey = options?.apiKey;
     if (!apiKey) {
         throw new Error(`No API key for provider: ${model.provider}`);
     }
@@ -655,9 +659,10 @@ function createClient(model, apiKey, interleavedThinking, useFineGrainedToolStre
 }
 function buildParams(model, context, isOAuthToken, options) {
     const { cacheControl } = getCacheControl(model, options?.cacheRetention);
+    const compat = getAnthropicCompat(model);
     const params = {
         model: model.id,
-        messages: convertMessages(context.messages, model, isOAuthToken, cacheControl),
+        messages: convertMessages(context.messages, model, isOAuthToken, cacheControl, compat.allowEmptySignature),
         max_tokens: options?.maxTokens ?? model.maxTokens,
         stream: true,
     };
@@ -688,12 +693,11 @@ function buildParams(model, context, isOAuthToken, options) {
             },
         ];
     }
-    // Temperature is incompatible with extended thinking (adaptive or budget-based).
-    if (options?.temperature !== undefined && !options?.thinkingEnabled) {
+    // Temperature is incompatible with extended thinking and unsupported on Claude Opus 4.7+.
+    if (options?.temperature !== undefined && !options?.thinkingEnabled && compat.supportsTemperature) {
         params.temperature = options.temperature;
     }
     if (context.tools && context.tools.length > 0) {
-        const compat = getAnthropicCompat(model);
         params.tools = convertTools(context.tools, isOAuthToken, compat.supportsEagerToolInputStreaming, compat.supportsCacheControlOnTools ? cacheControl : undefined);
     }
     // Configure thinking mode: adaptive, budget-based, or explicitly disabled.
@@ -746,7 +750,7 @@ function buildParams(model, context, isOAuthToken, options) {
 function normalizeToolCallId(id) {
     return id.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 64);
 }
-function convertMessages(messages, model, isOAuthToken, cacheControl) {
+function convertMessages(messages, model, isOAuthToken, cacheControl, allowEmptySignature = false) {
     const params = [];
     // Transform messages for cross-provider compatibility
     const transformedMessages = transformMessages(messages, model, normalizeToolCallId);
@@ -817,13 +821,19 @@ function convertMessages(messages, model, isOAuthToken, cacheControl) {
                     if (block.thinking.trim().length === 0)
                         continue;
                     // If thinking signature is missing/empty (e.g., from aborted stream),
-                    // convert to plain text block without <thinking> tags to avoid API rejection
-                    // and prevent Claude from mimicking the tags in responses
+                    // convert to plain text for Anthropic. Some compatible providers emit
+                    // and accept empty signatures, so let marked models preserve the block.
                     if (!block.thinkingSignature || block.thinkingSignature.trim().length === 0) {
-                        blocks.push({
-                            type: "text",
-                            text: sanitizeSurrogates(block.thinking),
-                        });
+                        blocks.push(allowEmptySignature
+                            ? {
+                                type: "thinking",
+                                thinking: sanitizeSurrogates(block.thinking),
+                                signature: "",
+                            }
+                            : {
+                                type: "text",
+                                text: sanitizeSurrogates(block.thinking),
+                            });
                     }
                     else {
                         blocks.push({

package/node_modules/@earendil-works/pi-ai/dist/providers/azure-openai-responses.js

@@ -1,5 +1,4 @@
 import { AzureOpenAI } from "openai";
-import { getEnvApiKey } from "../env-api-keys.js";
 import { clampThinkingLevel } from "../models.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
 import { headersToRecord } from "../utils/headers.js";
@@ -73,7 +72,10 @@ export const streamAzureOpenAIResponses = (model, context, options) => {
         };
         try {
             // Create Azure OpenAI client
-            const apiKey = options?.apiKey || getEnvApiKey(model.provider) || "";
+            const apiKey = options?.apiKey;
+            if (!apiKey) {
+                throw new Error(`No API key for provider: ${model.provider}`);
+            }
             const client = createClient(model, apiKey, options);
             let params = buildParams(model, context, options, deploymentName);
             const nextParams = await options?.onPayload?.(params, model);
@@ -113,7 +115,7 @@ export const streamAzureOpenAIResponses = (model, context, options) => {
     return stream;
 };
 export const streamSimpleAzureOpenAIResponses = (model, context, options) => {
-    const apiKey = options?.apiKey || getEnvApiKey(model.provider);
+    const apiKey = options?.apiKey;
     if (!apiKey) {
         throw new Error(`No API key for provider: ${model.provider}`);
     }
@@ -167,12 +169,6 @@ function resolveAzureConfig(model, options) {
     };
 }
 function createClient(model, apiKey, options) {
-    if (!apiKey) {
-        if (!process.env.AZURE_OPENAI_API_KEY) {
-            throw new Error("Azure OpenAI API key is required. Set AZURE_OPENAI_API_KEY environment variable or pass it as an argument.");
-        }
-        apiKey = process.env.AZURE_OPENAI_API_KEY;
-    }
     const headers = { ...model.headers };
     if (options?.headers) {
         Object.assign(headers, options.headers);

package/node_modules/@earendil-works/pi-ai/dist/providers/google-vertex.js

@@ -300,7 +300,7 @@ function baseUrlIncludesApiVersion(baseUrl) {
     }
 }
 function resolveApiKey(options) {
-    const apiKey = options?.apiKey?.trim() || process.env.GOOGLE_CLOUD_API_KEY?.trim();
+    const apiKey = options?.apiKey?.trim();
     if (!apiKey || apiKey === GCP_VERTEX_CREDENTIALS_MARKER || isPlaceholderApiKey(apiKey)) {
         return undefined;
     }

package/node_modules/@earendil-works/pi-ai/dist/providers/google.js

@@ -1,5 +1,4 @@
 import { GoogleGenAI, } from "@google/genai";
-import { getEnvApiKey } from "../env-api-keys.js";
 import { calculateCost, clampThinkingLevel } from "../models.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
 import { sanitizeSurrogates } from "../utils/sanitize-unicode.js";
@@ -28,7 +27,10 @@ export const streamGoogle = (model, context, options) => {
             timestamp: Date.now(),
         };
         try {
-            const apiKey = options?.apiKey || getEnvApiKey(model.provider) || "";
+            const apiKey = options?.apiKey;
+            if (!apiKey) {
+                throw new Error(`No API key for provider: ${model.provider}`);
+            }
             const client = createClient(model, apiKey, options?.headers);
             let params = buildParams(model, context, options);
             const nextParams = await options?.onPayload?.(params, model);
@@ -214,7 +216,7 @@ export const streamGoogle = (model, context, options) => {
     return stream;
 };
 export const streamSimpleGoogle = (model, context, options) => {
-    const apiKey = options?.apiKey || getEnvApiKey(model.provider);
+    const apiKey = options?.apiKey;
     if (!apiKey) {
         throw new Error(`No API key for provider: ${model.provider}`);
     }

package/node_modules/@earendil-works/pi-ai/dist/providers/images/openrouter.js

@@ -1,5 +1,4 @@
 import OpenAI from "openai";
-import { getEnvApiKey } from "../../env-api-keys.js";
 import { headersToRecord } from "../../utils/headers.js";
 import { sanitizeSurrogates } from "../../utils/sanitize-unicode.js";
 export const generateImagesOpenRouter = async (model, context, options) => {
@@ -12,9 +11,9 @@ export const generateImagesOpenRouter = async (model, context, options) => {
         timestamp: Date.now(),
     };
     try {
-        const apiKey = options?.apiKey || getEnvApiKey(model.provider);
+        const apiKey = options?.apiKey;
         if (!apiKey) {
-            throw new Error(`No API key available for provider: ${model.provider}`);
+            throw new Error(`No API key for provider: ${model.provider}`);
         }
         const client = createClient(model, apiKey, options?.headers);
         let params = buildParams(model, context);

package/node_modules/@earendil-works/pi-ai/dist/providers/mistral.js

@@ -1,5 +1,4 @@
 import { Mistral } from "@mistralai/mistralai";
-import { getEnvApiKey } from "../env-api-keys.js";
 import { calculateCost, clampThinkingLevel } from "../models.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
 import { shortHash } from "../utils/hash.js";
@@ -17,7 +16,7 @@ export const streamMistral = (model, context, options) => {
     (async () => {
         const output = createOutput(model);
         try {
-            const apiKey = options?.apiKey || getEnvApiKey(model.provider);
+            const apiKey = options?.apiKey;
             if (!apiKey) {
                 throw new Error(`No API key for provider: ${model.provider}`);
             }
@@ -62,7 +61,7 @@ export const streamMistral = (model, context, options) => {
  * Maps provider-agnostic `SimpleStreamOptions` to Mistral options.
  */
 export const streamSimpleMistral = (model, context, options) => {
-    const apiKey = options?.apiKey || getEnvApiKey(model.provider);
+    const apiKey = options?.apiKey;
     if (!apiKey) {
         throw new Error(`No API key for provider: ${model.provider}`);
     }