@sayknow-cli/ai 0.4.6 → 0.5.0

package/README.md

@@ -69,6 +69,8 @@ Unified LLM API with automatic model discovery, provider configuration, token an
 - **MiniMax Coding Plan** (requires `MINIMAX_CODE_API_KEY` or `MINIMAX_CODE_CN_API_KEY`)
 - **Xiaomi MiMo** (requires `XIAOMI_API_KEY`)
 - **ZenMux** (requires `ZENMUX_API_KEY`)
+- **OpenGateway by Sionic AI** (requires `OPENGATEWAY_API_KEY`)
+- **BizRouter** (requires `BIZROUTER_API_KEY`)
 - **Qwen Portal** (supports `QWEN_OAUTH_TOKEN` or `QWEN_PORTAL_API_KEY`)
 - **Cloudflare AI Gateway** (requires `CLOUDFLARE_AI_GATEWAY_API_KEY` and provider-specific gateway base URL)
 - **Ollama** (local OpenAI-compatible runtime; optional `OLLAMA_API_KEY`)
@@ -954,6 +956,8 @@ In Node.js environments, you can set environment variables to avoid passing API
 | MiniMax Code   | `MINIMAX_CODE_API_KEY` (international) or `MINIMAX_CODE_CN_API_KEY` (China) |
 | Xiaomi MiMo    | `XIAOMI_API_KEY`                                                             |
 | ZenMux         | `ZENMUX_API_KEY`                                                             |
+| OpenGateway    | `OPENGATEWAY_API_KEY`                                                        |
+| BizRouter      | `BIZROUTER_API_KEY`                                                          |
 | vLLM           | `VLLM_API_KEY`                                                               |
 | Cloudflare AI Gateway | `CLOUDFLARE_AI_GATEWAY_API_KEY`                                      |
 | GitHub Copilot | `COPILOT_GITHUB_TOKEN` or `GH_TOKEN` or `GITHUB_TOKEN`                      |
@@ -977,6 +981,8 @@ Provider endpoint defaults for the current OpenAI-compatible integrations:
 - Xiaomi MiMo: `https://api.xiaomimimo.com/anthropic`
 - ZenMux (OpenAI): `https://zenmux.ai/api/v1`
 - ZenMux (Anthropic models): `https://zenmux.ai/api/anthropic`
+- OpenGateway by Sionic AI: `https://apis.opengateway.ai/v1`
+- BizRouter: `https://api.bizrouter.ai/v1`
 - vLLM: `http://127.0.0.1:8000/v1`
 - Ollama: local OpenAI-compatible runtime (`http://127.0.0.1:11434/v1`)
 - Ollama Cloud: native Ollama API host (`https://ollama.com/api`, configured here as base URL `https://ollama.com`)

package/dist/types/auth-broker/client.d.ts

@@ -1,5 +1,5 @@
 import type { AuthCredential } from "../auth-storage";
-import type { CredentialDisableResponse, CredentialIfAbsentUploadResponse, CredentialRefreshResponse, CredentialUploadResponse, HealthzResponse, SnapshotResponse, SnapshotStreamEvent, UsageResponse } from "./types";
+import type { CredentialDisableResponse, CredentialIfAbsentUploadResponse, CredentialRefreshRequest, CredentialRefreshResponse, CredentialUploadResponse, HealthzResponse, SnapshotResponse, SnapshotStreamEvent, UsageResponse } from "./types";
 export interface AuthBrokerClientOptions {
     /** Base URL (e.g. `https://broker.tailnet:8765`). Trailing slashes are trimmed. */
     url: string;
@@ -61,6 +61,7 @@ export declare class AuthBrokerClient {
     }): AsyncGenerator<SnapshotStreamEvent>;
     fetchUsage(signal?: AbortSignal): Promise<UsageResponse>;
     refreshCredential(id: number, signal?: AbortSignal): Promise<CredentialRefreshResponse>;
+    refreshMCPCredential(id: number, body: CredentialRefreshRequest, signal?: AbortSignal): Promise<CredentialRefreshResponse>;
     disableCredential(id: number, cause: string, signal?: AbortSignal): Promise<CredentialDisableResponse>;
     uploadCredential(provider: string, credential: AuthCredential, signal?: AbortSignal): Promise<CredentialUploadResponse>;
     uploadCredentialIfAbsent(provider: string, credential: AuthCredential, signal?: AbortSignal): Promise<CredentialIfAbsentUploadResponse>;

package/dist/types/auth-broker/remote-store.d.ts

@@ -1,4 +1,4 @@
-import { type AuthCredential, type AuthCredentialIfAbsentResult, type AuthCredentialStore, type OAuthCredential, type StoredAuthCredential } from "../auth-storage";
+import { type AuthCredential, type AuthCredentialIfAbsentResult, type AuthCredentialStore, type MCPOAuthRefreshClient, type OAuthCredential, type StoredAuthCredential } from "../auth-storage";
 import type { Provider } from "../types";
 import type { UsageReport } from "../usage";
 import type { OAuthCredentials } from "../utils/oauth/types";
@@ -78,6 +78,7 @@ export declare class RemoteAuthCredentialStore implements AuthCredentialStore {
      * the `refresh` slot.
      */
     refreshOAuthCredential(_provider: Provider, credentialId: number, _credential: OAuthCredential, signal?: AbortSignal): Promise<OAuthCredentials>;
+    refreshMCPOAuthCredential(credentialId: number, credential: OAuthCredential, client: MCPOAuthRefreshClient, signal?: AbortSignal): Promise<OAuthCredential>;
     /**
      * Store-level hook consumed by `AuthStorage.fetchUsageReports()` — proxies
      * to the broker's `/v1/usage` endpoint. The broker's egress IP isn't

package/dist/types/auth-broker/types.d.ts

@@ -5,7 +5,7 @@
  * clients use `access` tokens directly and call back to the broker when a
  * credential expires or a 401 surfaces on a supposedly-fresh credential.
  */
-import type { AuthCredential, AuthCredentialIfAbsentReason, AuthCredentialSnapshot, AuthCredentialSnapshotEntry } from "../auth-storage";
+import type { AuthCredential, AuthCredentialIfAbsentReason, AuthCredentialSnapshot, AuthCredentialSnapshotEntry, MCPOAuthRefreshClient } from "../auth-storage";
 import type { UsageReport } from "../usage";
 /** GET /v1/healthz response body. */
 export interface HealthzResponse {
@@ -36,6 +36,8 @@ export interface UsageResponse {
 export interface CredentialRefreshResponse {
     entry: AuthCredentialSnapshotEntry;
 }
+/** Optional MCP client metadata; the broker still selects the stored token endpoint. */
+export type CredentialRefreshRequest = MCPOAuthRefreshClient;
 /** POST /v1/credential/:id/disable request body. */
 export interface CredentialDisableRequest {
     cause: string;

package/dist/types/auth-broker/wire-schemas.d.ts

@@ -11,6 +11,10 @@
  * `hasOnlyFields` allowlist for the same effect.
  */
 import * as z from "zod/v4";
+export declare const mcpOAuthBindingSchema: z.ZodObject<{
+    resourceOrigin: z.ZodString;
+    tokenEndpoint: z.ZodString;
+}, z.core.$strict>;
 /** Real OAuth credential (broker-side) — refresh token is the actual upstream value. */
 export declare const oauthCredentialSchema: z.ZodObject<{
     type: z.ZodLiteral<"oauth">;
@@ -21,6 +25,10 @@ export declare const oauthCredentialSchema: z.ZodObject<{
     projectId: z.ZodOptional<z.ZodString>;
     email: z.ZodOptional<z.ZodString>;
     accountId: z.ZodOptional<z.ZodString>;
+    mcpBinding: z.ZodOptional<z.ZodObject<{
+        resourceOrigin: z.ZodString;
+        tokenEndpoint: z.ZodString;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 /** OAuth credential as it appears in broker snapshots — refresh replaced with sentinel. */
 export declare const remoteOauthCredentialSchema: z.ZodObject<{
@@ -31,6 +39,10 @@ export declare const remoteOauthCredentialSchema: z.ZodObject<{
     projectId: z.ZodOptional<z.ZodString>;
     email: z.ZodOptional<z.ZodString>;
     accountId: z.ZodOptional<z.ZodString>;
+    mcpBinding: z.ZodOptional<z.ZodObject<{
+        resourceOrigin: z.ZodString;
+        tokenEndpoint: z.ZodString;
+    }, z.core.$strict>>;
     refresh: z.ZodLiteral<"__remote__">;
 }, z.core.$strict>;
 export declare const apiKeyCredentialSchema: z.ZodObject<{
@@ -47,6 +59,10 @@ export declare const writableAuthCredentialSchema: z.ZodDiscriminatedUnion<[z.Zo
     projectId: z.ZodOptional<z.ZodString>;
     email: z.ZodOptional<z.ZodString>;
     accountId: z.ZodOptional<z.ZodString>;
+    mcpBinding: z.ZodOptional<z.ZodObject<{
+        resourceOrigin: z.ZodString;
+        tokenEndpoint: z.ZodString;
+    }, z.core.$strict>>;
 }, z.core.$strict>, z.ZodObject<{
     type: z.ZodLiteral<"api_key">;
     key: z.ZodString;
@@ -60,6 +76,10 @@ export declare const snapshotCredentialSchema: z.ZodDiscriminatedUnion<[z.ZodObj
     projectId: z.ZodOptional<z.ZodString>;
     email: z.ZodOptional<z.ZodString>;
     accountId: z.ZodOptional<z.ZodString>;
+    mcpBinding: z.ZodOptional<z.ZodObject<{
+        resourceOrigin: z.ZodString;
+        tokenEndpoint: z.ZodString;
+    }, z.core.$strict>>;
     refresh: z.ZodLiteral<"__remote__">;
 }, z.core.$strict>, z.ZodObject<{
     type: z.ZodLiteral<"api_key">;
@@ -76,6 +96,10 @@ export declare const credentialSnapshotEntrySchema: z.ZodObject<{
         projectId: z.ZodOptional<z.ZodString>;
         email: z.ZodOptional<z.ZodString>;
         accountId: z.ZodOptional<z.ZodString>;
+        mcpBinding: z.ZodOptional<z.ZodObject<{
+            resourceOrigin: z.ZodString;
+            tokenEndpoint: z.ZodString;
+        }, z.core.$strict>>;
         refresh: z.ZodLiteral<"__remote__">;
     }, z.core.$strict>, z.ZodObject<{
         type: z.ZodLiteral<"api_key">;
@@ -94,6 +118,10 @@ export declare const snapshotEntrySchema: z.ZodObject<{
         projectId: z.ZodOptional<z.ZodString>;
         email: z.ZodOptional<z.ZodString>;
         accountId: z.ZodOptional<z.ZodString>;
+        mcpBinding: z.ZodOptional<z.ZodObject<{
+            resourceOrigin: z.ZodString;
+            tokenEndpoint: z.ZodString;
+        }, z.core.$strict>>;
         refresh: z.ZodLiteral<"__remote__">;
     }, z.core.$strict>, z.ZodObject<{
         type: z.ZodLiteral<"api_key">;
@@ -129,6 +157,10 @@ export declare const snapshotResponseSchema: z.ZodObject<{
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;
@@ -160,6 +192,10 @@ export declare const snapshotStreamSnapshotEventSchema: z.ZodObject<{
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;
@@ -192,6 +228,10 @@ export declare const snapshotStreamEntryEventSchema: z.ZodObject<{
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;
@@ -236,6 +276,10 @@ export declare const snapshotStreamEventSchema: z.ZodDiscriminatedUnion<[z.ZodOb
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;
@@ -266,6 +310,10 @@ export declare const snapshotStreamEventSchema: z.ZodDiscriminatedUnion<[z.ZodOb
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;
@@ -348,6 +396,10 @@ export declare const usageResponseSchema: z.ZodObject<{
         raw: z.ZodOptional<z.ZodUnknown>;
     }, z.core.$strip>>;
 }, z.core.$strict>;
+export declare const credentialRefreshRequestSchema: z.ZodObject<{
+    clientId: z.ZodOptional<z.ZodString>;
+    clientSecret: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
 export declare const credentialRefreshResponseSchema: z.ZodObject<{
     entry: z.ZodObject<{
         id: z.ZodNumber;
@@ -360,6 +412,10 @@ export declare const credentialRefreshResponseSchema: z.ZodObject<{
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;
@@ -385,6 +441,10 @@ export declare const credentialUploadRequestSchema: z.ZodObject<{
         projectId: z.ZodOptional<z.ZodString>;
         email: z.ZodOptional<z.ZodString>;
         accountId: z.ZodOptional<z.ZodString>;
+        mcpBinding: z.ZodOptional<z.ZodObject<{
+            resourceOrigin: z.ZodString;
+            tokenEndpoint: z.ZodString;
+        }, z.core.$strict>>;
     }, z.core.$strict>, z.ZodObject<{
         type: z.ZodLiteral<"api_key">;
         key: z.ZodString;
@@ -402,6 +462,10 @@ export declare const credentialUploadResponseSchema: z.ZodObject<{
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;
@@ -433,6 +497,10 @@ export declare const credentialIfAbsentUploadResponseSchema: z.ZodObject<{
             projectId: z.ZodOptional<z.ZodString>;
             email: z.ZodOptional<z.ZodString>;
             accountId: z.ZodOptional<z.ZodString>;
+            mcpBinding: z.ZodOptional<z.ZodObject<{
+                resourceOrigin: z.ZodString;
+                tokenEndpoint: z.ZodString;
+            }, z.core.$strict>>;
             refresh: z.ZodLiteral<"__remote__">;
         }, z.core.$strict>, z.ZodObject<{
             type: z.ZodLiteral<"api_key">;

package/dist/types/auth-storage.d.ts

@@ -15,10 +15,26 @@ export type ApiKeyCredential = {
     type: "api_key";
     key: string;
 };
+export interface MCPOAuthBinding {
+    /** Exact HTTP(S) origin of the MCP resource endpoint. */
+    resourceOrigin: string;
+    /** Exact canonical HTTP(S) token endpoint used to create and refresh the credential. */
+    tokenEndpoint: string;
+}
+export declare function resolveMCPOAuthResourceOrigin(value: string): string | undefined;
+export declare function resolveMCPOAuthTokenEndpoint(value: string): string | undefined;
+export declare function isCanonicalMCPOAuthBinding(binding: MCPOAuthBinding): boolean;
+export declare function assertCanonicalMCPOAuthBinding(binding: MCPOAuthBinding | undefined): asserts binding is MCPOAuthBinding;
 export type OAuthCredential = {
     type: "oauth";
+    /** Present only for credentials created by runtime MCP OAuth. */
+    mcpBinding?: MCPOAuthBinding;
 } & OAuthCredentials;
 export type AuthCredential = ApiKeyCredential | OAuthCredential;
+export interface MCPOAuthRefreshClient {
+    clientId?: string;
+    clientSecret?: string;
+}
 export type AuthCredentialEntry = AuthCredential | AuthCredential[];
 export type AuthStorageData = Record<string, AuthCredentialEntry>;
 /**
@@ -161,6 +177,8 @@ export interface AuthCredentialStore {
      * for `timeoutMs * (maxRetries + 1)`.
      */
     refreshOAuthCredential?(provider: Provider, credentialId: number, credential: OAuthCredential, signal?: AbortSignal): Promise<OAuthCredentials>;
+    /** Broker-backed MCP refresh using the broker's stored token endpoint and refresh secret. */
+    refreshMCPOAuthCredential?(credentialId: number, credential: OAuthCredential, client: MCPOAuthRefreshClient, signal?: AbortSignal): Promise<OAuthCredential>;
     /**
      * Optional async pre-read hook invoked after AuthStorage selects a stored
      * credential but before it returns that credential for an outbound request.
@@ -597,7 +615,7 @@ export declare class AuthStorage {
      * refresh attempt, which is required for providers that rotate refresh tokens
      * on every successful refresh.
      */
-    refreshCredentialById(id: number, signal?: AbortSignal): Promise<AuthCredentialSnapshotEntry>;
+    refreshCredentialById(id: number, signal?: AbortSignal, mcpClient?: MCPOAuthRefreshClient): Promise<AuthCredentialSnapshotEntry>;
     /**
      * Force-refresh the OAuth credential with the given id, bypassing the
      * not-yet-expired guard. Used by the auth-broker server to honour
@@ -607,6 +625,8 @@ export declare class AuthStorage {
      * Throws when no OAuth credential with that id is loaded.
      */
     forceRefreshCredentialById(id: number, signal?: AbortSignal): Promise<AuthCredentialSnapshotEntry>;
+    /** Force-refresh the first OAuth credential stored for a provider. */
+    forceRefreshOAuthCredential(provider: string, expected: OAuthCredential, client?: MCPOAuthRefreshClient, signal?: AbortSignal): Promise<OAuthCredential>;
     /**
      * Disable the credential with the given id and emit a
      * {@link CredentialDisabledEvent}. Used by the auth-broker server to honour

package/dist/types/provider-models/openai-compat.d.ts

@@ -27,6 +27,8 @@ export interface OpenAIModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;
 }
+/** Test seam: the model-manager base URL as resolved from trusted env. */
+export declare function resolveOpenAIModelManagerBaseUrlForTest(config?: OpenAIModelManagerConfig): string;
 export declare function openaiModelManagerOptions(config?: OpenAIModelManagerConfig): ModelManagerOptions<"openai-responses">;
 export interface GroqModelManagerConfig {
     apiKey?: string;
@@ -111,16 +113,31 @@ export interface ZenMuxModelManagerConfig {
     baseUrl?: string;
 }
 export declare function zenmuxModelManagerOptions(config?: ZenMuxModelManagerConfig): ModelManagerOptions<Api>;
+export interface OpenGatewayModelManagerConfig {
+    apiKey?: string;
+    baseUrl?: string;
+}
+/**
+ * OpenGateway by Sionic AI — an OpenAI-compatible gateway that fronts OpenAI,
+ * Anthropic, and Google models behind one API key. Models are discovered from
+ * the OpenAI-compatible `/v1/models` endpoint.
+ */
+export declare function opengatewayModelManagerOptions(config?: OpenGatewayModelManagerConfig): ModelManagerOptions<"openai-completions">;
+export interface BizRouterModelManagerConfig {
+    apiKey?: string;
+    baseUrl?: string;
+}
+export declare function bizrouterModelManagerOptions(config?: BizRouterModelManagerConfig): ModelManagerOptions<"openai-completions">;
 export interface KiloModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;
 }
 export declare function kiloModelManagerOptions(config?: KiloModelManagerConfig): ModelManagerOptions<"openai-completions">;
-export interface AlibabaCodingPlanModelManagerConfig {
+export interface AlibabaTokenPlanModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;
 }
-export declare function alibabaCodingPlanModelManagerOptions(config?: AlibabaCodingPlanModelManagerConfig): ModelManagerOptions<"openai-completions">;
+export declare function alibabaTokenPlanModelManagerOptions(config?: AlibabaTokenPlanModelManagerConfig): ModelManagerOptions<"openai-completions">;
 export interface VercelAiGatewayModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;

package/dist/types/providers/anthropic.d.ts

@@ -42,7 +42,16 @@ type AnthropicCacheControl = {
 export declare function clearAnthropicFastModeFallback(providerSessionState: Map<string, ProviderSessionState> | undefined): void;
 export declare function isAnthropicFastModeUnsupportedError(error: unknown): boolean;
 export declare function isAnthropicThinkingBlockMutationError(error: unknown): boolean;
-export declare const claudeCodeVersion = "2.1.63";
+/**
+ * 400 shape where a replayed `thinking`/`redacted_thinking` block fails signature
+ * validation, e.g. `messages.5.content.24: Invalid \`signature\` in \`thinking\` block`.
+ * Unlike the latest-assistant mutation error above, the cited block can sit anywhere
+ * in the replayed history, so recovery must repair every assistant message rather
+ * than only the latest one.
+ */
+export declare function isAnthropicThinkingSignatureInvalidError(error: unknown): boolean;
+export declare const claudeCodeVersion = "2.1.219";
+export declare const claudeCodeEntrypoint = "sdk-cli";
 export declare const claudeToolPrefix: string;
 export declare const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
 export declare function mapStainlessOs(platform: string): "MacOS" | "Windows" | "Linux" | "FreeBSD" | `Other::${string}`;
@@ -184,6 +193,7 @@ export declare function buildAnthropicClientOptions(args: AnthropicClientOptions
 export declare function normalizeCacheControlTtlOrdering(params: MessageCreateParamsStreaming): void;
 export declare function convertAnthropicMessages(messages: Message[], model: Model<"anthropic-messages">, isOAuthToken: boolean, options?: {
     repairLatestAssistantThinking?: boolean;
+    repairAllAssistantThinking?: boolean;
 }): MessageParam[];
 /**
  * Normalize a JSON Schema node for Anthropic tool `input_schema`.

package/dist/types/providers/azure-openai-responses.d.ts

@@ -1,4 +1,4 @@
-import type { ServiceTier, StreamFunction, StreamOptions, ToolChoice } from "../types";
+import type { Model, ServiceTier, StreamFunction, StreamOptions, ToolChoice } from "../types";
 export interface AzureOpenAIResponsesOptions extends StreamOptions {
     reasoning?: "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
     reasoningSummary?: "auto" | "detailed" | "concise" | null;
@@ -13,3 +13,8 @@ export interface AzureOpenAIResponsesOptions extends StreamOptions {
  * Generate function for Azure OpenAI Responses API
  */
 export declare const streamAzureOpenAIResponses: StreamFunction<"azure-openai-responses">;
+/** Test seam: the Azure endpoint config as resolved from trusted env. */
+export declare function resolveAzureConfigForTest(model: Model<"azure-openai-responses">, options?: AzureOpenAIResponsesOptions): {
+    baseUrl: string;
+    apiVersion: string;
+};

package/dist/types/providers/google-auth.d.ts

@@ -12,6 +12,8 @@
  * (default 60s). Concurrent callers waiting on a refresh share the same in-flight promise.
  */
 import type { FetchImpl } from "../types";
+/** Test seam: the ADC credentials file path as resolved from trusted env. */
+export declare function resolveAdcCredentialsPathForTest(): string | undefined;
 /**
  * Returns a Bearer access token suitable for the `Authorization` header on Vertex AI calls.
  * The token is cached in module scope and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` ms before it expires.

package/dist/types/providers/google-gemini-headers.d.ts

@@ -5,7 +5,7 @@
  */
 export declare const GEMINI_CLI_VERSION_ENV = "SKC_AI_GEMINI_CLI_VERSION";
 export declare const LEGACY_GEMINI_CLI_VERSION_ENV = "PI_AI_GEMINI_CLI_VERSION";
-export declare const DEFAULT_GEMINI_CLI_VERSION = "0.50.0";
+export declare const DEFAULT_GEMINI_CLI_VERSION = "0.52.0";
 export declare function getGeminiCliUserAgent(modelId?: string): string;
 export declare const getGeminiCliHeaders: (modelId?: string) => {
     "User-Agent": string;

package/dist/types/providers/google-vertex.d.ts

@@ -5,3 +5,5 @@ export interface GoogleVertexOptions extends GoogleSharedStreamOptions {
     location?: string;
 }
 export declare const streamGoogleVertex: StreamFunction<"google-vertex">;
+/** Test seam: the Vertex API key as resolved from options plus trusted env. */
+export declare function resolveVertexApiKeyForTest(options?: GoogleVertexOptions): string | undefined;

package/dist/types/providers/openai-codex-responses.d.ts

@@ -10,6 +10,10 @@ export interface OpenAICodexResponsesOptions extends StreamOptions {
     preferWebsockets?: boolean;
     serviceTier?: ServiceTier;
 }
+/** Maps a canonical tool name to the name Codex accepts on the wire. */
+export declare function codexToolWireName(name: string): string;
+/** Maps a Codex wire tool name back to the canonical harness tool name. */
+export declare function codexToolCanonicalName(wireName: string): string;
 type CodexTransport = "sse" | "websocket";
 export interface OpenAICodexWebSocketDebugStats {
     fullContextRequests: number;

package/dist/types/providers/openai-completions.d.ts

@@ -1,6 +1,8 @@
 import type { ChatCompletionMessageParam } from "openai/resources/chat/completions";
 import { type AssistantMessage, type Context, type Model, type ServiceTier, type StreamFunction, type StreamOptions, type ToolChoice } from "../types";
 import { type ResolvedOpenAICompat } from "./openai-completions-compat";
+/** Test seam: the provider base URL as resolved from trusted env. */
+export declare function resolveOpenAICompletionsBaseUrlForTest(baseUrl: string | undefined, authCredentialType: "api_key" | "oauth" | undefined): string;
 /**
  * Identify "real progress" stream chunks vs. keepalives, role-only preambles,
  * and empty `{choices:[]}` no-ops emitted by some OpenAI-compatible endpoints.

package/dist/types/providers/openai-responses.d.ts

@@ -13,6 +13,8 @@ export interface OpenAIResponsesOptions extends StreamOptions {
      */
     strictResponsesPairing?: boolean;
 }
+/** Test seam: the provider base URL as resolved from trusted env. */
+export declare function resolveOpenAIProviderBaseUrlForTest(baseUrl: string | undefined, authCredentialType: "api_key" | "oauth" | undefined): string;
 /**
  * Generate function for OpenAI Responses API
  */

package/dist/types/providers/register-builtins.d.ts

@@ -17,6 +17,14 @@ interface BedrockProviderModule {
     streamBedrock: (model: Model<"bedrock-converse-stream">, context: Context, options: BedrockOptions) => AssistantMessageEventStream;
 }
 export declare function setBedrockProviderModule(module: BedrockProviderModule): void;
+/**
+ * Resolves the first-event timeout fallback for the outer lazy-stream watchdog.
+ * A configured wrapper-specific fallback (from `LazyStreamLimits`) always wins;
+ * otherwise providers known to have slow first events get a five-minute floor
+ * matching their inner provider-level override. Returns `undefined` for
+ * providers that should use the shared default.
+ */
+export declare function resolveLazyStreamFirstEventFallbackMs(provider: string, configuredFallbackMs?: number): number | undefined;
 export declare const streamAnthropic: (model: Model<"anthropic-messages">, context: Context, options: OptionsForApi<"anthropic-messages">) => EventStreamImpl;
 export declare const streamAzureOpenAIResponses: (model: Model<"azure-openai-responses">, context: Context, options: OptionsForApi<"azure-openai-responses">) => EventStreamImpl;
 export declare const streamGoogle: (model: Model<"google-generative-ai">, context: Context, options: OptionsForApi<"google-generative-ai">) => EventStreamImpl;

package/dist/types/providers/transform-messages.d.ts

@@ -11,4 +11,5 @@ import type { Api, AssistantMessage, Message, Model } from "../types";
  */
 export declare function transformMessages<TApi extends Api>(messages: Message[], model: Model<TApi>, normalizeToolCallId?: (id: string, model: Model<TApi>, source: AssistantMessage) => string, options?: {
     repairLatestAssistantThinking?: boolean;
+    repairAllAssistantThinking?: boolean;
 }): Message[];

package/dist/types/types.d.ts

@@ -51,7 +51,7 @@ export interface ThinkingConfig {
     /** Provider-specific transport used to encode the selected effort. */
     mode: ThinkingControlMode;
 }
-export type KnownProvider = "alibaba-coding-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio";
+export type KnownProvider = "alibaba-token-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "opengateway" | "bizrouter" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio";
 export type Provider = KnownProvider | string;
 import type { Effort } from "./model-thinking";
 /** Token budgets for each thinking level (token-based providers only) */
@@ -519,6 +519,7 @@ export type TSchema = ZodType | TJsonSchema;
 export type Static<S> = S extends ZodType ? z.infer<S> : S extends {
     static: infer T;
 } ? T : unknown;
+export type RawArgumentRejectionCode = "ask-intent-review-requires-positive-round" | "ask-intent-contract-requires-non-empty-authority" | "ask-deep-interview-metadata-requires-deep-interview-gate";
 export type RawArgumentValidationResult = {
     outcome: "passthrough";
 } | {
@@ -526,6 +527,7 @@ export type RawArgumentValidationResult = {
     arguments: ToolCall["arguments"];
 } | {
     outcome: "reject";
+    code?: RawArgumentRejectionCode;
 };
 export interface Tool<TParameters extends TSchema = TSchema> {
     name: string;

package/dist/types/usage/grok-cli.d.ts

@@ -1,10 +1,12 @@
-import type { CredentialRankingStrategy, UsageProvider } from "../usage";
+import type { CredentialRankingStrategy, UsageFetchParams, UsageProvider } from "../usage";
 interface BillingUsage {
     monthlyLimit: number;
     used: number;
     billingPeriodEnd: string;
 }
 export declare function parseGrokCliBillingUsage(payload: unknown): BillingUsage;
+/** Test seam: the usage access token as resolved from a credential plus trusted env. */
+export declare function resolveGrokAccessTokenForTest(params: UsageFetchParams): string | undefined;
 export declare const grokCliUsageProvider: UsageProvider;
 export declare const grokCliRankingStrategy: CredentialRankingStrategy;
 export {};

package/dist/types/usage/kimi.d.ts

@@ -1,2 +1,4 @@
 import type { UsageProvider } from "../usage";
+/** Test seam: the usage base URL as resolved from a caller value plus trusted env. */
+export declare function normalizeKimiUsageBaseUrlForTest(baseUrl?: string): string;
 export declare const kimiUsageProvider: UsageProvider;

package/dist/types/utils/anthropic-auth.d.ts

@@ -4,6 +4,14 @@ export interface AnthropicAuthConfig {
     baseUrl: string;
     isOAuth: boolean;
 }
+/**
+ * Resolve the Anthropic base URL from the environment.
+ *
+ * Trusted sources only: the result becomes the request URL that carries the
+ * Anthropic API key / OAuth token, so whatever can set it can redirect
+ * authenticated traffic. `$env` merges the caller's `cwd/.env`, so reading it
+ * there would let repository content choose where credentials are sent.
+ */
 export declare function resolveAnthropicBaseUrlFromEnv(): string | undefined;
 /**
  * Checks if a token is an OAuth token by looking for sk-ant-oat prefix.

package/dist/types/utils/foundry.d.ts

@@ -1 +1,11 @@
+/**
+ * Whether Anthropic requests run in Foundry gateway mode.
+ *
+ * Resolved from trusted environment sources only. Enabling Foundry switches the
+ * request base URL and injects TLS client material, so whatever can set this
+ * redirects authenticated traffic. `$env` merges the caller's `cwd/.env`, so
+ * reading it there would let repository content flip the mode; resolve it the
+ * same way the credentials themselves are (launching shell plus SKC/user-owned
+ * `.env` files, never the project `.env`).
+ */
 export declare function isFoundryEnabled(): boolean;

package/dist/types/utils/http-inspector.d.ts

@@ -18,6 +18,19 @@ export declare function isModelUnavailableError(message: string, error: unknown)
 /** Actionable guidance for selecting an available model/provider. */
 export declare function formatModelUnavailableGuidance(dump: RawHttpRequestDump | undefined): string;
 export declare function appendRawHttpRequestDumpFor400(message: string, error: unknown, dump: RawHttpRequestDump | undefined): Promise<string>;
+/**
+ * Name the failed connection when the request never produced an HTTP status.
+ *
+ * Bun raises DNS and socket failures as a bare `Error` whose message is a
+ * standalone hint ("Was there a typo in the url or port?", "Unable to connect.
+ * Is the computer able to access the url?") while the actionable facts live on
+ * `code` and `path`. Those properties are dropped when only `message` reaches
+ * the assistant message, so a provider outage, a local DNS failure, and a
+ * mistyped custom base URL all render as the same context-free sentence.
+ * Appending the code and the target URL tells the user which host failed and
+ * whether the fault is theirs.
+ */
+export declare function appendTransportFailureContext(message: string, error: unknown, rawRequestDump: RawHttpRequestDump | undefined): string;
 export declare function finalizeErrorMessage(error: unknown, rawRequestDump: RawHttpRequestDump | undefined, capturedErrorResponse?: CapturedHttpErrorResponse): Promise<string>;
 export declare function withHttpStatus(error: unknown, status: number): Error;
 /**

package/dist/types/utils/idle-iterator.d.ts

@@ -1,7 +1,8 @@
+export declare function getProviderFirstEventTimeoutFallbackMs(provider: string): number | undefined;
 /**
  * Returns the idle timeout used for provider streaming transports.
  *
- * `PI_OPENAI_STREAM_IDLE_TIMEOUT_MS` is accepted as a backward-compatible alias.
+ * `SKC_OPENAI_STREAM_IDLE_TIMEOUT_MS` is honored first; `PI_OPENAI_STREAM_IDLE_TIMEOUT_MS` is a backward-compatible alias.
  * Set `PI_STREAM_IDLE_TIMEOUT_MS=0` to disable the watchdog.
  *
  * Providers that legitimately stream much slower than the global default can pass
@@ -12,7 +13,7 @@ export declare function getStreamIdleTimeoutMs(fallbackMs?: number): number | un
 /**
  * Returns the idle timeout used for OpenAI-family streaming transports.
  *
- * Set `PI_OPENAI_STREAM_IDLE_TIMEOUT_MS=0` to disable the watchdog.
+ * Honors `SKC_OPENAI_STREAM_IDLE_TIMEOUT_MS` first (`PI_OPENAI_STREAM_IDLE_TIMEOUT_MS` is the legacy alias). Set `=0` to disable.
  */
 export declare function getOpenAIStreamIdleTimeoutMs(): number | undefined;
 /**

package/dist/types/utils/oauth/alibaba-token-plan.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Alibaba Token Plan login flow.
+ *
+ * Alibaba Token Plan provides OpenAI-compatible models via
+ * https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1.
+ *
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open browser to Alibaba Cloud Model Studio console
+ * 2. User copies their API key
+ * 3. User pastes the API key into the CLI
+ */
+import type { OAuthController } from "./types";
+/**
+ * Login to Alibaba Token Plan.
+ *
+ * Opens browser to API keys page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginAlibabaTokenPlan(options: OAuthController): Promise<string>;

package/dist/types/utils/oauth/bizrouter.d.ts

@@ -0,0 +1 @@
+export declare const loginBizRouter: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/utils/oauth/opengateway.d.ts

@@ -0,0 +1 @@
+export declare const loginOpenGateway: (options: import("./types").OAuthController) => Promise<string>;