@sayknow-cli/ai 0.4.6 → 0.5.0

package/src/utils/http-inspector.ts

@@ -26,6 +26,34 @@ type ErrorWithStatus = {
 
 const SENSITIVE_HEADERS = ["authorization", "x-api-key", "api-key", "cookie", "set-cookie", "proxy-authorization"];
 
+/**
+ * Connection-level failure codes, meaning the request never reached the
+ * provider and no HTTP status exists. Bun reports the first group for `fetch`;
+ * the `E*`/`UND_ERR_*` group comes from Node-style DNS and socket errors.
+ *
+ * Deliberately excludes aborts and TLS/certificate codes: an abort is a
+ * user/watchdog outcome with its own display path, and its message must keep
+ * matching the abort normalizers in `modes/utils/abort-message`.
+ */
+const TRANSPORT_FAILURE_CODES: ReadonlySet<string> = new Set([
+	"ConnectionClosed",
+	"ConnectionRefused",
+	"ConnectionReset",
+	"ConnectionTimeout",
+	"FailedToOpenSocket",
+	"HTTP2Unsupported",
+	"EAI_AGAIN",
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"EHOSTUNREACH",
+	"ENETUNREACH",
+	"ENOTFOUND",
+	"EPIPE",
+	"ETIMEDOUT",
+	"UND_ERR_CONNECT_TIMEOUT",
+	"UND_ERR_SOCKET",
+]);
+
 /**
  * Privacy note appended next to a saved raw HTTP request dump. The dump is
  * sanitized (secrets/thinking redacted) but can still contain prompt content
@@ -88,6 +116,54 @@ export async function appendRawHttpRequestDumpFor400(
 	}
 }
 
+/** Origin and path of `value`, dropping query, fragment, and credentials so a
+ *  key carried in the request URL (Google `?key=`, signed URLs) never lands in
+ *  a user-visible error string. */
+function redactRequestUrl(value: unknown): string | undefined {
+	if (typeof value !== "string" || value.trim().length === 0) return undefined;
+	try {
+		const url = new URL(value);
+		return `${url.origin}${url.pathname}`;
+	} catch {
+		return undefined;
+	}
+}
+
+function findTransportFailure(error: unknown, depth: number): { code: string; url?: string } | undefined {
+	if (!error || typeof error !== "object" || depth > 2) return undefined;
+	const info = error as { code?: unknown; path?: unknown; url?: unknown; cause?: unknown };
+	if (typeof info.code === "string" && TRANSPORT_FAILURE_CODES.has(info.code)) {
+		return { code: info.code, url: redactRequestUrl(info.path) ?? redactRequestUrl(info.url) };
+	}
+	return findTransportFailure(info.cause, depth + 1);
+}
+
+/**
+ * Name the failed connection when the request never produced an HTTP status.
+ *
+ * Bun raises DNS and socket failures as a bare `Error` whose message is a
+ * standalone hint ("Was there a typo in the url or port?", "Unable to connect.
+ * Is the computer able to access the url?") while the actionable facts live on
+ * `code` and `path`. Those properties are dropped when only `message` reaches
+ * the assistant message, so a provider outage, a local DNS failure, and a
+ * mistyped custom base URL all render as the same context-free sentence.
+ * Appending the code and the target URL tells the user which host failed and
+ * whether the fault is theirs.
+ */
+export function appendTransportFailureContext(
+	message: string,
+	error: unknown,
+	rawRequestDump: RawHttpRequestDump | undefined,
+): string {
+	if (extractHttpStatusFromError(error) !== undefined) return message;
+	const failure = findTransportFailure(error, 0);
+	if (!failure) return message;
+
+	const url = failure.url ?? redactRequestUrl(rawRequestDump?.url);
+	const context = url ? `transport=${failure.code} url=${url}` : `transport=${failure.code}`;
+	return message.includes(context) ? message : `${message} (${context})`;
+}
+
 export async function finalizeErrorMessage(
 	error: unknown,
 	rawRequestDump: RawHttpRequestDump | undefined,
@@ -105,6 +181,7 @@ export async function finalizeErrorMessage(
 	if (isModelUnavailableError(message, error)) {
 		message = `${message}\n\n${formatModelUnavailableGuidance(rawRequestDump)}`;
 	}
+	message = appendTransportFailureContext(message, error, rawRequestDump);
 	return appendRawHttpRequestDumpFor400(message, error, rawRequestDump);
 }
 

package/src/utils/idle-iterator.ts

@@ -2,6 +2,11 @@ import { $env } from "@sayknow-cli/utils";
 
 const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 120_000;
 const DEFAULT_STREAM_FIRST_EVENT_TIMEOUT_MS = 100_000;
+const KIMI_CODE_FIRST_EVENT_TIMEOUT_MS = 300_000;
+
+export function getProviderFirstEventTimeoutFallbackMs(provider: string): number | undefined {
+	return provider === "kimi-code" ? KIMI_CODE_FIRST_EVENT_TIMEOUT_MS : undefined;
+}
 
 function normalizeIdleTimeoutMs(value: string | undefined, fallback: number): number | undefined {
 	if (value === undefined) return fallback;
@@ -14,7 +19,7 @@ function normalizeIdleTimeoutMs(value: string | undefined, fallback: number): nu
 /**
  * Returns the idle timeout used for provider streaming transports.
  *
- * `PI_OPENAI_STREAM_IDLE_TIMEOUT_MS` is accepted as a backward-compatible alias.
+ * `SKC_OPENAI_STREAM_IDLE_TIMEOUT_MS` is honored first; `PI_OPENAI_STREAM_IDLE_TIMEOUT_MS` is a backward-compatible alias.
  * Set `PI_STREAM_IDLE_TIMEOUT_MS=0` to disable the watchdog.
  *
  * Providers that legitimately stream much slower than the global default can pass
@@ -22,17 +27,20 @@ function normalizeIdleTimeoutMs(value: string | undefined, fallback: number): nu
  * Caller options still take precedence; env overrides still trump the fallback.
  */
 export function getStreamIdleTimeoutMs(fallbackMs: number = DEFAULT_STREAM_IDLE_TIMEOUT_MS): number | undefined {
-	return normalizeIdleTimeoutMs($env.PI_STREAM_IDLE_TIMEOUT_MS ?? $env.PI_OPENAI_STREAM_IDLE_TIMEOUT_MS, fallbackMs);
+	return normalizeIdleTimeoutMs(
+		$env.SKC_OPENAI_STREAM_IDLE_TIMEOUT_MS ?? $env.PI_STREAM_IDLE_TIMEOUT_MS ?? $env.PI_OPENAI_STREAM_IDLE_TIMEOUT_MS,
+		fallbackMs,
+	);
 }
 
 /**
  * Returns the idle timeout used for OpenAI-family streaming transports.
  *
- * Set `PI_OPENAI_STREAM_IDLE_TIMEOUT_MS=0` to disable the watchdog.
+ * Honors `SKC_OPENAI_STREAM_IDLE_TIMEOUT_MS` first (`PI_OPENAI_STREAM_IDLE_TIMEOUT_MS` is the legacy alias). Set `=0` to disable.
  */
 export function getOpenAIStreamIdleTimeoutMs(): number | undefined {
 	return normalizeIdleTimeoutMs(
-		$env.PI_OPENAI_STREAM_IDLE_TIMEOUT_MS ?? $env.PI_STREAM_IDLE_TIMEOUT_MS,
+		$env.SKC_OPENAI_STREAM_IDLE_TIMEOUT_MS ?? $env.PI_OPENAI_STREAM_IDLE_TIMEOUT_MS ?? $env.PI_STREAM_IDLE_TIMEOUT_MS,
 		DEFAULT_STREAM_IDLE_TIMEOUT_MS,
 	);
 }
@@ -168,8 +176,6 @@ export async function* iterateWithIdleTimeout<T>(
 			}
 		}
 
-		const nextResultPromise = withRacy(iterator.next());
-
 		const racers: Array<
 			Promise<
 				| { kind: "next"; result: IteratorResult<T> }
@@ -177,7 +183,7 @@ export async function* iterateWithIdleTimeout<T>(
 				| { kind: "timeout" }
 				| { kind: "abort" }
 			>
-		> = [nextResultPromise];
+		> = [];
 
 		let timer: NodeJS.Timeout | undefined;
 		let resolveTimeout: ((value: { kind: "timeout" }) => void) | undefined;
@@ -202,6 +208,13 @@ export async function* iterateWithIdleTimeout<T>(
 			racers.push(promise);
 		}
 
+		// Arm timeout/abort races before asking the source for its next item. A
+		// periodic keepalive iterator commonly registers its own timer inside
+		// `next()`; registering that first lets equal-deadline keepalives win every
+		// race and extend the idle window forever. Already-buffered items still
+		// settle as microtasks before a 0ms watchdog.
+		racers.unshift(withRacy(iterator.next()));
+
 		try {
 			const outcome = await Promise.race(racers);
 			if (outcome.kind === "abort") {

package/src/utils/oauth/{alibaba-coding-plan.ts → alibaba-token-plan.ts}

@@ -1,10 +1,11 @@
 /**
- * Alibaba Coding Plan login flow.
+ * Alibaba Token Plan login flow.
  *
- * Alibaba Coding Plan provides OpenAI-compatible models via https://coding-intl.dashscope.aliyuncs.com/v1.
+ * Alibaba Token Plan provides OpenAI-compatible models via
+ * https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1.
  *
  * This is not OAuth - it's a simple API key flow:
- * 1. Open browser to Alibaba Cloud DashScope API key settings
+ * 1. Open browser to Alibaba Cloud Model Studio console
  * 2. User copies their API key
  * 3. User pastes the API key into the CLI
  */
@@ -13,27 +14,27 @@ import { validateOpenAICompatibleApiKey } from "./api-key-validation";
 import type { OAuthController } from "./types";
 
 const AUTH_URL = "https://modelstudio.console.alibabacloud.com/";
-const API_BASE_URL = "https://coding-intl.dashscope.aliyuncs.com/v1";
-const VALIDATION_MODEL = "qwen3.5-plus";
+const API_BASE_URL = "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1";
+const VALIDATION_MODEL = "deepseek-v4-pro";
 
 /**
- * Login to Alibaba Coding Plan.
+ * Login to Alibaba Token Plan.
  *
  * Opens browser to API keys page, prompts user to paste their API key.
  * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
  */
-export async function loginAlibabaCodingPlan(options: OAuthController): Promise<string> {
+export async function loginAlibabaTokenPlan(options: OAuthController): Promise<string> {
 	if (!options.onPrompt) {
-		throw new Error("Alibaba Coding Plan login requires onPrompt callback");
+		throw new Error("Alibaba Token Plan login requires onPrompt callback");
 	}
 
 	options.onAuth?.({
 		url: AUTH_URL,
-		instructions: "Copy your API key from the Alibaba Cloud DashScope console",
+		instructions: "Copy your API key from the Alibaba Cloud Model Studio console",
 	});
 
 	const apiKey = await options.onPrompt({
-		message: "Paste your Alibaba Coding Plan API key",
+		message: "Paste your Alibaba Token Plan API key",
 		placeholder: "sk-...",
 	});
 
@@ -48,7 +49,7 @@ export async function loginAlibabaCodingPlan(options: OAuthController): Promise<
 
 	options.onProgress?.("Validating API key...");
 	await validateOpenAICompatibleApiKey({
-		provider: "Alibaba Coding Plan",
+		provider: "Alibaba Token Plan",
 		apiKey: trimmed,
 		baseUrl: API_BASE_URL,
 		model: VALIDATION_MODEL,

package/src/utils/oauth/bizrouter.ts

@@ -0,0 +1,15 @@
+/** BizRouter login flow (API key paste, validated via /v1/models). */
+import { createApiKeyLogin } from "./api-key-login";
+
+export const loginBizRouter = createApiKeyLogin({
+	providerLabel: "BizRouter",
+	authUrl: "https://bizrouter.ai/settings/keys",
+	instructions: "Create or copy your BizRouter API key",
+	promptMessage: "Paste your BizRouter API key",
+	placeholder: "sk-br-v1-...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "BizRouter",
+		modelsUrl: "https://api.bizrouter.ai/v1/models",
+	},
+});

package/src/utils/oauth/index.ts

@@ -16,8 +16,8 @@ const builtInOAuthProviders: OAuthProviderInfo[] = [
 		available: true,
 	},
 	{
-		id: "alibaba-coding-plan",
-		name: "Alibaba Coding Plan",
+		id: "alibaba-token-plan",
+		name: "Alibaba Token Plan",
 		available: true,
 	},
 	{
@@ -240,6 +240,16 @@ const builtInOAuthProviders: OAuthProviderInfo[] = [
 		name: "ZenMux",
 		available: true,
 	},
+	{
+		id: "bizrouter",
+		name: "BizRouter",
+		available: true,
+	},
+	{
+		id: "opengateway",
+		name: "OpenGateway by Sionic AI",
+		available: true,
+	},
 	{
 		id: "vllm",
 		name: "vLLM (Local OpenAI-compatible)",
@@ -370,6 +380,7 @@ export async function refreshOAuthToken(
 		case "together":
 		case "litellm":
 		case "lm-studio":
+		case "alibaba-token-plan":
 		case "ollama":
 		case "ollama-cloud":
 		case "xiaomi":
@@ -384,6 +395,8 @@ export async function refreshOAuthToken(
 		case "vercel-ai-gateway":
 		case "qwen-portal":
 		case "zenmux":
+		case "bizrouter":
+		case "opengateway":
 		case "vllm":
 			// API keys / static bearer tokens don't expire, return as-is
 			newCredentials = credentials;

package/src/utils/oauth/opengateway.ts

@@ -0,0 +1,15 @@
+/** OpenGateway (by Sionic AI) login flow (API key paste, validated via /v1/models). */
+import { createApiKeyLogin } from "./api-key-login";
+
+export const loginOpenGateway = createApiKeyLogin({
+	providerLabel: "OpenGateway by Sionic AI",
+	authUrl: "https://opengateway.ai/dashboard",
+	instructions: "Create or copy your OpenGateway API key",
+	promptMessage: "Paste your OpenGateway API key",
+	placeholder: "sk-...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "OpenGateway by Sionic AI",
+		modelsUrl: "https://apis.opengateway.ai/v1/models",
+	},
+});

package/src/utils/oauth/types.ts

@@ -9,8 +9,9 @@ export type OAuthCredentials = {
 };
 
 export type OAuthProvider =
-	| "alibaba-coding-plan"
+	| "alibaba-token-plan"
 	| "anthropic"
+	| "bizrouter"
 	| "cerebras"
 	| "cloudflare-ai-gateway"
 	| "cursor"
@@ -40,6 +41,7 @@ export type OAuthProvider =
 	| "openai-codex-device"
 	| "opencode-go"
 	| "opencode-zen"
+	| "opengateway"
 	| "parallel"
 	| "perplexity"
 	| "qianfan"

package/src/utils/validation.ts

@@ -25,7 +25,7 @@
 import { structuredCloneJSON } from "@sayknow-cli/utils";
 import type { ZodType } from "zod/v4";
 import type { $ZodIssue as ZodIssue } from "zod/v4/core";
-import type { Tool, ToolCall } from "../types";
+import type { RawArgumentRejectionCode, Tool, ToolCall } from "../types";
 import { upgradeJsonSchemaTo202012 } from "./schema/draft";
 import {
 	isJsonSchemaValueValid,
@@ -958,6 +958,15 @@ export function validateToolCall(tools: Tool[], toolCall: ToolCall): ToolCall["a
 	return validateToolArguments(tool, toolCall);
 }
 
+const RAW_ARGUMENT_REJECTION_MESSAGES: Record<RawArgumentRejectionCode, string> = {
+	"ask-intent-review-requires-positive-round":
+		"deepInterview.intent_review is post-Round-0 only and requires a positive round",
+	"ask-intent-contract-requires-non-empty-authority":
+		"deepInterview.intent_contract requires non-empty items and confirmation_options",
+	"ask-deep-interview-metadata-requires-deep-interview-gate":
+		"deepInterview metadata cannot be combined with a non-deep-interview workflowGate",
+};
+
 /**
  * Validates tool call arguments against the tool's schema (Zod or plain JSON
  * Schema). Applies LLM-quirk coercions (numeric strings, JSON-string
@@ -969,7 +978,13 @@ export function validateToolArguments(tool: Tool, toolCall: ToolCall): ToolCall[
 	const originalArgs = toolCall.arguments;
 	const rawValidation = tool.rawArgumentValidation?.(originalArgs);
 	if (rawValidation?.outcome === "reject") {
-		throw new Error(`Validation failed for tool "${toolCall.name}": raw arguments rejected before coercion`);
+		const base = `Validation failed for tool "${toolCall.name}": raw arguments rejected before coercion`;
+		const code = rawValidation.code;
+		const correction =
+			typeof code === "string" && Object.hasOwn(RAW_ARGUMENT_REJECTION_MESSAGES, code)
+				? RAW_ARGUMENT_REJECTION_MESSAGES[code as RawArgumentRejectionCode]
+				: undefined;
+		throw new Error(correction ? `${base}; ${correction}` : base);
 	}
 	const rawArgs = rawValidation?.outcome === "accept" ? rawValidation.arguments : originalArgs;
 	const ctx = getValidationContext(tool);

package/src/utils.ts

@@ -271,17 +271,53 @@ function normalizeResponsesImageUrlForReplay(value: unknown): NormalizedResponse
 	return { imageUrl: stringifyResponsesStringParamForReplay(value) };
 }
 
+/**
+ * OpenAI Responses `input_image.image_url` must be a fetchable HTTP(S) URL or an
+ * image data URI. Session resident-blob materialization may leave a human-readable
+ * placeholder like `[Session resident imageUrl blob missing: sha256:…; …]` in this
+ * field; replaying that string as `image_url` makes Codex reject the entire turn
+ * with `invalid_value` (#2924).
+ */
+function isProviderSafeResponsesImageUrl(value: string): boolean {
+	const url = value.trim();
+	if (url.length === 0) return false;
+	if (url.startsWith("https://") || url.startsWith("http://")) return true;
+	// Accept only image data URIs — other data: schemes are not valid image inputs.
+	if (url.startsWith("data:image/")) return true;
+	return false;
+}
+
+function hasNonEmptyResponsesFileId(part: Record<string, unknown>): boolean {
+	return typeof part.file_id === "string" && part.file_id.trim().length > 0;
+}
+
 function sanitizeResponsesMessageContentForReplay(content: unknown): unknown {
 	if (typeof content === "string") return neutralizeReservedControlTokens(content.toWellFormed());
 	if (!Array.isArray(content)) return content;
-	return content.map(part => {
-		if (!part || typeof part !== "object") return part;
+	const sanitizedContent: unknown[] = [];
+	for (const part of content) {
+		if (!part || typeof part !== "object") {
+			sanitizedContent.push(part);
+			continue;
+		}
 		const sanitizedPart = { ...(part as Record<string, unknown>) };
 		if ("text" in sanitizedPart) {
 			sanitizedPart.text = normalizeResponsesMessageTextForReplay(sanitizedPart.text);
 		}
 		if ("image_url" in sanitizedPart) {
 			const normalizedImageUrl = normalizeResponsesImageUrlForReplay(sanitizedPart.image_url);
+			if (!isProviderSafeResponsesImageUrl(normalizedImageUrl.imageUrl)) {
+				// Keep the part when a provider file_id can stand alone; otherwise drop
+				// only this image part so neighboring text/history still replays.
+				if (!hasNonEmptyResponsesFileId(sanitizedPart)) continue;
+				delete sanitizedPart.image_url;
+				if (sanitizedPart.type === "image_url") sanitizedPart.type = "input_image";
+				if ("detail" in sanitizedPart && !isResponsesImageDetail(sanitizedPart.detail)) {
+					delete sanitizedPart.detail;
+				}
+				sanitizedContent.push(sanitizedPart);
+				continue;
+			}
 			sanitizedPart.image_url = normalizedImageUrl.imageUrl;
 			if (sanitizedPart.type === "image_url") {
 				sanitizedPart.type = "input_image";
@@ -292,8 +328,9 @@ function sanitizeResponsesMessageContentForReplay(content: unknown): unknown {
 				delete sanitizedPart.detail;
 			}
 		}
-		return sanitizedPart;
-	});
+		sanitizedContent.push(sanitizedPart);
+	}
+	return sanitizedContent;
 }
 
 function sanitizeResponsesStringFieldsForReplay(item: Record<string, unknown>): void {

package/dist/types/utils/oauth/alibaba-coding-plan.d.ts

@@ -1,18 +0,0 @@
-/**
- * Alibaba Coding Plan login flow.
- *
- * Alibaba Coding Plan provides OpenAI-compatible models via https://coding-intl.dashscope.aliyuncs.com/v1.
- *
- * This is not OAuth - it's a simple API key flow:
- * 1. Open browser to Alibaba Cloud DashScope API key settings
- * 2. User copies their API key
- * 3. User pastes the API key into the CLI
- */
-import type { OAuthController } from "./types";
-/**
- * Login to Alibaba Coding Plan.
- *
- * Opens browser to API keys page, prompts user to paste their API key.
- * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
- */
-export declare function loginAlibabaCodingPlan(options: OAuthController): Promise<string>;