@sayknow-cli/ai 0.5.1 → 0.5.6

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [0.5.6] - 2026-08-28
+
+## [0.5.3] - 2026-08-28
+
+### Added
+
+- Added first-class oMLX and SGLang OpenAI-compatible local providers. oMLX includes model capability enrichment and macOS profiles; SGLang discovery is credentialless only on normalized loopback origins and supports trusted `SGLANG_BASE_URL`/`SGLANG_API_KEY` configuration.
+### Fixed
+
+- Hardened local OpenAI-compatible discovery with bounded catalogs, redirect refusal, canonical loopback URLs, safe oMLX limits, and explicit-only SGLang login; deprecated `sglang-local` credentials no longer shadow real keys.
+
+- Anthropic's measured `invalid_request_error` prompt-overflow envelope now triggers context compaction only when its reported token usage actually exceeds the reported maximum, while auth, quota, rate-limit, and unverified prose remain authoritative non-overflow failures.
+
 ## [0.7.5] - 2026-06-27
 
 ### Fixed

package/dist/types/provider-models/openai-compat.d.ts

@@ -153,6 +153,11 @@ export interface LmStudioModelManagerConfig {
     baseUrl?: string;
 }
 export declare function lmStudioModelManagerOptions(config?: LmStudioModelManagerConfig): ModelManagerOptions<"openai-completions">;
+export interface OmlxModelManagerConfig {
+    apiKey?: string;
+    baseUrl?: string;
+}
+export declare function omlxModelManagerOptions(config?: OmlxModelManagerConfig): ModelManagerOptions<"openai-completions">;
 export interface SyntheticModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;
@@ -210,6 +215,11 @@ export interface VllmModelManagerConfig {
     baseUrl?: string;
 }
 export declare function vllmModelManagerOptions(config?: VllmModelManagerConfig): ModelManagerOptions<"openai-completions">;
+export interface SglangModelManagerConfig {
+    apiKey?: string;
+    baseUrl?: string;
+}
+export declare function sglangModelManagerOptions(config?: SglangModelManagerConfig): ModelManagerOptions<"openai-completions">;
 export interface NanoGptModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;

package/dist/types/providers/openai-responses-shared.d.ts

@@ -45,16 +45,18 @@ export interface ProcessResponsesStreamOptions {
 }
 export declare function processResponsesStream<TApi extends Api>(openaiStream: AsyncIterable<OpenAI.Responses.ResponseStreamEvent>, output: AssistantMessage, stream: AssistantMessageEventStream, model: Model<TApi>, options?: ProcessResponsesStreamOptions): Promise<void>;
 /**
- * Mark tool-call blocks left incomplete by a length-truncated response so the
- * agent loop rejects them instead of executing a best-effort partial parse.
+ * Mark tool-call blocks whose arguments are structurally incomplete when a
+ * response stops for length.
  *
- * The universal signal is finalization: a call that never received its terminal
- * `output_item.done` (passed in via `isFinalized`) was cut off mid-arguments.
- * This covers both JSON function calls and raw-input custom tools without
- * mis-flagging a *completed* custom tool whose raw input is not valid JSON. As a
- * defensive secondary, a finalized JSON function call whose buffered arguments
- * still don't parse (e.g. a misbehaving relay) is flagged too. No-op unless the
- * turn stopped for length.
+ * A missing `output_item.done` normally means the call was cut off. Responses
+ * can also hit the output-token limit after emitting a complete JSON object but
+ * before finalizing the item (for example, after a long whitespace tail). A
+ * non-finalized JSON call is therefore safe only when its exact buffered text
+ * parses as complete JSON. Custom tools carry raw input with no structural
+ * completion marker, so they still require finalization.
+ *
+ * Finalized JSON calls get the same defensive parse check for misbehaving
+ * relays. No-op unless the turn stopped for length.
  *
  * Shared by both Responses providers (`openai-responses`, `openai-codex-responses`).
  */

package/dist/types/types.d.ts

@@ -51,7 +51,7 @@ export interface ThinkingConfig {
     /** Provider-specific transport used to encode the selected effort. */
     mode: ThinkingControlMode;
 }
-export type KnownProvider = "alibaba-token-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "opengateway" | "bizrouter" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio";
+export type KnownProvider = "alibaba-token-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "opengateway" | "bizrouter" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio" | "omlx" | "sglang";
 export type Provider = KnownProvider | string;
 import type { Effort } from "./model-thinking";
 /** Token budgets for each thinking level (token-based providers only) */
@@ -355,6 +355,12 @@ export interface ToolCall {
      * rejects the call with a retryable error instead.
      */
     incompleteArguments?: boolean;
+    /**
+     * Transient raw JSON for a provider-detected `\uXXXX`-escaped non-ASCII
+     * tool payload. The agent loop validates and removes it before persistence.
+     */
+    escapedNonAsciiArguments?: boolean;
+    escapedNonAsciiArgumentsRaw?: string;
 }
 export interface Usage {
     /** Non-cached input tokens (matches the bucket the provider bills as new input). */

package/dist/types/utils/discovery/openai-compatible.d.ts

@@ -72,3 +72,13 @@ export interface FetchOpenAICompatibleModelsOptions<TApi extends Api> {
  * Returns `[]` only when the endpoint responds successfully with no usable models.
  */
 export declare function fetchOpenAICompatibleModels<TApi extends Api>(options: FetchOpenAICompatibleModelsOptions<TApi>): Promise<Model<TApi>[] | null>;
+/**
+ * Returns a canonical HTTP(S) OpenAI-compatible base URL without embedded URL
+ * credentials, query parameters, or fragments.
+ */
+export declare function resolveCanonicalOpenAIBaseUrl(value: string | undefined): string | undefined;
+/**
+ * Returns a local OpenAI-compatible base URL only when it is an HTTP(S)
+ * loopback endpoint; otherwise returns the trusted fallback.
+ */
+export declare function resolveLoopbackOpenAIBaseUrl(value: string | undefined, fallback: string): string;

package/dist/types/utils/oauth/sglang.d.ts

@@ -0,0 +1,12 @@
+/**
+ * SGLang login flow.
+ *
+ * SGLang commonly exposes an OpenAI-compatible API on a local server. It may
+ * require a bearer token, but local servers commonly allow unauthenticated
+ * access. This flow stores an API-key-style credential for auth storage.
+ */
+import type { OAuthController } from "./types";
+/**
+ * Login to SGLang with an explicit bearer token.
+ */
+export declare function loginSglang(options: OAuthController): Promise<string>;

package/dist/types/utils/oauth/types.d.ts

@@ -7,7 +7,7 @@ export type OAuthCredentials = {
     email?: string;
     accountId?: string;
 };
-export type OAuthProvider = "alibaba-token-plan" | "anthropic" | "bizrouter" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "zai";
+export type OAuthProvider = "alibaba-token-plan" | "anthropic" | "bizrouter" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "sglang" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "zai";
 export type OAuthProviderId = OAuthProvider | (string & {});
 export type OAuthPrompt = {
     message: string;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@sayknow-cli/ai",
-	"version": "0.5.1",
+	"version": "0.5.6",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://sayknow-cli.com",
 	"author": "jaybeyond",
@@ -43,7 +43,7 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@sayknow-cli/utils": "0.5.1",
+		"@sayknow-cli/utils": "0.5.6",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-storage.ts

@@ -37,6 +37,12 @@ import { loginDeepSeek } from "./utils/oauth/deepseek";
 import { loginOpenAICodexDevice } from "./utils/oauth/openai-codex";
 import type { OAuthController, OAuthCredentials, OAuthProvider, OAuthProviderId } from "./utils/oauth/types";
 
+const DEPRECATED_SGLANG_NO_AUTH_TOKEN = "sglang-local";
+
+function isDeprecatedSglangNoAuthToken(provider: string, apiKey: string | undefined): boolean {
+	return provider === "sglang" && apiKey === DEPRECATED_SGLANG_NO_AUTH_TOKEN;
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Credential Types
 // ─────────────────────────────────────────────────────────────────────────────
@@ -1351,6 +1357,11 @@ export class AuthStorage {
 			.filter(
 				(entry): entry is { credential: Extract<AuthCredential, { type: T }>; index: number } =>
 					entry.credential.type === type,
+			)
+			.filter(
+				entry =>
+					type !== "api_key" ||
+					!isDeprecatedSglangNoAuthToken(provider, (entry.credential as ApiKeyCredential).key),
 			);
 
 		if (credentials.length === 0) return undefined;
@@ -1950,6 +1961,12 @@ export class AuthStorage {
 				await saveApiKeyCredential(apiKey);
 				return;
 			}
+			case "sglang": {
+				const { loginSglang } = await import("./utils/oauth/sglang");
+				const apiKey = await loginSglang(ctrl);
+				await saveApiKeyCredential(apiKey);
+				return;
+			}
 			case "parallel": {
 				const { loginParallel } = await import("./utils/oauth/parallel");
 				const apiKey = await loginParallel(ctrl);
@@ -3434,7 +3451,8 @@ export class AuthStorage {
 
 		const apiKeySelection = this.#selectCredentialByType(provider, "api_key");
 		if (apiKeySelection) {
-			return this.#configValueResolver(apiKeySelection.credential.key);
+			const apiKey = await this.#configValueResolver(apiKeySelection.credential.key);
+			if (!isDeprecatedSglangNoAuthToken(provider, apiKey)) return apiKey;
 		}
 
 		// Return current OAuth access token only if it is not already expired.
@@ -3487,16 +3505,24 @@ export class AuthStorage {
 			return configKey;
 		}
 
+		let skippedDeprecatedNoAuthToken = false;
 		if (selectedCredential?.credential.type === "api_key") {
-			this.#recordSessionCredential(provider, sessionId, "api_key", selectedCredential.index);
-			return this.#configValueResolver(selectedCredential.credential.key);
+			const apiKey = await this.#configValueResolver(selectedCredential.credential.key);
+			if (!isDeprecatedSglangNoAuthToken(provider, apiKey)) {
+				this.#recordSessionCredential(provider, sessionId, "api_key", selectedCredential.index);
+				return apiKey;
+			}
+			skippedDeprecatedNoAuthToken = true;
 		}
 
-		if (!selectedCredential) {
+		if (!selectedCredential || skippedDeprecatedNoAuthToken) {
 			const apiKeySelection = this.#selectCredentialByType(provider, "api_key", sessionId);
 			if (apiKeySelection) {
-				this.#recordSessionCredential(provider, sessionId, "api_key", apiKeySelection.index);
-				return this.#configValueResolver(apiKeySelection.credential.key);
+				const apiKey = await this.#configValueResolver(apiKeySelection.credential.key);
+				if (!isDeprecatedSglangNoAuthToken(provider, apiKey)) {
+					this.#recordSessionCredential(provider, sessionId, "api_key", apiKeySelection.index);
+					return apiKey;
+				}
 			}
 		}
 

package/src/model-thinking.ts

@@ -198,7 +198,11 @@ export function refreshModelThinking<TApi extends Api>(model: ApiModel<TApi>): A
  */
 export function applyGeneratedModelPolicies(models: ApiModel<Api>[]): void {
 	for (let index = 0; index < models.length; index++) {
-		const model = refreshModelThinking(models[index]!);
+		const source = models[index]!;
+		if (source.provider === "omlx") {
+			source.reasoning = true;
+		}
+		const model = refreshModelThinking(source);
 		applyGeneratedModelPolicy(model);
 		models[index] = model;
 	}
@@ -377,6 +381,16 @@ function applyGeneratedModelPolicy(model: ApiModel<Api>): void {
 		};
 		delete model.compat.thinkingFormat;
 	}
+	if (model.provider === "omlx" && model.api === "openai-completions") {
+		model.compat = {
+			...(model.compat ?? {}),
+			supportsStore: false,
+			supportsDeveloperRole: false,
+			supportsReasoningEffort: true,
+			thinkingFormat: "qwen-chat-template",
+			reasoningContentField: "reasoning_content",
+		};
+	}
 	model.name = scrubGeneratedModelName(model.name);
 	if (
 		model.api === "openai-completions" &&
@@ -527,6 +541,9 @@ function inferDefaultEffort<TApi extends Api>(model: ApiModel<TApi>, parsedModel
 	) {
 		return GPT_5_5_DEFAULT_EFFORT;
 	}
+	if (model.provider === "omlx") {
+		return Effort.Medium;
+	}
 	return undefined;
 }
 
@@ -662,6 +679,9 @@ function inferFallbackEfforts<TApi extends Api>(model: ApiModel<TApi>): readonly
 		return DEFAULT_REASONING_EFFORTS;
 	}
 	if (model.api === "openai-completions") {
+		if (model.provider === "omlx") {
+			return [Effort.Low, Effort.Medium, Effort.High];
+		}
 		const compat = resolveOpenAICompat(model as ApiModel<"openai-completions">);
 		if (compat.thinkingFormat === "openai" && compat.supportsReasoningEffort) {
 			return DEFAULT_REASONING_EFFORTS_WITH_XHIGH;

package/src/provider-models/descriptors.ts

@@ -31,6 +31,7 @@ import {
 	nanoGptModelManagerOptions,
 	nvidiaModelManagerOptions,
 	ollamaModelManagerOptions,
+	omlxModelManagerOptions,
 	openaiModelManagerOptions,
 	opencodeGoModelManagerOptions,
 	opencodeZenModelManagerOptions,
@@ -38,6 +39,7 @@ import {
 	openrouterModelManagerOptions,
 	qianfanModelManagerOptions,
 	qwenPortalModelManagerOptions,
+	sglangModelManagerOptions,
 	syntheticModelManagerOptions,
 	togetherModelManagerOptions,
 	veniceModelManagerOptions,
@@ -260,12 +262,22 @@ export const PROVIDER_DESCRIPTORS: readonly ProviderDescriptor[] = [
 		catalog("LiteLLM", ["LITELLM_API_KEY"], { allowUnauthenticated: true }),
 	),
 	descriptor("lm-studio", "llama-3-8b", config => lmStudioModelManagerOptions(config), { allowUnauthenticated: true }),
+	descriptor("omlx", "Qwen3.5-122B-A10B-Q4", config => omlxModelManagerOptions(config), {
+		allowUnauthenticated: true,
+	}),
 	catalogDescriptor(
 		"vllm",
 		"gpt-oss-20b",
 		config => vllmModelManagerOptions(config),
 		catalog("vLLM", ["VLLM_API_KEY"], { allowUnauthenticated: true }),
 	),
+	catalogDescriptor(
+		"sglang",
+		"gpt-oss-20b",
+		config => sglangModelManagerOptions(config),
+		catalog("SGLang", ["SGLANG_API_KEY"], { allowUnauthenticated: true }),
+		{ allowUnauthenticated: true },
+	),
 	catalogDescriptor(
 		"moonshot",
 		"kimi-k2.5",

package/src/provider-models/openai-compat.ts

@@ -8,6 +8,8 @@ import {
 	fetchOpenAICompatibleModels,
 	type OpenAICompatibleModelMapperContext,
 	type OpenAICompatibleModelRecord,
+	resolveCanonicalOpenAIBaseUrl,
+	resolveLoopbackOpenAIBaseUrl,
 } from "../utils/discovery/openai-compatible";
 import { toFireworksPublicModelId } from "../utils/fireworks-model-id";
 import { getGitHubCopilotBaseUrl, OPENCODE_HEADERS, parseGitHubCopilotApiKey } from "../utils/oauth/github-copilot";
@@ -197,6 +199,18 @@ function firstPositiveModelNumber(fallback: number, ...candidates: readonly unkn
 	return fallback;
 }
 
+function safePositiveInteger(value: unknown): number | undefined {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
+}
+
+function firstPositiveSafeInteger(fallback: number, ...candidates: readonly unknown[]): number {
+	for (const candidate of candidates) {
+		const value = safePositiveInteger(candidate);
+		if (value !== undefined) return value;
+	}
+	return fallback;
+}
+
 function mapLmStudioModel(
 	entry: OpenAICompatibleModelRecord,
 	defaults: Model<"openai-completions">,
@@ -226,6 +240,52 @@ function mapLmStudioModel(
 		),
 	};
 }
+function mapOmlxModel(
+	entry: OpenAICompatibleModelRecord,
+	defaults: Model<"openai-completions">,
+	reference: Model<"openai-completions"> | undefined,
+): Model<"openai-completions"> {
+	const model = mapWithBundledReference(entry, defaults, reference);
+	return {
+		...model,
+		reasoning: true,
+		thinking: {
+			mode: "effort",
+			minLevel: Effort.Low,
+			maxLevel: Effort.High,
+			defaultLevel: Effort.Medium,
+			levels: [Effort.Low, Effort.Medium, Effort.High],
+		},
+		compat: {
+			...(model.compat ?? {}),
+			supportsStore: false,
+			supportsDeveloperRole: false,
+			supportsReasoningEffort: true,
+			thinkingFormat: "qwen-chat-template",
+			reasoningContentField: "reasoning_content",
+		},
+		contextWindow: firstPositiveSafeInteger(
+			model.contextWindow,
+			safePositiveInteger(entry.max_model_len),
+			entry.context_length,
+			entry.max_context_length,
+			getNestedModelValue(entry, ["meta", "n_ctx"]),
+			getNestedModelValue(entry, ["details", "context_length"]),
+			getNestedModelValue(entry, ["details", "n_ctx"]),
+			getNestedModelValue(entry, ["meta", "n_ctx_train"]),
+		),
+		maxTokens: firstPositiveSafeInteger(
+			model.maxTokens,
+			entry.max_completion_tokens,
+			entry.max_tokens,
+			entry.max_output_tokens,
+			getNestedModelValue(entry, ["details", "max_completion_tokens"]),
+			getNestedModelValue(entry, ["details", "max_tokens"]),
+			getNestedModelValue(entry, ["meta", "max_completion_tokens"]),
+			getNestedModelValue(entry, ["meta", "max_tokens"]),
+		),
+	};
+}
 
 function normalizeAnthropicBaseUrl(baseUrl: string | undefined, fallback: string): string {
 	const value = baseUrl?.trim();
@@ -1381,6 +1441,42 @@ export function lmStudioModelManagerOptions(
 			}),
 	};
 }
+// ---------------------------------------------------------------------------
+// 12.6. oMLX (Apple Silicon MLX Local Server)
+// ---------------------------------------------------------------------------
+
+export interface OmlxModelManagerConfig {
+	apiKey?: string;
+	baseUrl?: string;
+}
+
+export function omlxModelManagerOptions(config?: OmlxModelManagerConfig): ModelManagerOptions<"openai-completions"> {
+	const apiKey = config?.apiKey;
+	const baseUrl = resolveLoopbackOpenAIBaseUrl(
+		config?.baseUrl ?? $credentialEnv("OMLX_BASE_URL"),
+		"http://127.0.0.1:8080/v1",
+	);
+	const references = createBundledReferenceMap<"openai-completions">("omlx" as Parameters<typeof getBundledModels>[0]);
+	return {
+		providerId: "omlx",
+		fetchDynamicModels: () =>
+			fetchOpenAICompatibleModels({
+				api: "openai-completions",
+				provider: "omlx",
+				baseUrl,
+				apiKey,
+				fetch: (input, init) =>
+					fetch(input, {
+						...init,
+						redirect: "error",
+						signal: init?.signal
+							? AbortSignal.any([init.signal, AbortSignal.timeout(500)])
+							: AbortSignal.timeout(500),
+					}),
+				mapModel: (entry, defaults) => mapOmlxModel(entry, defaults, references.get(defaults.id)),
+			}),
+	};
+}
 
 // ---------------------------------------------------------------------------
 // 13. Synthetic
@@ -1735,6 +1831,62 @@ export function vllmModelManagerOptions(config?: VllmModelManagerConfig): ModelM
 			}),
 	};
 }
+// ---------------------------------------------------------------------------
+// 22.5. SGLang
+// ---------------------------------------------------------------------------
+
+export interface SglangModelManagerConfig {
+	apiKey?: string;
+	baseUrl?: string;
+}
+
+export function sglangModelManagerOptions(
+	config?: SglangModelManagerConfig,
+): ModelManagerOptions<"openai-completions"> {
+	const apiKey = config?.apiKey;
+	const configuredBaseUrl = config?.baseUrl ?? $credentialEnv("SGLANG_BASE_URL");
+	const baseUrl =
+		resolveCanonicalOpenAIBaseUrl(configuredBaseUrl) ?? (config?.baseUrl ? "" : "http://127.0.0.1:30000/v1");
+	const isLoopback = baseUrl.length > 0 && resolveLoopbackOpenAIBaseUrl(baseUrl, "") === baseUrl;
+	const references = createBundledReferenceMap<"openai-completions">(
+		"sglang" as Parameters<typeof getBundledModels>[0],
+	);
+	return {
+		providerId: "sglang",
+		...(baseUrl && (apiKey || isLoopback)
+			? {
+					fetchDynamicModels: () =>
+						fetchOpenAICompatibleModels({
+							api: "openai-completions",
+							provider: "sglang",
+							baseUrl,
+							apiKey,
+							fetch: (input, init) =>
+								fetch(input, {
+									...init,
+									redirect: "error",
+									signal: isLoopback
+										? init?.signal
+											? AbortSignal.any([init.signal, AbortSignal.timeout(500)])
+											: AbortSignal.timeout(500)
+										: init?.signal,
+								}),
+							mapModel: (entry, defaults) => {
+								const model = mapWithBundledReference(entry, defaults, references.get(defaults.id));
+								const contextWindow = toNumber(entry.max_model_len);
+								return {
+									...model,
+									contextWindow:
+										contextWindow !== undefined && Number.isSafeInteger(contextWindow) && contextWindow > 0
+											? contextWindow
+											: model.contextWindow,
+								};
+							},
+						}),
+				}
+			: {}),
+	};
+}
 
 // ---------------------------------------------------------------------------
 // 23. NanoGPT

package/src/providers/anthropic.ts

@@ -1668,6 +1668,17 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 							if (block) {
 								blocksByAnthropicIndex.delete(event.index);
 								delete (block as { index?: number }).index;
+								if (block.type === "toolCall" && /\\u[0-9a-fA-F]{4}/.test(block.partialJson)) {
+									const escapedCodeUnits = [...block.partialJson.matchAll(/\\u([0-9a-fA-F]{4})/g)].map(match =>
+										Number.parseInt(match[1]!, 16),
+									);
+									if (escapedCodeUnits.some(codeUnit => codeUnit >= 0x80)) {
+										Object.defineProperties(block, {
+											escapedNonAsciiArguments: { value: true, configurable: true },
+											escapedNonAsciiArgumentsRaw: { value: block.partialJson, configurable: true },
+										});
+									}
+								}
 								if (block.type === "text") {
 									stream.push({
 										type: "text_end",

package/src/providers/openai-completions.ts

@@ -38,6 +38,7 @@ import {
 import { normalizeSystemPrompts, sanitizeJsonStrings } from "../utils";
 import { createAbortSourceTracker } from "../utils/abort";
 import { AssistantMessageEventStream } from "../utils/event-stream";
+import { transportFailureFacts } from "../utils/fallback-transport";
 import { toFirepassWireModelId, toFireworksWireModelId } from "../utils/fireworks-model-id";
 import {
 	type CapturedHttpErrorResponse,
@@ -465,7 +466,7 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 				options?.fetch,
 				options?.streamFirstEventTimeoutMs,
 				options?.authCredentialType,
-				options?.requestMaxRetries,
+				options?.fallbackManaged ? 0 : options?.requestMaxRetries,
 				options?.sessionId,
 			);
 			const premiumRequestsTotal = copilotPremiumRequests;
@@ -500,7 +501,10 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 					body: params,
 				};
 				const { data, response, request_id } = await client.chat.completions
-					.create(params as OpenAI.Chat.Completions.ChatCompletionCreateParamsStreaming, { signal: requestSignal })
+					.create(params as OpenAI.Chat.Completions.ChatCompletionCreateParamsStreaming, {
+						signal: requestSignal,
+						...(options?.fallbackManaged ? { maxRetries: 0 } : {}),
+					})
 					.withResponse();
 				await notifyProviderResponse(options, response, model, request_id);
 				return data;
@@ -510,6 +514,7 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 				openaiStream = await callWithCopilotModelRetry(() => createCompletionsStream(), {
 					provider: model.provider,
 					signal: requestSignal,
+					fallbackManaged: options?.fallbackManaged,
 				});
 			} catch (error) {
 				const capturedErrorResponse = getCapturedErrorResponse();
@@ -766,13 +771,25 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 
 				if (choice.finish_reason) {
 					const finishReasonResult = mapStopReason(choice.finish_reason);
-					output.stopReason = finishReasonResult.stopReason;
-					if (finishReasonResult.errorMessage) {
-						output.errorMessage = finishReasonResult.errorMessage;
+					if (choice.finish_reason === "content_filter") {
+						output.errorKind = "provider_safety_stop";
+					}
+					if (output.errorKind !== "provider_safety_stop" || choice.finish_reason === "content_filter") {
+						output.stopReason = finishReasonResult.stopReason;
+						if (finishReasonResult.errorMessage) {
+							output.errorMessage = finishReasonResult.errorMessage;
+						}
 					}
 				}
 
 				if (choice.delta) {
+					const refusal = choice.delta.refusal;
+					if (typeof refusal === "string" && refusal.length > 0) {
+						output.errorKind = "provider_safety_stop";
+						output.stopReason = "error";
+						output.errorMessage = "Provider refusal";
+						appendTextDelta(refusal);
+					}
 					const normalizedDeltaText = normalizeStreamingContentText(choice.delta.content);
 					if (normalizedDeltaText.length > 0) {
 						if (!firstTokenTime) firstTokenTime = Date.now();
@@ -944,13 +961,19 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 			const firstEventTimeoutError = abortTracker.getLocalAbortReason();
 			output.stopReason = abortTracker.wasCallerAbort() ? "aborted" : "error";
 			output.errorStatus = extractHttpStatusFromError(error) ?? getCapturedErrorResponse?.()?.status;
-			output.errorMessage =
-				firstEventTimeoutError?.message ??
-				(await finalizeErrorMessage(error, rawRequestDump, getCapturedErrorResponse?.()));
-			// Some providers via OpenRouter include extra details here.
-			const rawMetadata = (error as { error?: { metadata?: { raw?: string } } })?.error?.metadata?.raw;
-			if (rawMetadata) output.errorMessage += `\n${rawMetadata}`;
-			output.errorMessage = rewriteCopilotError(output.errorMessage, error, model.provider);
+			output.transportFailure = transportFailureFacts(error);
+			if (isOpenAICompletionsSafetyStop(error, getCapturedErrorResponse?.())) {
+				output.errorKind = "provider_safety_stop";
+			}
+			if (output.errorKind !== "provider_safety_stop" || !output.errorMessage) {
+				output.errorMessage =
+					firstEventTimeoutError?.message ??
+					(await finalizeErrorMessage(error, rawRequestDump, getCapturedErrorResponse?.()));
+				// Some providers via OpenRouter include extra details here.
+				const rawMetadata = (error as { error?: { metadata?: { raw?: string } } })?.error?.metadata?.raw;
+				if (rawMetadata) output.errorMessage += `\n${rawMetadata}`;
+				output.errorMessage = rewriteCopilotError(output.errorMessage, error, model.provider);
+			}
 			output.duration = Date.now() - startTime;
 			if (firstTokenTime) output.ttft = firstTokenTime - startTime;
 			stream.push({ type: "error", reason: output.stopReason, error: output });
@@ -1264,8 +1287,12 @@ function buildParams(
 		// Qwen uses top-level enable_thinking: boolean
 		params.enable_thinking = !!options?.reasoning && !options?.disableReasoning;
 	} else if (supportsReasoningParams && compat.thinkingFormat === "qwen-chat-template" && model.reasoning) {
+		const enableThinking = !!options?.reasoning && !options?.disableReasoning;
 		params.chat_template_kwargs = {
-			enable_thinking: !!options?.reasoning && !options?.disableReasoning,
+			enable_thinking: enableThinking,
+			...(enableThinking && options?.reasoning
+				? { reasoning_effort: mapReasoningEffort(options.reasoning, compat.reasoningEffortMap) }
+				: {}),
 		};
 	} else if (supportsReasoningParams && compat.thinkingFormat === "openrouter" && model.reasoning) {
 		// OpenRouter normalizes reasoning across providers via a nested reasoning object.
@@ -1926,7 +1953,22 @@ function shouldRetryWithoutStrictTools(
 		.join("\n");
 	return /wrong_api_format|mixed values for 'strict'|tool[s]?\b.*strict|\bstrict\b.*tool/i.test(messageParts);
 }
-
+function isOpenAICompletionsSafetyStop(
+	error: unknown,
+	capturedErrorResponse: CapturedHttpErrorResponse | undefined,
+): boolean {
+	const hasContentFilterCode = (value: unknown): boolean =>
+		typeof value === "string" && value.toLowerCase() === "content_filter";
+	const errorRecord = error as { code?: unknown; error?: { code?: unknown } } | undefined;
+	if (hasContentFilterCode(errorRecord?.code) || hasContentFilterCode(errorRecord?.error?.code)) return true;
+	if (!capturedErrorResponse?.bodyText) return false;
+	try {
+		const body = JSON.parse(capturedErrorResponse.bodyText) as { code?: unknown; error?: { code?: unknown } };
+		return hasContentFilterCode(body.code) || hasContentFilterCode(body.error?.code);
+	} catch {
+		return false;
+	}
+}
 function mapStopReason(reason: ChatCompletionChunk.Choice["finish_reason"] | string): {
 	stopReason: StopReason;
 	errorMessage?: string;

package/src/providers/openai-responses-shared.ts

@@ -795,16 +795,18 @@ export async function processResponsesStream<TApi extends Api>(
 }
 
 /**
- * Mark tool-call blocks left incomplete by a length-truncated response so the
- * agent loop rejects them instead of executing a best-effort partial parse.
+ * Mark tool-call blocks whose arguments are structurally incomplete when a
+ * response stops for length.
  *
- * The universal signal is finalization: a call that never received its terminal
- * `output_item.done` (passed in via `isFinalized`) was cut off mid-arguments.
- * This covers both JSON function calls and raw-input custom tools without
- * mis-flagging a *completed* custom tool whose raw input is not valid JSON. As a
- * defensive secondary, a finalized JSON function call whose buffered arguments
- * still don't parse (e.g. a misbehaving relay) is flagged too. No-op unless the
- * turn stopped for length.
+ * A missing `output_item.done` normally means the call was cut off. Responses
+ * can also hit the output-token limit after emitting a complete JSON object but
+ * before finalizing the item (for example, after a long whitespace tail). A
+ * non-finalized JSON call is therefore safe only when its exact buffered text
+ * parses as complete JSON. Custom tools carry raw input with no structural
+ * completion marker, so they still require finalization.
+ *
+ * Finalized JSON calls get the same defensive parse check for misbehaving
+ * relays. No-op unless the turn stopped for length.
  *
  * Shared by both Responses providers (`openai-responses`, `openai-codex-responses`).
  */
@@ -816,15 +818,17 @@ export function flagTruncatedToolCalls(
 	if (stopReason !== "length") return;
 	for (const block of output.content) {
 		if (block.type !== "toolCall") continue;
+		const partial = (block as { partialJson?: string }).partialJson;
 		if (!isFinalized(block)) {
-			block.incompleteArguments = true;
+			if (block.customWireName || partial === undefined || !isCompleteJson(partial)) {
+				block.incompleteArguments = true;
+			}
 			continue;
 		}
-		// Finalized: custom tools carry raw (non-JSON) input and are complete once
-		// finalized; only JSON function calls get the parse double-check.
-		if (!block.customWireName) {
-			const partial = (block as { partialJson?: string }).partialJson;
-			if (partial !== undefined && !isCompleteJson(partial)) block.incompleteArguments = true;
+		// Finalized custom tools carry raw (non-JSON) input. Only JSON function
+		// calls need the defensive parse check.
+		if (!block.customWireName && partial !== undefined && !isCompleteJson(partial)) {
+			block.incompleteArguments = true;
 		}
 	}
 }

package/src/stream.ts

@@ -11,6 +11,11 @@ import {
 } from "./model-thinking";
 import type { BedrockOptions } from "./providers/amazon-bedrock";
 import type { AnthropicOptions } from "./providers/anthropic";
+import {
+	hasResolvableAwsProfileSource,
+	isValidBedrockBearerToken,
+	readAwsStaticEnvironmentCredentials,
+} from "./providers/aws-credential-config";
 import type { CursorOptions } from "./providers/cursor";
 import { isGitLabDuoModel, streamGitLabDuo } from "./providers/gitlab-duo";
 import type { GoogleOptions } from "./providers/google";
@@ -129,28 +134,12 @@ const serviceProviderMap: Record<string, KeyResolver> = {
 			return "<authenticated>";
 		}
 	},
-	// Amazon Bedrock supports multiple credential sources:
-	// 1. AWS_PROFILE - named profile from ~/.aws/credentials
-	// 2. AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY - standard IAM keys
-	// 3. AWS_BEARER_TOKEN_BEDROCK - Bedrock API keys (bearer token)
-	// 4. AWS_CONTAINER_CREDENTIALS_* - ECS/Task IAM role credentials
-	// 5. AWS_WEB_IDENTITY_TOKEN_FILE + AWS_ROLE_ARN - IRSA (EKS) web identity
+	// Amazon Bedrock is advertised only when a credential source can be
+	// resolved locally without probing network metadata providers.
 	"amazon-bedrock": () => {
-		const awsProfile = $credentialEnv("AWS_PROFILE");
-		const awsAccessKeyId = $credentialEnv("AWS_ACCESS_KEY_ID");
-		const awsSecretAccessKey = $credentialEnv("AWS_SECRET_ACCESS_KEY");
 		const awsBearerToken = $credentialEnv("AWS_BEARER_TOKEN_BEDROCK");
-		const hasEcsCredentials =
-			!!$credentialEnv("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI") ||
-			!!$credentialEnv("AWS_CONTAINER_CREDENTIALS_FULL_URI");
-		const hasWebIdentity = !!$credentialEnv("AWS_WEB_IDENTITY_TOKEN_FILE") && !!$credentialEnv("AWS_ROLE_ARN");
-		if (
-			awsProfile ||
-			(awsAccessKeyId && awsSecretAccessKey) ||
-			awsBearerToken ||
-			hasEcsCredentials ||
-			hasWebIdentity
-		) {
+		if (awsBearerToken !== undefined && !isValidBedrockBearerToken(awsBearerToken)) return undefined;
+		if (awsBearerToken || readAwsStaticEnvironmentCredentials() || hasResolvableAwsProfileSource()) {
 			return "<authenticated>";
 		}
 	},
@@ -173,6 +162,8 @@ const serviceProviderMap: Record<string, KeyResolver> = {
 	bizrouter: "BIZROUTER_API_KEY",
 	venice: "VENICE_API_KEY",
 	vllm: "VLLM_API_KEY",
+	omlx: "OMLX_API_KEY",
+	sglang: "SGLANG_API_KEY",
 	xiaomi: "XIAOMI_API_KEY",
 };
 
@@ -371,7 +362,8 @@ export function streamSimple<TApi extends Api>(
 	context: Context,
 	options?: SimpleStreamOptions,
 ): AssistantMessageEventStream {
-	const retryApiKey = options?.onAuthError ? (options.apiKey ?? getEnvApiKey(model.provider)) : undefined;
+	const retryApiKey =
+		!options?.fallbackManaged && options?.onAuthError ? (options.apiKey ?? getEnvApiKey(model.provider)) : undefined;
 	if (retryApiKey) {
 		const outer = new AssistantMessageEventStream();
 		const onAuthError = options!.onAuthError!;
@@ -632,6 +624,8 @@ function mapOptionsForApi<TApi extends Api>(
 		maxRetryDelayMs: options?.maxRetryDelayMs,
 		requestMaxRetries: options?.requestMaxRetries,
 		streamMaxRetries: options?.streamMaxRetries,
+		fallbackManaged: options?.fallbackManaged,
+		fallbackAttempt: options?.fallbackAttempt,
 		metadata: options?.metadata,
 		sessionId: options?.sessionId,
 		providerSessionState: options?.providerSessionState,

package/src/types.ts

@@ -168,7 +168,9 @@ export type KnownProvider =
 	| "xiaomi-token-plan-ams"
 	| "xiaomi-token-plan-cn"
 	| "zenmux"
-	| "lm-studio";
+	| "lm-studio"
+	| "omlx"
+	| "sglang";
 export type Provider = KnownProvider | string;
 
 import type { Effort } from "./model-thinking";
@@ -529,6 +531,12 @@ export interface ToolCall {
 	 * rejects the call with a retryable error instead.
 	 */
 	incompleteArguments?: boolean;
+	/**
+	 * Transient raw JSON for a provider-detected `\uXXXX`-escaped non-ASCII
+	 * tool payload. The agent loop validates and removes it before persistence.
+	 */
+	escapedNonAsciiArguments?: boolean;
+	escapedNonAsciiArgumentsRaw?: string;
 }
 
 export interface Usage {

package/src/utils/discovery/openai-compatible.ts

@@ -1,8 +1,43 @@
+import * as net from "node:net";
 import { UNK_CONTEXT_WINDOW, UNK_MAX_TOKENS } from "@sayknow-cli/ai";
 import * as z from "zod/v4";
 import type { Api, FetchImpl, Model, Provider } from "../../types";
 
 const MODELS_PATH = "/models";
+const MAX_MODELS_RESPONSE_BYTES = 1_000_000;
+function parseIpv6Hextets(host: string): number[] | undefined {
+	if (net.isIP(host) !== 6) return undefined;
+	const doubleColon = host.indexOf("::");
+	if (doubleColon !== host.lastIndexOf("::")) return undefined;
+	const parseSide = (value: string): number[] | undefined => {
+		if (!value) return [];
+		const parts = value.split(":");
+		if (parts.some(part => !/^[0-9a-f]{1,4}$/i.test(part))) return undefined;
+		return parts.map(part => Number.parseInt(part, 16));
+	};
+	if (doubleColon < 0) {
+		const hextets = parseSide(host);
+		return hextets?.length === 8 ? hextets : undefined;
+	}
+	const left = parseSide(host.slice(0, doubleColon));
+	const right = parseSide(host.slice(doubleColon + 2));
+	if (!left || !right) return undefined;
+	const missing = 8 - left.length - right.length;
+	if (missing < 1) return undefined;
+	return [...left, ...new Array<number>(missing).fill(0), ...right];
+}
+
+function isLoopbackHost(hostname: string): boolean {
+	const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+	if (host === "localhost") return true;
+	if (net.isIP(host) === 4) return host.split(".", 1)[0] === "127";
+	const hextets = parseIpv6Hextets(host);
+	if (!hextets) return false;
+	const isIpv6Loopback = hextets.slice(0, 7).every(part => part === 0) && hextets[7] === 1;
+	const isIpv4MappedLoopback =
+		hextets.slice(0, 5).every(part => part === 0) && hextets[5] === 0xffff && hextets[6]! >> 8 === 0x7f;
+	return isIpv6Loopback || isIpv4MappedLoopback;
+}
 
 /**
  * Minimal OpenAI-style model entry shape consumed by discovery.
@@ -128,7 +163,9 @@ export async function fetchOpenAICompatibleModels<TApi extends Api>(
 		response = await fetchImpl(`${baseUrl}${MODELS_PATH}`, {
 			method: "GET",
 			headers: requestHeaders,
-			signal: options.signal,
+			signal: options.signal
+				? AbortSignal.any([options.signal, AbortSignal.timeout(5_000)])
+				: AbortSignal.timeout(5_000),
 		});
 	} catch {
 		return null;
@@ -144,7 +181,7 @@ export async function fetchOpenAICompatibleModels<TApi extends Api>(
 
 	let payload: unknown;
 	try {
-		payload = await response.json();
+		payload = JSON.parse(await readModelsResponse(response));
 	} catch {
 		return null;
 	}
@@ -188,6 +225,39 @@ export async function fetchOpenAICompatibleModels<TApi extends Api>(
 	return Array.from(deduped.values()).sort((left, right) => left.id.localeCompare(right.id));
 }
 
+async function readModelsResponse(response: Response): Promise<string> {
+	const contentLength = Number(response.headers.get("content-length"));
+	if (Number.isFinite(contentLength) && contentLength > MAX_MODELS_RESPONSE_BYTES) {
+		throw new Error("OpenAI-compatible models response exceeds the size limit");
+	}
+	if (!response.body) return "";
+	const reader = response.body.getReader();
+	const chunks: Uint8Array[] = [];
+	let total = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (!value) continue;
+			total += value.byteLength;
+			if (total > MAX_MODELS_RESPONSE_BYTES) {
+				await reader.cancel();
+				throw new Error("OpenAI-compatible models response exceeds the size limit");
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const body = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		body.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return new TextDecoder().decode(body);
+}
+
 function normalizeBaseUrl(baseUrl: string): string {
 	const trimmed = baseUrl.trim();
 	if (!trimmed) {
@@ -195,6 +265,40 @@ function normalizeBaseUrl(baseUrl: string): string {
 	}
 	return trimmed.endsWith("/") ? trimmed.slice(0, -1) : trimmed;
 }
+/**
+ * Returns a canonical HTTP(S) OpenAI-compatible base URL without embedded URL
+ * credentials, query parameters, or fragments.
+ */
+export function resolveCanonicalOpenAIBaseUrl(value: string | undefined): string | undefined {
+	const candidate = value?.trim();
+	if (!candidate) return undefined;
+	try {
+		const parsed = new URL(candidate);
+		if (
+			(parsed.protocol === "http:" || parsed.protocol === "https:") &&
+			!parsed.username &&
+			!parsed.password &&
+			!parsed.search &&
+			!parsed.hash
+		) {
+			return candidate;
+		}
+	} catch {
+		// Invalid endpoint.
+	}
+	return undefined;
+}
+
+/**
+ * Returns a local OpenAI-compatible base URL only when it is an HTTP(S)
+ * loopback endpoint; otherwise returns the trusted fallback.
+ */
+export function resolveLoopbackOpenAIBaseUrl(value: string | undefined, fallback: string): string {
+	const candidate = resolveCanonicalOpenAIBaseUrl(value);
+	if (!candidate) return fallback;
+	const parsed = new URL(candidate);
+	return isLoopbackHost(parsed.hostname) ? candidate : fallback;
+}
 
 function extractModelEntries(payload: unknown): ParsedOpenAICompatibleModelRecord[] | null {
 	return extractModelEntriesFromNode(payload);

package/src/utils/oauth/index.ts

@@ -255,6 +255,11 @@ const builtInOAuthProviders: OAuthProviderInfo[] = [
 		name: "vLLM (Local OpenAI-compatible)",
 		available: true,
 	},
+	{
+		id: "sglang",
+		name: "SGLang (Local OpenAI-compatible)",
+		available: true,
+	},
 	{
 		id: "cloudflare-ai-gateway",
 		name: "Cloudflare AI Gateway",
@@ -398,6 +403,7 @@ export async function refreshOAuthToken(
 		case "bizrouter":
 		case "opengateway":
 		case "vllm":
+		case "sglang":
 			// API keys / static bearer tokens don't expire, return as-is
 			newCredentials = credentials;
 			break;

package/src/utils/oauth/sglang.ts

@@ -0,0 +1,39 @@
+/**
+ * SGLang login flow.
+ *
+ * SGLang commonly exposes an OpenAI-compatible API on a local server. It may
+ * require a bearer token, but local servers commonly allow unauthenticated
+ * access. This flow stores an API-key-style credential for auth storage.
+ */
+
+import type { OAuthController, OAuthProvider } from "./types";
+
+const PROVIDER_ID: OAuthProvider = "sglang";
+const AUTH_URL = "https://docs.sglang.io/docs/advanced_features/server_arguments.html";
+const DEFAULT_LOCAL_BASE_URL = "http://127.0.0.1:30000/v1";
+
+/**
+ * Login to SGLang with an explicit bearer token.
+ */
+export async function loginSglang(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new Error(`${PROVIDER_ID} login requires onPrompt callback`);
+	}
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: `Paste the API key configured with SGLang's --api-key option. Local no-auth servers at ${DEFAULT_LOCAL_BASE_URL} are discovered automatically and do not need /login.`,
+	});
+	const apiKey = await options.onPrompt({
+		message: "Paste your SGLang API key",
+		placeholder: "SGLang API key",
+		allowEmpty: false,
+	});
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new Error("SGLang API key is required; local no-auth servers are discovered automatically");
+	}
+	return trimmed;
+}

package/src/utils/oauth/types.ts

@@ -52,6 +52,7 @@ export type OAuthProvider =
 	| "venice"
 	| "vercel-ai-gateway"
 	| "vllm"
+	| "sglang"
 	| "xai"
 	| "glm-zcode"
 	| "xiaomi"

package/src/utils/overflow.ts

@@ -127,8 +127,12 @@ const EMPTY_RESPONSE_USAGE_THRESHOLD = 5;
  * misleading error text.
  */
 const OVERFLOW_PROVIDER_CODES = new Set(["context_length_exceeded", "request_too_large"]);
+/**
+ * Codes that name a specific non-overflow *cause*. These are authoritative and
+ * can never be upgraded by error prose. Generic HTTP envelope types belong in
+ * {@link GENERIC_ENVELOPE_PROVIDER_CODES} instead.
+ */
 const NON_OVERFLOW_PROVIDER_CODES = new Set([
-	"invalid_request_error",
 	"authentication_error",
 	"invalid_api_key",
 	"invalid_token",
@@ -145,6 +149,7 @@ const NON_OVERFLOW_PROVIDER_CODES = new Set([
 	"rate_limit_error",
 	"rate_limit_exceeded",
 	"too_many_requests",
+	"empty_response",
 ]);
 
 function transportCodes(transportFailure: TransportFailureFacts | undefined): string[] {
@@ -157,6 +162,53 @@ function hasTypedNonOverflowCode(transportFailure: TransportFailureFacts | undef
 	return transportCodes(transportFailure).some(code => NON_OVERFLOW_PROVIDER_CODES.has(code));
 }
 
+/**
+ * Generic envelope codes that name the HTTP error *category*, not its cause.
+ *
+ * Anthropic reports context overflow through this envelope:
+ *
+ *   {"type":"error","error":{"type":"invalid_request_error",
+ *    "message":"prompt is too long: 1158066 tokens > 1000000 maximum"}}
+ *
+ * Treating the envelope as an authoritative non-overflow cause vetoed the
+ * overflow classification, so auto-compaction never ran and the session died on
+ * the very overflow it was supposed to absorb.
+ *
+ * Unlike {@link NON_OVERFLOW_PROVIDER_CODES} (auth, quota, rate limit), this
+ * envelope names no cause, so it must not veto an overflow the provider stated
+ * quantitatively. It still vetoes free-form prose: only the self-verifying
+ * measured form below can override it.
+ */
+const GENERIC_ENVELOPE_PROVIDER_CODES = new Set(["invalid_request_error"]);
+
+/**
+ * Anthropic's measured overflow report: `<used> tokens > <limit> maximum`.
+ *
+ * Deliberately far narrower than {@link OVERFLOW_PATTERNS}. Those patterns
+ * include loose prose (`too many tokens`, `token limit exceeded`) that a tool
+ * result or a model-authored string can trivially contain, so they must never
+ * be able to flip a typed transport classification. This form carries its own
+ * arithmetic proof and is verified below, so injected text cannot satisfy it
+ * without also asserting a real overage.
+ */
+const ANTHROPIC_MEASURED_OVERFLOW_PATTERN = /prompt is too long:\s*(\d+)\s*tokens?\s*>\s*(\d+)\s*maximum/i;
+
+/**
+ * True only for a provider-measured overflow that verifies against itself:
+ * the reported usage must actually exceed the reported maximum.
+ */
+function hasSelfVerifyingOverflowMeasurement(message: AssistantMessage): boolean {
+	if (message.stopReason !== "error") return false;
+	const errorMessage = message.errorMessage;
+	if (!errorMessage) return false;
+	const match = ANTHROPIC_MEASURED_OVERFLOW_PATTERN.exec(errorMessage);
+	if (!match) return false;
+	const used = Number(match[1]);
+	const maximum = Number(match[2]);
+	if (!Number.isFinite(used) || !Number.isFinite(maximum) || maximum <= 0) return false;
+	return used > maximum;
+}
+
 function isTypedNoBodyOverflow(
 	message: AssistantMessage,
 	transportFailure: TransportFailureFacts | undefined,
@@ -173,7 +225,18 @@ export function classifyContextOverflow(
 	if (transportFailure?.status === 429) return false;
 	const typedCodes = transportCodes(transportFailure);
 	if (typedCodes.some(code => OVERFLOW_PROVIDER_CODES.has(code))) return true;
+	// A specific non-overflow cause (auth, quota, rate limit) is authoritative
+	// and can never be upgraded by error prose.
 	if (hasTypedNonOverflowCode(transportFailure)) return false;
+	// A generic envelope (`invalid_request_error`) names no cause. It still
+	// vetoes free-form overflow prose, but must not veto a provider-measured,
+	// self-verifying overflow report — that is how Anthropic reports overflow.
+	if (
+		typedCodes.some(code => GENERIC_ENVELOPE_PROVIDER_CODES.has(code)) &&
+		!hasSelfVerifyingOverflowMeasurement(message)
+	) {
+		return false;
+	}
 	if (isTypedNoBodyOverflow(message, transportFailure)) return true;
 
 	const errorMessage = message.errorMessage;