@sayknow-cli/ai 0.5.2 → 0.5.8

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [0.5.8] - 2026-09-10
+
+## [0.5.7] - 2026-09-10
+
+### Added
+
+- Bundled `openai-codex/gpt-6-astra` (ported from upstream #5294) so eligible ChatGPT accounts can select GPT-6 Astra without waiting for authenticated Codex discovery. The reviewed snapshot records the 272K prompt budget, 128K output cap, text-and-image input, websocket preference, low-through-max reasoning efforts, freeform `apply_patch`, and standard published pricing ($10/$50, cache read $1, cache write $12.50). Upstream's above-272K pricing tier is intentionally omitted: this fork's cost engine has no long-context tier support, so the field would be dead data. The GPT model-id parser and the generated `apply_patch` policy now recognize the `astra` variant (GPT-6), and the catalog was regenerated, which also picks up the current models.dev snapshot across gateway providers.
+
+### Fixed
+
+- Bumped the advertised Claude Code client version from 2.1.219 to 2.1.267. Anthropic gates newer models (e.g. the 5.1 line) on the advertised client version and rejected requests with HTTP 400 `claude_code_version_too_old` ("version 2.1.251 or newer is required"), so those models were unusable through the Claude Code OAuth path.
+
+## [0.5.3] - 2026-08-28
+
+### Added
+
+- Added first-class oMLX and SGLang OpenAI-compatible local providers. oMLX includes model capability enrichment and macOS profiles; SGLang discovery is credentialless only on normalized loopback origins and supports trusted `SGLANG_BASE_URL`/`SGLANG_API_KEY` configuration.
+### Fixed
+
+- Hardened local OpenAI-compatible discovery with bounded catalogs, redirect refusal, canonical loopback URLs, safe oMLX limits, and explicit-only SGLang login; deprecated `sglang-local` credentials no longer shadow real keys.
+
+- Anthropic's measured `invalid_request_error` prompt-overflow envelope now triggers context compaction only when its reported token usage actually exceeds the reported maximum, while auth, quota, rate-limit, and unverified prose remain authoritative non-overflow failures.
+
 ## [0.7.5] - 2026-06-27
 
 ### Fixed

package/dist/types/model-thinking.d.ts

@@ -27,6 +27,13 @@ export declare function enrichModelThinking<TApi extends Api>(model: ApiModel<TA
  * canonical rules, replacing any existing `thinking`.
  */
 export declare function refreshModelThinking<TApi extends Api>(model: ApiModel<TApi>): ApiModel<TApi>;
+/**
+ * Extract the GLM generation from a Zhipu/ZAI model id: `glm-5.3` and
+ * `glm-5.3-flash` -> 5.3, `glm-5` and `glm-5-turbo` -> 5, `glm-4.7` -> 4.7.
+ * Returns undefined for ids that are not a plain GLM generation, including the
+ * vision line (`glm-5v-turbo`), so those never inherit text-model corrections.
+ */
+export declare function glmGeneration(modelId: string): number | undefined;
 /**
  * Apply upstream metadata corrections to a mutable array of models.
  *

package/dist/types/provider-models/openai-compat.d.ts

@@ -153,6 +153,11 @@ export interface LmStudioModelManagerConfig {
     baseUrl?: string;
 }
 export declare function lmStudioModelManagerOptions(config?: LmStudioModelManagerConfig): ModelManagerOptions<"openai-completions">;
+export interface OmlxModelManagerConfig {
+    apiKey?: string;
+    baseUrl?: string;
+}
+export declare function omlxModelManagerOptions(config?: OmlxModelManagerConfig): ModelManagerOptions<"openai-completions">;
 export interface SyntheticModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;
@@ -210,6 +215,11 @@ export interface VllmModelManagerConfig {
     baseUrl?: string;
 }
 export declare function vllmModelManagerOptions(config?: VllmModelManagerConfig): ModelManagerOptions<"openai-completions">;
+export interface SglangModelManagerConfig {
+    apiKey?: string;
+    baseUrl?: string;
+}
+export declare function sglangModelManagerOptions(config?: SglangModelManagerConfig): ModelManagerOptions<"openai-completions">;
 export interface NanoGptModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;

package/dist/types/providers/anthropic.d.ts

@@ -50,7 +50,7 @@ export declare function isAnthropicThinkingBlockMutationError(error: unknown): b
  * than only the latest one.
  */
 export declare function isAnthropicThinkingSignatureInvalidError(error: unknown): boolean;
-export declare const claudeCodeVersion = "2.1.219";
+export declare const claudeCodeVersion = "2.1.267";
 export declare const claudeCodeEntrypoint = "sdk-cli";
 export declare const claudeToolPrefix: string;
 export declare const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";

package/dist/types/types.d.ts

@@ -51,7 +51,7 @@ export interface ThinkingConfig {
     /** Provider-specific transport used to encode the selected effort. */
     mode: ThinkingControlMode;
 }
-export type KnownProvider = "alibaba-token-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "opengateway" | "bizrouter" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio";
+export type KnownProvider = "alibaba-token-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "opengateway" | "bizrouter" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio" | "omlx" | "sglang";
 export type Provider = KnownProvider | string;
 import type { Effort } from "./model-thinking";
 /** Token budgets for each thinking level (token-based providers only) */
@@ -355,6 +355,12 @@ export interface ToolCall {
      * rejects the call with a retryable error instead.
      */
     incompleteArguments?: boolean;
+    /**
+     * Transient raw JSON for a provider-detected `\uXXXX`-escaped non-ASCII
+     * tool payload. The agent loop validates and removes it before persistence.
+     */
+    escapedNonAsciiArguments?: boolean;
+    escapedNonAsciiArgumentsRaw?: string;
 }
 export interface Usage {
     /** Non-cached input tokens (matches the bucket the provider bills as new input). */

package/dist/types/utils/discovery/openai-compatible.d.ts

@@ -72,3 +72,13 @@ export interface FetchOpenAICompatibleModelsOptions<TApi extends Api> {
  * Returns `[]` only when the endpoint responds successfully with no usable models.
  */
 export declare function fetchOpenAICompatibleModels<TApi extends Api>(options: FetchOpenAICompatibleModelsOptions<TApi>): Promise<Model<TApi>[] | null>;
+/**
+ * Returns a canonical HTTP(S) OpenAI-compatible base URL without embedded URL
+ * credentials, query parameters, or fragments.
+ */
+export declare function resolveCanonicalOpenAIBaseUrl(value: string | undefined): string | undefined;
+/**
+ * Returns a local OpenAI-compatible base URL only when it is an HTTP(S)
+ * loopback endpoint; otherwise returns the trusted fallback.
+ */
+export declare function resolveLoopbackOpenAIBaseUrl(value: string | undefined, fallback: string): string;

package/dist/types/utils/oauth/sglang.d.ts

@@ -0,0 +1,12 @@
+/**
+ * SGLang login flow.
+ *
+ * SGLang commonly exposes an OpenAI-compatible API on a local server. It may
+ * require a bearer token, but local servers commonly allow unauthenticated
+ * access. This flow stores an API-key-style credential for auth storage.
+ */
+import type { OAuthController } from "./types";
+/**
+ * Login to SGLang with an explicit bearer token.
+ */
+export declare function loginSglang(options: OAuthController): Promise<string>;

package/dist/types/utils/oauth/types.d.ts

@@ -7,7 +7,7 @@ export type OAuthCredentials = {
     email?: string;
     accountId?: string;
 };
-export type OAuthProvider = "alibaba-token-plan" | "anthropic" | "bizrouter" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "zai";
+export type OAuthProvider = "alibaba-token-plan" | "anthropic" | "bizrouter" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "sglang" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "zai";
 export type OAuthProviderId = OAuthProvider | (string & {});
 export type OAuthPrompt = {
     message: string;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@sayknow-cli/ai",
-	"version": "0.5.2",
+	"version": "0.5.8",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://sayknow-cli.com",
 	"author": "jaybeyond",
@@ -43,7 +43,7 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@sayknow-cli/utils": "0.5.2",
+		"@sayknow-cli/utils": "0.5.8",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-storage.ts

@@ -37,6 +37,12 @@ import { loginDeepSeek } from "./utils/oauth/deepseek";
 import { loginOpenAICodexDevice } from "./utils/oauth/openai-codex";
 import type { OAuthController, OAuthCredentials, OAuthProvider, OAuthProviderId } from "./utils/oauth/types";
 
+const DEPRECATED_SGLANG_NO_AUTH_TOKEN = "sglang-local";
+
+function isDeprecatedSglangNoAuthToken(provider: string, apiKey: string | undefined): boolean {
+	return provider === "sglang" && apiKey === DEPRECATED_SGLANG_NO_AUTH_TOKEN;
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Credential Types
 // ─────────────────────────────────────────────────────────────────────────────
@@ -1351,6 +1357,11 @@ export class AuthStorage {
 			.filter(
 				(entry): entry is { credential: Extract<AuthCredential, { type: T }>; index: number } =>
 					entry.credential.type === type,
+			)
+			.filter(
+				entry =>
+					type !== "api_key" ||
+					!isDeprecatedSglangNoAuthToken(provider, (entry.credential as ApiKeyCredential).key),
 			);
 
 		if (credentials.length === 0) return undefined;
@@ -1950,6 +1961,12 @@ export class AuthStorage {
 				await saveApiKeyCredential(apiKey);
 				return;
 			}
+			case "sglang": {
+				const { loginSglang } = await import("./utils/oauth/sglang");
+				const apiKey = await loginSglang(ctrl);
+				await saveApiKeyCredential(apiKey);
+				return;
+			}
 			case "parallel": {
 				const { loginParallel } = await import("./utils/oauth/parallel");
 				const apiKey = await loginParallel(ctrl);
@@ -3434,7 +3451,8 @@ export class AuthStorage {
 
 		const apiKeySelection = this.#selectCredentialByType(provider, "api_key");
 		if (apiKeySelection) {
-			return this.#configValueResolver(apiKeySelection.credential.key);
+			const apiKey = await this.#configValueResolver(apiKeySelection.credential.key);
+			if (!isDeprecatedSglangNoAuthToken(provider, apiKey)) return apiKey;
 		}
 
 		// Return current OAuth access token only if it is not already expired.
@@ -3487,16 +3505,24 @@ export class AuthStorage {
 			return configKey;
 		}
 
+		let skippedDeprecatedNoAuthToken = false;
 		if (selectedCredential?.credential.type === "api_key") {
-			this.#recordSessionCredential(provider, sessionId, "api_key", selectedCredential.index);
-			return this.#configValueResolver(selectedCredential.credential.key);
+			const apiKey = await this.#configValueResolver(selectedCredential.credential.key);
+			if (!isDeprecatedSglangNoAuthToken(provider, apiKey)) {
+				this.#recordSessionCredential(provider, sessionId, "api_key", selectedCredential.index);
+				return apiKey;
+			}
+			skippedDeprecatedNoAuthToken = true;
 		}
 
-		if (!selectedCredential) {
+		if (!selectedCredential || skippedDeprecatedNoAuthToken) {
 			const apiKeySelection = this.#selectCredentialByType(provider, "api_key", sessionId);
 			if (apiKeySelection) {
-				this.#recordSessionCredential(provider, sessionId, "api_key", apiKeySelection.index);
-				return this.#configValueResolver(apiKeySelection.credential.key);
+				const apiKey = await this.#configValueResolver(apiKeySelection.credential.key);
+				if (!isDeprecatedSglangNoAuthToken(provider, apiKey)) {
+					this.#recordSessionCredential(provider, sessionId, "api_key", apiKeySelection.index);
+					return apiKey;
+				}
 			}
 		}
 

package/src/model-thinking.ts

@@ -64,6 +64,7 @@ type SemVer = {
 type GeminiKind = "pro" | "flash";
 type AnthropicKind = "opus" | "sonnet" | "fable";
 type OpenAIVariant =
+	| "astra"
 	| "base"
 	| "codex"
 	| "codex-max"
@@ -190,6 +191,24 @@ export function refreshModelThinking<TApi extends Api>(model: ApiModel<TApi>): A
 	return { ...model, thinking: inferModelThinking(model) };
 }
 
+/**
+ * Extract the GLM generation from a Zhipu/ZAI model id: `glm-5.3` and
+ * `glm-5.3-flash` -> 5.3, `glm-5` and `glm-5-turbo` -> 5, `glm-4.7` -> 4.7.
+ * Returns undefined for ids that are not a plain GLM generation, including the
+ * vision line (`glm-5v-turbo`), so those never inherit text-model corrections.
+ */
+export function glmGeneration(modelId: string): number | undefined {
+	const match = modelId.toLowerCase().match(/^glm-(\d+)(?:\.(\d+))?(?![\d.v])/);
+	if (!match) return undefined;
+	const [, major, minor] = match;
+	return minor === undefined ? Number(major) : Number(`${major}.${minor}`);
+}
+
+function glmGenerationAtLeast(modelId: string, minimum: number): boolean {
+	const generation = glmGeneration(modelId);
+	return generation !== undefined && generation >= minimum;
+}
+
 /**
  * Apply upstream metadata corrections to a mutable array of models.
  *
@@ -198,7 +217,11 @@ export function refreshModelThinking<TApi extends Api>(model: ApiModel<TApi>): A
  */
 export function applyGeneratedModelPolicies(models: ApiModel<Api>[]): void {
 	for (let index = 0; index < models.length; index++) {
-		const model = refreshModelThinking(models[index]!);
+		const source = models[index]!;
+		if (source.provider === "omlx") {
+			source.reasoning = true;
+		}
+		const model = refreshModelThinking(source);
 		applyGeneratedModelPolicy(model);
 		models[index] = model;
 	}
@@ -377,6 +400,16 @@ function applyGeneratedModelPolicy(model: ApiModel<Api>): void {
 		};
 		delete model.compat.thinkingFormat;
 	}
+	if (model.provider === "omlx" && model.api === "openai-completions") {
+		model.compat = {
+			...(model.compat ?? {}),
+			supportsStore: false,
+			supportsDeveloperRole: false,
+			supportsReasoningEffort: true,
+			thinkingFormat: "qwen-chat-template",
+			reasoningContentField: "reasoning_content",
+		};
+	}
 	model.name = scrubGeneratedModelName(model.name);
 	if (
 		model.api === "openai-completions" &&
@@ -411,13 +444,31 @@ function applyGeneratedModelPolicy(model: ApiModel<Api>): void {
 	if (parsedModel.family === "openai") {
 		applyOpenAICatalogPolicy(model, parsedModel);
 	}
-	// GLM-5.2 (Zhipu/ZAI): ships a 1M lossless context window, but the bundled
-	// catalog copied GLM-5.1's 200K and that stale value survives generate-models
-	// (provider-scoped models bypass the models.dev refresh in applyGlobalModelsDevFallback).
-	// Pin to the true 1M so context-cap / auto-compaction thresholds aren't tripped ~5x early.
-	if (model.provider === "zai" && model.id === "glm-5.2") {
+	// GLM-5.2 and newer (Zhipu/ZAI): ship a 1M lossless context window, but the
+	// bundled catalog copied GLM-5.1's 200K and that stale value survives
+	// generate-models (provider-scoped models bypass the models.dev refresh in
+	// applyGlobalModelsDevFallback). Pin the true 1M so context-cap /
+	// auto-compaction thresholds aren't tripped ~5x early.
+	//
+	// Matched by generation rather than by exact id so the next GLM point
+	// release inherits the correct window instead of silently regressing to
+	// whatever the catalog happens to carry. The correction only raises a
+	// stale-low window: a future generation that genuinely ships more than 1M
+	// keeps its larger catalog value instead of being clamped down to 1M.
+	if (model.provider === "zai" && glmGenerationAtLeast(model.id, 5.2) && model.contextWindow < 1_000_000) {
 		model.contextWindow = 1_000_000;
 	}
+	// Alibaba Token Plan's qwen3.8-max-preview is routed through the OpenAI
+	// Responses API. models.dev recently started publishing the whole
+	// alibaba-token-plan provider, and its blanket chat-completions mapping wins
+	// the generate-models merge, so a regeneration silently reroutes this one
+	// paid model. Pin the routing that ships today and is covered by
+	// register-builtins' Responses lazy-path watchdog until the endpoint is
+	// re-verified; the catalog's other metadata (vision input, 131K output cap)
+	// is still inherited.
+	if (model.provider === "alibaba-token-plan" && model.id === "qwen3.8-max-preview") {
+		model.api = "openai-responses" as typeof model.api;
+	}
 	// MiniMax-M3: MiniMax exposes a 1M context tier, but usage beyond 512K is
 	// billed separately. Keep bundled/default metadata at the billing-safe 512K
 	// unless an explicit paid-tier contract is added.
@@ -454,7 +505,10 @@ function inferGeneratedApplyPatchToolType(
 	model: ApiModel<Api>,
 	parsedModel: ParsedModel,
 ): ApiModel<Api>["applyPatchToolType"] {
-	if (parsedModel.family !== "openai" || parsedModel.version.major !== 5) {
+	if (
+		parsedModel.family !== "openai" ||
+		(parsedModel.version.major !== 5 && !(parsedModel.version.major === 6 && parsedModel.variant === "astra"))
+	) {
 		return undefined;
 	}
 	if (model.provider === "openai" && model.api === "openai-responses") {
@@ -527,6 +581,9 @@ function inferDefaultEffort<TApi extends Api>(model: ApiModel<TApi>, parsedModel
 	) {
 		return GPT_5_5_DEFAULT_EFFORT;
 	}
+	if (model.provider === "omlx") {
+		return Effort.Medium;
+	}
 	return undefined;
 }
 
@@ -662,6 +719,9 @@ function inferFallbackEfforts<TApi extends Api>(model: ApiModel<TApi>): readonly
 		return DEFAULT_REASONING_EFFORTS;
 	}
 	if (model.api === "openai-completions") {
+		if (model.provider === "omlx") {
+			return [Effort.Low, Effort.Medium, Effort.High];
+		}
 		const compat = resolveOpenAICompat(model as ApiModel<"openai-completions">);
 		if (compat.thinkingFormat === "openai" && compat.supportsReasoningEffort) {
 			return DEFAULT_REASONING_EFFORTS_WITH_XHIGH;
@@ -758,7 +818,7 @@ function parseAnthropicModel(modelId: string): AnthropicModel | null {
 
 function parseOpenAIModel(modelId: string): OpenAIModel | null {
 	const match =
-		/gpt-(\d+(?:\.\d+){0,2})(?:-(codex-spark|codex-mini|codex-max|codex|luna|mini|max|nano|sol|terra))?$/.exec(
+		/gpt-(\d+(?:\.\d+){0,2})(?:-(astra|codex-spark|codex-mini|codex-max|codex|luna|mini|max|nano|sol|terra))?$/.exec(
 			modelId,
 		);
 	if (!match) {