@sayknow-cli/ai 0.5.2 → 0.5.8

package/src/provider-models/descriptors.ts

@@ -31,6 +31,7 @@ import {
 	nanoGptModelManagerOptions,
 	nvidiaModelManagerOptions,
 	ollamaModelManagerOptions,
+	omlxModelManagerOptions,
 	openaiModelManagerOptions,
 	opencodeGoModelManagerOptions,
 	opencodeZenModelManagerOptions,
@@ -38,6 +39,7 @@ import {
 	openrouterModelManagerOptions,
 	qianfanModelManagerOptions,
 	qwenPortalModelManagerOptions,
+	sglangModelManagerOptions,
 	syntheticModelManagerOptions,
 	togetherModelManagerOptions,
 	veniceModelManagerOptions,
@@ -260,12 +262,22 @@ export const PROVIDER_DESCRIPTORS: readonly ProviderDescriptor[] = [
 		catalog("LiteLLM", ["LITELLM_API_KEY"], { allowUnauthenticated: true }),
 	),
 	descriptor("lm-studio", "llama-3-8b", config => lmStudioModelManagerOptions(config), { allowUnauthenticated: true }),
+	descriptor("omlx", "Qwen3.5-122B-A10B-Q4", config => omlxModelManagerOptions(config), {
+		allowUnauthenticated: true,
+	}),
 	catalogDescriptor(
 		"vllm",
 		"gpt-oss-20b",
 		config => vllmModelManagerOptions(config),
 		catalog("vLLM", ["VLLM_API_KEY"], { allowUnauthenticated: true }),
 	),
+	catalogDescriptor(
+		"sglang",
+		"gpt-oss-20b",
+		config => sglangModelManagerOptions(config),
+		catalog("SGLang", ["SGLANG_API_KEY"], { allowUnauthenticated: true }),
+		{ allowUnauthenticated: true },
+	),
 	catalogDescriptor(
 		"moonshot",
 		"kimi-k2.5",
@@ -326,7 +338,7 @@ export const PROVIDER_DESCRIPTORS: readonly ProviderDescriptor[] = [
 		config => bizrouterModelManagerOptions(config),
 		catalog("BizRouter", ["BIZROUTER_API_KEY"]),
 	),
-	catalogDescriptor("zai", "glm-5.2", config => zaiModelManagerOptions(config), catalog("zAI", ["ZAI_API_KEY"])),
+	catalogDescriptor("zai", "glm-5.3", config => zaiModelManagerOptions(config), catalog("zAI", ["ZAI_API_KEY"])),
 	catalogDescriptor(
 		"glm-zcode",
 		"glm-5.2",

package/src/provider-models/openai-compat.ts

@@ -8,6 +8,8 @@ import {
 	fetchOpenAICompatibleModels,
 	type OpenAICompatibleModelMapperContext,
 	type OpenAICompatibleModelRecord,
+	resolveCanonicalOpenAIBaseUrl,
+	resolveLoopbackOpenAIBaseUrl,
 } from "../utils/discovery/openai-compatible";
 import { toFireworksPublicModelId } from "../utils/fireworks-model-id";
 import { getGitHubCopilotBaseUrl, OPENCODE_HEADERS, parseGitHubCopilotApiKey } from "../utils/oauth/github-copilot";
@@ -197,6 +199,18 @@ function firstPositiveModelNumber(fallback: number, ...candidates: readonly unkn
 	return fallback;
 }
 
+function safePositiveInteger(value: unknown): number | undefined {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
+}
+
+function firstPositiveSafeInteger(fallback: number, ...candidates: readonly unknown[]): number {
+	for (const candidate of candidates) {
+		const value = safePositiveInteger(candidate);
+		if (value !== undefined) return value;
+	}
+	return fallback;
+}
+
 function mapLmStudioModel(
 	entry: OpenAICompatibleModelRecord,
 	defaults: Model<"openai-completions">,
@@ -226,6 +240,52 @@ function mapLmStudioModel(
 		),
 	};
 }
+function mapOmlxModel(
+	entry: OpenAICompatibleModelRecord,
+	defaults: Model<"openai-completions">,
+	reference: Model<"openai-completions"> | undefined,
+): Model<"openai-completions"> {
+	const model = mapWithBundledReference(entry, defaults, reference);
+	return {
+		...model,
+		reasoning: true,
+		thinking: {
+			mode: "effort",
+			minLevel: Effort.Low,
+			maxLevel: Effort.High,
+			defaultLevel: Effort.Medium,
+			levels: [Effort.Low, Effort.Medium, Effort.High],
+		},
+		compat: {
+			...(model.compat ?? {}),
+			supportsStore: false,
+			supportsDeveloperRole: false,
+			supportsReasoningEffort: true,
+			thinkingFormat: "qwen-chat-template",
+			reasoningContentField: "reasoning_content",
+		},
+		contextWindow: firstPositiveSafeInteger(
+			model.contextWindow,
+			safePositiveInteger(entry.max_model_len),
+			entry.context_length,
+			entry.max_context_length,
+			getNestedModelValue(entry, ["meta", "n_ctx"]),
+			getNestedModelValue(entry, ["details", "context_length"]),
+			getNestedModelValue(entry, ["details", "n_ctx"]),
+			getNestedModelValue(entry, ["meta", "n_ctx_train"]),
+		),
+		maxTokens: firstPositiveSafeInteger(
+			model.maxTokens,
+			entry.max_completion_tokens,
+			entry.max_tokens,
+			entry.max_output_tokens,
+			getNestedModelValue(entry, ["details", "max_completion_tokens"]),
+			getNestedModelValue(entry, ["details", "max_tokens"]),
+			getNestedModelValue(entry, ["meta", "max_completion_tokens"]),
+			getNestedModelValue(entry, ["meta", "max_tokens"]),
+		),
+	};
+}
 
 function normalizeAnthropicBaseUrl(baseUrl: string | undefined, fallback: string): string {
 	const value = baseUrl?.trim();
@@ -1381,6 +1441,42 @@ export function lmStudioModelManagerOptions(
 			}),
 	};
 }
+// ---------------------------------------------------------------------------
+// 12.6. oMLX (Apple Silicon MLX Local Server)
+// ---------------------------------------------------------------------------
+
+export interface OmlxModelManagerConfig {
+	apiKey?: string;
+	baseUrl?: string;
+}
+
+export function omlxModelManagerOptions(config?: OmlxModelManagerConfig): ModelManagerOptions<"openai-completions"> {
+	const apiKey = config?.apiKey;
+	const baseUrl = resolveLoopbackOpenAIBaseUrl(
+		config?.baseUrl ?? $credentialEnv("OMLX_BASE_URL"),
+		"http://127.0.0.1:8080/v1",
+	);
+	const references = createBundledReferenceMap<"openai-completions">("omlx" as Parameters<typeof getBundledModels>[0]);
+	return {
+		providerId: "omlx",
+		fetchDynamicModels: () =>
+			fetchOpenAICompatibleModels({
+				api: "openai-completions",
+				provider: "omlx",
+				baseUrl,
+				apiKey,
+				fetch: (input, init) =>
+					fetch(input, {
+						...init,
+						redirect: "error",
+						signal: init?.signal
+							? AbortSignal.any([init.signal, AbortSignal.timeout(500)])
+							: AbortSignal.timeout(500),
+					}),
+				mapModel: (entry, defaults) => mapOmlxModel(entry, defaults, references.get(defaults.id)),
+			}),
+	};
+}
 
 // ---------------------------------------------------------------------------
 // 13. Synthetic
@@ -1735,6 +1831,62 @@ export function vllmModelManagerOptions(config?: VllmModelManagerConfig): ModelM
 			}),
 	};
 }
+// ---------------------------------------------------------------------------
+// 22.5. SGLang
+// ---------------------------------------------------------------------------
+
+export interface SglangModelManagerConfig {
+	apiKey?: string;
+	baseUrl?: string;
+}
+
+export function sglangModelManagerOptions(
+	config?: SglangModelManagerConfig,
+): ModelManagerOptions<"openai-completions"> {
+	const apiKey = config?.apiKey;
+	const configuredBaseUrl = config?.baseUrl ?? $credentialEnv("SGLANG_BASE_URL");
+	const baseUrl =
+		resolveCanonicalOpenAIBaseUrl(configuredBaseUrl) ?? (config?.baseUrl ? "" : "http://127.0.0.1:30000/v1");
+	const isLoopback = baseUrl.length > 0 && resolveLoopbackOpenAIBaseUrl(baseUrl, "") === baseUrl;
+	const references = createBundledReferenceMap<"openai-completions">(
+		"sglang" as Parameters<typeof getBundledModels>[0],
+	);
+	return {
+		providerId: "sglang",
+		...(baseUrl && (apiKey || isLoopback)
+			? {
+					fetchDynamicModels: () =>
+						fetchOpenAICompatibleModels({
+							api: "openai-completions",
+							provider: "sglang",
+							baseUrl,
+							apiKey,
+							fetch: (input, init) =>
+								fetch(input, {
+									...init,
+									redirect: "error",
+									signal: isLoopback
+										? init?.signal
+											? AbortSignal.any([init.signal, AbortSignal.timeout(500)])
+											: AbortSignal.timeout(500)
+										: init?.signal,
+								}),
+							mapModel: (entry, defaults) => {
+								const model = mapWithBundledReference(entry, defaults, references.get(defaults.id));
+								const contextWindow = toNumber(entry.max_model_len);
+								return {
+									...model,
+									contextWindow:
+										contextWindow !== undefined && Number.isSafeInteger(contextWindow) && contextWindow > 0
+											? contextWindow
+											: model.contextWindow,
+								};
+							},
+						}),
+				}
+			: {}),
+	};
+}
 
 // ---------------------------------------------------------------------------
 // 23. NanoGPT

package/src/providers/anthropic.ts

@@ -491,7 +491,7 @@ function getCacheControl(
 }
 
 // Stealth mode: Mimic Anthropic Code headers and tool prefixing.
-export const claudeCodeVersion = "2.1.219";
+export const claudeCodeVersion = "2.1.267";
 export const claudeCodeEntrypoint = "sdk-cli";
 export const claudeToolPrefix: string = "proxy_";
 export const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
@@ -1668,6 +1668,17 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 							if (block) {
 								blocksByAnthropicIndex.delete(event.index);
 								delete (block as { index?: number }).index;
+								if (block.type === "toolCall" && /\\u[0-9a-fA-F]{4}/.test(block.partialJson)) {
+									const escapedCodeUnits = [...block.partialJson.matchAll(/\\u([0-9a-fA-F]{4})/g)].map(match =>
+										Number.parseInt(match[1]!, 16),
+									);
+									if (escapedCodeUnits.some(codeUnit => codeUnit >= 0x80)) {
+										Object.defineProperties(block, {
+											escapedNonAsciiArguments: { value: true, configurable: true },
+											escapedNonAsciiArgumentsRaw: { value: block.partialJson, configurable: true },
+										});
+									}
+								}
 								if (block.type === "text") {
 									stream.push({
 										type: "text_end",

package/src/providers/openai-completions.ts

@@ -38,6 +38,7 @@ import {
 import { normalizeSystemPrompts, sanitizeJsonStrings } from "../utils";
 import { createAbortSourceTracker } from "../utils/abort";
 import { AssistantMessageEventStream } from "../utils/event-stream";
+import { transportFailureFacts } from "../utils/fallback-transport";
 import { toFirepassWireModelId, toFireworksWireModelId } from "../utils/fireworks-model-id";
 import {
 	type CapturedHttpErrorResponse,
@@ -465,7 +466,7 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 				options?.fetch,
 				options?.streamFirstEventTimeoutMs,
 				options?.authCredentialType,
-				options?.requestMaxRetries,
+				options?.fallbackManaged ? 0 : options?.requestMaxRetries,
 				options?.sessionId,
 			);
 			const premiumRequestsTotal = copilotPremiumRequests;
@@ -500,7 +501,10 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 					body: params,
 				};
 				const { data, response, request_id } = await client.chat.completions
-					.create(params as OpenAI.Chat.Completions.ChatCompletionCreateParamsStreaming, { signal: requestSignal })
+					.create(params as OpenAI.Chat.Completions.ChatCompletionCreateParamsStreaming, {
+						signal: requestSignal,
+						...(options?.fallbackManaged ? { maxRetries: 0 } : {}),
+					})
 					.withResponse();
 				await notifyProviderResponse(options, response, model, request_id);
 				return data;
@@ -510,6 +514,7 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 				openaiStream = await callWithCopilotModelRetry(() => createCompletionsStream(), {
 					provider: model.provider,
 					signal: requestSignal,
+					fallbackManaged: options?.fallbackManaged,
 				});
 			} catch (error) {
 				const capturedErrorResponse = getCapturedErrorResponse();
@@ -766,13 +771,25 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 
 				if (choice.finish_reason) {
 					const finishReasonResult = mapStopReason(choice.finish_reason);
-					output.stopReason = finishReasonResult.stopReason;
-					if (finishReasonResult.errorMessage) {
-						output.errorMessage = finishReasonResult.errorMessage;
+					if (choice.finish_reason === "content_filter") {
+						output.errorKind = "provider_safety_stop";
+					}
+					if (output.errorKind !== "provider_safety_stop" || choice.finish_reason === "content_filter") {
+						output.stopReason = finishReasonResult.stopReason;
+						if (finishReasonResult.errorMessage) {
+							output.errorMessage = finishReasonResult.errorMessage;
+						}
 					}
 				}
 
 				if (choice.delta) {
+					const refusal = choice.delta.refusal;
+					if (typeof refusal === "string" && refusal.length > 0) {
+						output.errorKind = "provider_safety_stop";
+						output.stopReason = "error";
+						output.errorMessage = "Provider refusal";
+						appendTextDelta(refusal);
+					}
 					const normalizedDeltaText = normalizeStreamingContentText(choice.delta.content);
 					if (normalizedDeltaText.length > 0) {
 						if (!firstTokenTime) firstTokenTime = Date.now();
@@ -944,13 +961,19 @@ export const streamOpenAICompletions: StreamFunction<"openai-completions"> = (
 			const firstEventTimeoutError = abortTracker.getLocalAbortReason();
 			output.stopReason = abortTracker.wasCallerAbort() ? "aborted" : "error";
 			output.errorStatus = extractHttpStatusFromError(error) ?? getCapturedErrorResponse?.()?.status;
-			output.errorMessage =
-				firstEventTimeoutError?.message ??
-				(await finalizeErrorMessage(error, rawRequestDump, getCapturedErrorResponse?.()));
-			// Some providers via OpenRouter include extra details here.
-			const rawMetadata = (error as { error?: { metadata?: { raw?: string } } })?.error?.metadata?.raw;
-			if (rawMetadata) output.errorMessage += `\n${rawMetadata}`;
-			output.errorMessage = rewriteCopilotError(output.errorMessage, error, model.provider);
+			output.transportFailure = transportFailureFacts(error);
+			if (isOpenAICompletionsSafetyStop(error, getCapturedErrorResponse?.())) {
+				output.errorKind = "provider_safety_stop";
+			}
+			if (output.errorKind !== "provider_safety_stop" || !output.errorMessage) {
+				output.errorMessage =
+					firstEventTimeoutError?.message ??
+					(await finalizeErrorMessage(error, rawRequestDump, getCapturedErrorResponse?.()));
+				// Some providers via OpenRouter include extra details here.
+				const rawMetadata = (error as { error?: { metadata?: { raw?: string } } })?.error?.metadata?.raw;
+				if (rawMetadata) output.errorMessage += `\n${rawMetadata}`;
+				output.errorMessage = rewriteCopilotError(output.errorMessage, error, model.provider);
+			}
 			output.duration = Date.now() - startTime;
 			if (firstTokenTime) output.ttft = firstTokenTime - startTime;
 			stream.push({ type: "error", reason: output.stopReason, error: output });
@@ -1264,8 +1287,12 @@ function buildParams(
 		// Qwen uses top-level enable_thinking: boolean
 		params.enable_thinking = !!options?.reasoning && !options?.disableReasoning;
 	} else if (supportsReasoningParams && compat.thinkingFormat === "qwen-chat-template" && model.reasoning) {
+		const enableThinking = !!options?.reasoning && !options?.disableReasoning;
 		params.chat_template_kwargs = {
-			enable_thinking: !!options?.reasoning && !options?.disableReasoning,
+			enable_thinking: enableThinking,
+			...(enableThinking && options?.reasoning
+				? { reasoning_effort: mapReasoningEffort(options.reasoning, compat.reasoningEffortMap) }
+				: {}),
 		};
 	} else if (supportsReasoningParams && compat.thinkingFormat === "openrouter" && model.reasoning) {
 		// OpenRouter normalizes reasoning across providers via a nested reasoning object.
@@ -1926,7 +1953,22 @@ function shouldRetryWithoutStrictTools(
 		.join("\n");
 	return /wrong_api_format|mixed values for 'strict'|tool[s]?\b.*strict|\bstrict\b.*tool/i.test(messageParts);
 }
-
+function isOpenAICompletionsSafetyStop(
+	error: unknown,
+	capturedErrorResponse: CapturedHttpErrorResponse | undefined,
+): boolean {
+	const hasContentFilterCode = (value: unknown): boolean =>
+		typeof value === "string" && value.toLowerCase() === "content_filter";
+	const errorRecord = error as { code?: unknown; error?: { code?: unknown } } | undefined;
+	if (hasContentFilterCode(errorRecord?.code) || hasContentFilterCode(errorRecord?.error?.code)) return true;
+	if (!capturedErrorResponse?.bodyText) return false;
+	try {
+		const body = JSON.parse(capturedErrorResponse.bodyText) as { code?: unknown; error?: { code?: unknown } };
+		return hasContentFilterCode(body.code) || hasContentFilterCode(body.error?.code);
+	} catch {
+		return false;
+	}
+}
 function mapStopReason(reason: ChatCompletionChunk.Choice["finish_reason"] | string): {
 	stopReason: StopReason;
 	errorMessage?: string;

package/src/stream.ts

@@ -11,6 +11,11 @@ import {
 } from "./model-thinking";
 import type { BedrockOptions } from "./providers/amazon-bedrock";
 import type { AnthropicOptions } from "./providers/anthropic";
+import {
+	hasResolvableAwsProfileSource,
+	isValidBedrockBearerToken,
+	readAwsStaticEnvironmentCredentials,
+} from "./providers/aws-credential-config";
 import type { CursorOptions } from "./providers/cursor";
 import { isGitLabDuoModel, streamGitLabDuo } from "./providers/gitlab-duo";
 import type { GoogleOptions } from "./providers/google";
@@ -129,28 +134,12 @@ const serviceProviderMap: Record<string, KeyResolver> = {
 			return "<authenticated>";
 		}
 	},
-	// Amazon Bedrock supports multiple credential sources:
-	// 1. AWS_PROFILE - named profile from ~/.aws/credentials
-	// 2. AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY - standard IAM keys
-	// 3. AWS_BEARER_TOKEN_BEDROCK - Bedrock API keys (bearer token)
-	// 4. AWS_CONTAINER_CREDENTIALS_* - ECS/Task IAM role credentials
-	// 5. AWS_WEB_IDENTITY_TOKEN_FILE + AWS_ROLE_ARN - IRSA (EKS) web identity
+	// Amazon Bedrock is advertised only when a credential source can be
+	// resolved locally without probing network metadata providers.
 	"amazon-bedrock": () => {
-		const awsProfile = $credentialEnv("AWS_PROFILE");
-		const awsAccessKeyId = $credentialEnv("AWS_ACCESS_KEY_ID");
-		const awsSecretAccessKey = $credentialEnv("AWS_SECRET_ACCESS_KEY");
 		const awsBearerToken = $credentialEnv("AWS_BEARER_TOKEN_BEDROCK");
-		const hasEcsCredentials =
-			!!$credentialEnv("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI") ||
-			!!$credentialEnv("AWS_CONTAINER_CREDENTIALS_FULL_URI");
-		const hasWebIdentity = !!$credentialEnv("AWS_WEB_IDENTITY_TOKEN_FILE") && !!$credentialEnv("AWS_ROLE_ARN");
-		if (
-			awsProfile ||
-			(awsAccessKeyId && awsSecretAccessKey) ||
-			awsBearerToken ||
-			hasEcsCredentials ||
-			hasWebIdentity
-		) {
+		if (awsBearerToken !== undefined && !isValidBedrockBearerToken(awsBearerToken)) return undefined;
+		if (awsBearerToken || readAwsStaticEnvironmentCredentials() || hasResolvableAwsProfileSource()) {
 			return "<authenticated>";
 		}
 	},
@@ -173,6 +162,8 @@ const serviceProviderMap: Record<string, KeyResolver> = {
 	bizrouter: "BIZROUTER_API_KEY",
 	venice: "VENICE_API_KEY",
 	vllm: "VLLM_API_KEY",
+	omlx: "OMLX_API_KEY",
+	sglang: "SGLANG_API_KEY",
 	xiaomi: "XIAOMI_API_KEY",
 };
 
@@ -371,7 +362,8 @@ export function streamSimple<TApi extends Api>(
 	context: Context,
 	options?: SimpleStreamOptions,
 ): AssistantMessageEventStream {
-	const retryApiKey = options?.onAuthError ? (options.apiKey ?? getEnvApiKey(model.provider)) : undefined;
+	const retryApiKey =
+		!options?.fallbackManaged && options?.onAuthError ? (options.apiKey ?? getEnvApiKey(model.provider)) : undefined;
 	if (retryApiKey) {
 		const outer = new AssistantMessageEventStream();
 		const onAuthError = options!.onAuthError!;
@@ -632,6 +624,8 @@ function mapOptionsForApi<TApi extends Api>(
 		maxRetryDelayMs: options?.maxRetryDelayMs,
 		requestMaxRetries: options?.requestMaxRetries,
 		streamMaxRetries: options?.streamMaxRetries,
+		fallbackManaged: options?.fallbackManaged,
+		fallbackAttempt: options?.fallbackAttempt,
 		metadata: options?.metadata,
 		sessionId: options?.sessionId,
 		providerSessionState: options?.providerSessionState,

package/src/types.ts

@@ -168,7 +168,9 @@ export type KnownProvider =
 	| "xiaomi-token-plan-ams"
 	| "xiaomi-token-plan-cn"
 	| "zenmux"
-	| "lm-studio";
+	| "lm-studio"
+	| "omlx"
+	| "sglang";
 export type Provider = KnownProvider | string;
 
 import type { Effort } from "./model-thinking";
@@ -529,6 +531,12 @@ export interface ToolCall {
 	 * rejects the call with a retryable error instead.
 	 */
 	incompleteArguments?: boolean;
+	/**
+	 * Transient raw JSON for a provider-detected `\uXXXX`-escaped non-ASCII
+	 * tool payload. The agent loop validates and removes it before persistence.
+	 */
+	escapedNonAsciiArguments?: boolean;
+	escapedNonAsciiArgumentsRaw?: string;
 }
 
 export interface Usage {

package/src/utils/discovery/openai-compatible.ts

@@ -1,8 +1,43 @@
+import * as net from "node:net";
 import { UNK_CONTEXT_WINDOW, UNK_MAX_TOKENS } from "@sayknow-cli/ai";
 import * as z from "zod/v4";
 import type { Api, FetchImpl, Model, Provider } from "../../types";
 
 const MODELS_PATH = "/models";
+const MAX_MODELS_RESPONSE_BYTES = 1_000_000;
+function parseIpv6Hextets(host: string): number[] | undefined {
+	if (net.isIP(host) !== 6) return undefined;
+	const doubleColon = host.indexOf("::");
+	if (doubleColon !== host.lastIndexOf("::")) return undefined;
+	const parseSide = (value: string): number[] | undefined => {
+		if (!value) return [];
+		const parts = value.split(":");
+		if (parts.some(part => !/^[0-9a-f]{1,4}$/i.test(part))) return undefined;
+		return parts.map(part => Number.parseInt(part, 16));
+	};
+	if (doubleColon < 0) {
+		const hextets = parseSide(host);
+		return hextets?.length === 8 ? hextets : undefined;
+	}
+	const left = parseSide(host.slice(0, doubleColon));
+	const right = parseSide(host.slice(doubleColon + 2));
+	if (!left || !right) return undefined;
+	const missing = 8 - left.length - right.length;
+	if (missing < 1) return undefined;
+	return [...left, ...new Array<number>(missing).fill(0), ...right];
+}
+
+function isLoopbackHost(hostname: string): boolean {
+	const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+	if (host === "localhost") return true;
+	if (net.isIP(host) === 4) return host.split(".", 1)[0] === "127";
+	const hextets = parseIpv6Hextets(host);
+	if (!hextets) return false;
+	const isIpv6Loopback = hextets.slice(0, 7).every(part => part === 0) && hextets[7] === 1;
+	const isIpv4MappedLoopback =
+		hextets.slice(0, 5).every(part => part === 0) && hextets[5] === 0xffff && hextets[6]! >> 8 === 0x7f;
+	return isIpv6Loopback || isIpv4MappedLoopback;
+}
 
 /**
  * Minimal OpenAI-style model entry shape consumed by discovery.
@@ -128,7 +163,9 @@ export async function fetchOpenAICompatibleModels<TApi extends Api>(
 		response = await fetchImpl(`${baseUrl}${MODELS_PATH}`, {
 			method: "GET",
 			headers: requestHeaders,
-			signal: options.signal,
+			signal: options.signal
+				? AbortSignal.any([options.signal, AbortSignal.timeout(5_000)])
+				: AbortSignal.timeout(5_000),
 		});
 	} catch {
 		return null;
@@ -144,7 +181,7 @@ export async function fetchOpenAICompatibleModels<TApi extends Api>(
 
 	let payload: unknown;
 	try {
-		payload = await response.json();
+		payload = JSON.parse(await readModelsResponse(response));
 	} catch {
 		return null;
 	}
@@ -188,6 +225,39 @@ export async function fetchOpenAICompatibleModels<TApi extends Api>(
 	return Array.from(deduped.values()).sort((left, right) => left.id.localeCompare(right.id));
 }
 
+async function readModelsResponse(response: Response): Promise<string> {
+	const contentLength = Number(response.headers.get("content-length"));
+	if (Number.isFinite(contentLength) && contentLength > MAX_MODELS_RESPONSE_BYTES) {
+		throw new Error("OpenAI-compatible models response exceeds the size limit");
+	}
+	if (!response.body) return "";
+	const reader = response.body.getReader();
+	const chunks: Uint8Array[] = [];
+	let total = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (!value) continue;
+			total += value.byteLength;
+			if (total > MAX_MODELS_RESPONSE_BYTES) {
+				await reader.cancel();
+				throw new Error("OpenAI-compatible models response exceeds the size limit");
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const body = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		body.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return new TextDecoder().decode(body);
+}
+
 function normalizeBaseUrl(baseUrl: string): string {
 	const trimmed = baseUrl.trim();
 	if (!trimmed) {
@@ -195,6 +265,40 @@ function normalizeBaseUrl(baseUrl: string): string {
 	}
 	return trimmed.endsWith("/") ? trimmed.slice(0, -1) : trimmed;
 }
+/**
+ * Returns a canonical HTTP(S) OpenAI-compatible base URL without embedded URL
+ * credentials, query parameters, or fragments.
+ */
+export function resolveCanonicalOpenAIBaseUrl(value: string | undefined): string | undefined {
+	const candidate = value?.trim();
+	if (!candidate) return undefined;
+	try {
+		const parsed = new URL(candidate);
+		if (
+			(parsed.protocol === "http:" || parsed.protocol === "https:") &&
+			!parsed.username &&
+			!parsed.password &&
+			!parsed.search &&
+			!parsed.hash
+		) {
+			return candidate;
+		}
+	} catch {
+		// Invalid endpoint.
+	}
+	return undefined;
+}
+
+/**
+ * Returns a local OpenAI-compatible base URL only when it is an HTTP(S)
+ * loopback endpoint; otherwise returns the trusted fallback.
+ */
+export function resolveLoopbackOpenAIBaseUrl(value: string | undefined, fallback: string): string {
+	const candidate = resolveCanonicalOpenAIBaseUrl(value);
+	if (!candidate) return fallback;
+	const parsed = new URL(candidate);
+	return isLoopbackHost(parsed.hostname) ? candidate : fallback;
+}
 
 function extractModelEntries(payload: unknown): ParsedOpenAICompatibleModelRecord[] | null {
 	return extractModelEntriesFromNode(payload);

package/src/utils/oauth/index.ts

@@ -255,6 +255,11 @@ const builtInOAuthProviders: OAuthProviderInfo[] = [
 		name: "vLLM (Local OpenAI-compatible)",
 		available: true,
 	},
+	{
+		id: "sglang",
+		name: "SGLang (Local OpenAI-compatible)",
+		available: true,
+	},
 	{
 		id: "cloudflare-ai-gateway",
 		name: "Cloudflare AI Gateway",
@@ -398,6 +403,7 @@ export async function refreshOAuthToken(
 		case "bizrouter":
 		case "opengateway":
 		case "vllm":
+		case "sglang":
 			// API keys / static bearer tokens don't expire, return as-is
 			newCredentials = credentials;
 			break;