@sayknow-cli/ai 0.5.2 → 0.5.8

package/src/utils/oauth/sglang.ts

@@ -0,0 +1,39 @@
+/**
+ * SGLang login flow.
+ *
+ * SGLang commonly exposes an OpenAI-compatible API on a local server. It may
+ * require a bearer token, but local servers commonly allow unauthenticated
+ * access. This flow stores an API-key-style credential for auth storage.
+ */
+
+import type { OAuthController, OAuthProvider } from "./types";
+
+const PROVIDER_ID: OAuthProvider = "sglang";
+const AUTH_URL = "https://docs.sglang.io/docs/advanced_features/server_arguments.html";
+const DEFAULT_LOCAL_BASE_URL = "http://127.0.0.1:30000/v1";
+
+/**
+ * Login to SGLang with an explicit bearer token.
+ */
+export async function loginSglang(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new Error(`${PROVIDER_ID} login requires onPrompt callback`);
+	}
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions: `Paste the API key configured with SGLang's --api-key option. Local no-auth servers at ${DEFAULT_LOCAL_BASE_URL} are discovered automatically and do not need /login.`,
+	});
+	const apiKey = await options.onPrompt({
+		message: "Paste your SGLang API key",
+		placeholder: "SGLang API key",
+		allowEmpty: false,
+	});
+	if (options.signal?.aborted) {
+		throw new Error("Login cancelled");
+	}
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new Error("SGLang API key is required; local no-auth servers are discovered automatically");
+	}
+	return trimmed;
+}

package/src/utils/oauth/types.ts

@@ -52,6 +52,7 @@ export type OAuthProvider =
 	| "venice"
 	| "vercel-ai-gateway"
 	| "vllm"
+	| "sglang"
 	| "xai"
 	| "glm-zcode"
 	| "xiaomi"

package/src/utils/overflow.ts

@@ -127,8 +127,12 @@ const EMPTY_RESPONSE_USAGE_THRESHOLD = 5;
  * misleading error text.
  */
 const OVERFLOW_PROVIDER_CODES = new Set(["context_length_exceeded", "request_too_large"]);
+/**
+ * Codes that name a specific non-overflow *cause*. These are authoritative and
+ * can never be upgraded by error prose. Generic HTTP envelope types belong in
+ * {@link GENERIC_ENVELOPE_PROVIDER_CODES} instead.
+ */
 const NON_OVERFLOW_PROVIDER_CODES = new Set([
-	"invalid_request_error",
 	"authentication_error",
 	"invalid_api_key",
 	"invalid_token",
@@ -145,6 +149,7 @@ const NON_OVERFLOW_PROVIDER_CODES = new Set([
 	"rate_limit_error",
 	"rate_limit_exceeded",
 	"too_many_requests",
+	"empty_response",
 ]);
 
 function transportCodes(transportFailure: TransportFailureFacts | undefined): string[] {
@@ -157,6 +162,53 @@ function hasTypedNonOverflowCode(transportFailure: TransportFailureFacts | undef
 	return transportCodes(transportFailure).some(code => NON_OVERFLOW_PROVIDER_CODES.has(code));
 }
 
+/**
+ * Generic envelope codes that name the HTTP error *category*, not its cause.
+ *
+ * Anthropic reports context overflow through this envelope:
+ *
+ *   {"type":"error","error":{"type":"invalid_request_error",
+ *    "message":"prompt is too long: 1158066 tokens > 1000000 maximum"}}
+ *
+ * Treating the envelope as an authoritative non-overflow cause vetoed the
+ * overflow classification, so auto-compaction never ran and the session died on
+ * the very overflow it was supposed to absorb.
+ *
+ * Unlike {@link NON_OVERFLOW_PROVIDER_CODES} (auth, quota, rate limit), this
+ * envelope names no cause, so it must not veto an overflow the provider stated
+ * quantitatively. It still vetoes free-form prose: only the self-verifying
+ * measured form below can override it.
+ */
+const GENERIC_ENVELOPE_PROVIDER_CODES = new Set(["invalid_request_error"]);
+
+/**
+ * Anthropic's measured overflow report: `<used> tokens > <limit> maximum`.
+ *
+ * Deliberately far narrower than {@link OVERFLOW_PATTERNS}. Those patterns
+ * include loose prose (`too many tokens`, `token limit exceeded`) that a tool
+ * result or a model-authored string can trivially contain, so they must never
+ * be able to flip a typed transport classification. This form carries its own
+ * arithmetic proof and is verified below, so injected text cannot satisfy it
+ * without also asserting a real overage.
+ */
+const ANTHROPIC_MEASURED_OVERFLOW_PATTERN = /prompt is too long:\s*(\d+)\s*tokens?\s*>\s*(\d+)\s*maximum/i;
+
+/**
+ * True only for a provider-measured overflow that verifies against itself:
+ * the reported usage must actually exceed the reported maximum.
+ */
+function hasSelfVerifyingOverflowMeasurement(message: AssistantMessage): boolean {
+	if (message.stopReason !== "error") return false;
+	const errorMessage = message.errorMessage;
+	if (!errorMessage) return false;
+	const match = ANTHROPIC_MEASURED_OVERFLOW_PATTERN.exec(errorMessage);
+	if (!match) return false;
+	const used = Number(match[1]);
+	const maximum = Number(match[2]);
+	if (!Number.isFinite(used) || !Number.isFinite(maximum) || maximum <= 0) return false;
+	return used > maximum;
+}
+
 function isTypedNoBodyOverflow(
 	message: AssistantMessage,
 	transportFailure: TransportFailureFacts | undefined,
@@ -173,7 +225,18 @@ export function classifyContextOverflow(
 	if (transportFailure?.status === 429) return false;
 	const typedCodes = transportCodes(transportFailure);
 	if (typedCodes.some(code => OVERFLOW_PROVIDER_CODES.has(code))) return true;
+	// A specific non-overflow cause (auth, quota, rate limit) is authoritative
+	// and can never be upgraded by error prose.
 	if (hasTypedNonOverflowCode(transportFailure)) return false;
+	// A generic envelope (`invalid_request_error`) names no cause. It still
+	// vetoes free-form overflow prose, but must not veto a provider-measured,
+	// self-verifying overflow report — that is how Anthropic reports overflow.
+	if (
+		typedCodes.some(code => GENERIC_ENVELOPE_PROVIDER_CODES.has(code)) &&
+		!hasSelfVerifyingOverflowMeasurement(message)
+	) {
+		return false;
+	}
 	if (isTypedNoBodyOverflow(message, transportFailure)) return true;
 
 	const errorMessage = message.errorMessage;