@usabledev/usable-chat 1.208.0 → 1.209.0

package/cli.js

@@ -29452,7 +29452,24 @@ function convertToOpenRouterMessages(messages4, modelId) {
       });
     }
   }
-  return messages4.map((msg) => {
+  const normalizedMessages = messages4.flatMap((message2) => {
+    if (message2.role !== "user" || !Array.isArray(message2.content)) return [message2];
+    const blocks2 = message2.content;
+    const results = blocks2.filter((block2) => block2.type === "tool_result");
+    if (!results.length) return [message2];
+    const other2 = blocks2.filter((block2) => block2.type !== "tool_result");
+    return [
+      ...results.map(
+        (block2) => ({
+          role: "tool",
+          tool_call_id: block2.tool_use_id,
+          content: `${block2.is_error ? "[TOOL ERROR] " : ""}${typeof block2.content === "string" ? block2.content : JSON.stringify(block2.content)}`
+        })
+      ),
+      ...other2.length ? [{ ...message2, content: other2 }] : []
+    ];
+  });
+  return normalizedMessages.map((msg) => {
     const extMsg = msg;
     let content = extMsg.content;
     if (Array.isArray(content)) {
@@ -45580,6 +45597,21 @@ var init_model_pricing = __esm({
   "src/lib/model-pricing.ts"() {
     "use strict";
     MODEL_PRICING = {
+      "openai/gpt-6-sol": {
+        input: 2e-6,
+        output: 1e-5,
+        multiplier: 16
+      },
+      "openai/gpt-6-luna": {
+        input: 1e-7,
+        output: 5e-7,
+        multiplier: 1
+      },
+      "anthropic/claude-opus-5.5": {
+        input: 4e-6,
+        output: 2e-5,
+        multiplier: 32
+      },
       // Amazon Models
       "amazon/nova-2-lite-v1": {
         input: 3e-7,
@@ -46912,6 +46944,75 @@ var init_model_registry_generated = __esm({
   "src/lib/model-registry-generated.ts"() {
     "use strict";
     GENERATED_MODELS = [
+      {
+        id: "openai/gpt-6-luna",
+        displayName: "GPT-6 Luna",
+        vendor: "openai",
+        category: "fast",
+        capabilities: {
+          vision: true,
+          reasoning: true,
+          maxTokens: 128e3,
+          contextLength: 105e4
+        },
+        pricing: {
+          inputPer1M: 0.1,
+          outputPer1M: 0.5,
+          multiplier: 1
+        },
+        availability: {
+          mainChat: false,
+          experts: true,
+          embeds: true
+        },
+        createdAt: 1790100786
+      },
+      {
+        id: "openai/gpt-6-sol",
+        displayName: "GPT-6 Sol",
+        vendor: "openai",
+        category: "balanced",
+        capabilities: {
+          vision: true,
+          reasoning: true,
+          maxTokens: 128e3,
+          contextLength: 105e4
+        },
+        pricing: {
+          inputPer1M: 2,
+          outputPer1M: 10,
+          multiplier: 16
+        },
+        availability: {
+          mainChat: false,
+          experts: true,
+          embeds: true
+        },
+        createdAt: 1790100775
+      },
+      {
+        id: "anthropic/claude-opus-5.5",
+        displayName: "Claude Opus 5.5",
+        vendor: "anthropic",
+        category: "powerful",
+        capabilities: {
+          vision: true,
+          reasoning: true,
+          maxTokens: 128e3,
+          contextLength: 1e6
+        },
+        pricing: {
+          inputPer1M: 4,
+          outputPer1M: 20,
+          multiplier: 32
+        },
+        availability: {
+          mainChat: false,
+          experts: true,
+          embeds: true
+        },
+        createdAt: 1790094732
+      },
       {
         id: "openai/gpt-6-astra",
         displayName: "GPT-6 Astra",
@@ -52518,6 +52619,7 @@ var init_model_registry = __esm({
       "claude-sonnet-4-6": { bedrockId: "anthropic.claude-sonnet-4-6", crossRegion: true },
       "claude-sonnet-5": { bedrockId: "global.anthropic.claude-sonnet-5", crossRegion: false },
       "claude-opus-5": { bedrockId: "global.anthropic.claude-opus-5", crossRegion: false },
+      "claude-opus-5-5": { bedrockId: "global.anthropic.claude-opus-5-5", crossRegion: false },
       // Opus 4.7 uses the Global Cross-Region Inference profile (no regional Geo access required)
       "claude-opus-4-7": { bedrockId: "global.anthropic.claude-opus-4-7", crossRegion: false },
       "claude-opus-4-20250514": {
@@ -138126,6 +138228,7 @@ function extractClaudeModel(modelId) {
     "anthropic/claude-opus-4.7": "claude-opus-4-7",
     "anthropic/claude-opus-4.8": "claude-opus-4-8",
     "anthropic/claude-opus-5": "claude-opus-5",
+    "anthropic/claude-opus-5.5": "claude-opus-5-5",
     // Claude Fable models
     "anthropic/claude-fable-5": "claude-fable-5",
     "anthropic/claude-fable-5.1": "claude-fable-5-1",
@@ -165240,8 +165343,8 @@ var init_model_tiers = __esm({
             effort: "medium"
           },
           {
-            id: "openai/gpt-5.6-luna",
-            displayName: "GPT-5.6 Luna",
+            id: "openai/gpt-6-luna",
+            displayName: "GPT-6 Luna",
             description: "Efficient high-volume reasoning, multimodal input, and 1M+ context",
             provider: "OpenAI",
             multiLingual: true,
@@ -165271,8 +165374,8 @@ var init_model_tiers = __esm({
             zdr: true
           },
           {
-            id: "openai/gpt-5.6-terra",
-            displayName: "GPT-5.6 Terra",
+            id: "openai/gpt-6-sol",
+            displayName: "GPT-6 Sol",
             description: "Balanced intelligence and cost for reasoning, coding, and agents",
             provider: "OpenAI",
             multiLingual: true,
@@ -165285,8 +165388,8 @@ var init_model_tiers = __esm({
         name: "Deep Research",
         models: [
           {
-            id: "anthropic/claude-opus-5",
-            displayName: "Claude Opus 5",
+            id: "anthropic/claude-opus-5.5",
+            displayName: "Claude Opus 5.5",
             description: "Frontier coding, agents, architecture, and long-running research",
             provider: "Anthropic",
             costTier: "Very Expensive",
@@ -166063,6 +166166,7 @@ var init_model_config = __esm({
       "anthropic/claude-4.5-sonnet": { vision: true, reasoning: true },
       "anthropic/claude-opus-4.7": { vision: true, reasoning: false },
       "anthropic/claude-opus-5": { vision: true, reasoning: true },
+      "anthropic/claude-opus-5.5": { vision: true, reasoning: true },
       "anthropic/claude-fable-5.1": { vision: true, reasoning: true },
       "google/gemini-2.5-flash": { vision: true, reasoning: true },
       "google/gemini-2.5-flash-lite": { vision: true, reasoning: true },
@@ -166076,6 +166180,8 @@ var init_model_config = __esm({
       "openai/gpt-5.2-codex": { vision: true, reasoning: true },
       "openai/gpt-5.5": { vision: true, reasoning: true },
       "openai/gpt-5.6-sol": { vision: true, reasoning: true },
+      "openai/gpt-6-sol": { vision: true, reasoning: true },
+      "openai/gpt-6-luna": { vision: true, reasoning: true },
       "openai/gpt-6-astra": { vision: true, reasoning: true },
       "deepseek/deepseek-r1": { vision: false, reasoning: true }
     };
@@ -167300,6 +167406,25 @@ var init_logger3 = __esm({
   }
 });
 
+// src/core/ai/openrouter-tool-format.ts
+function toOpenRouterToolFormat(tools) {
+  return tools.map(
+    (tool2) => "input_schema" in tool2 ? {
+      type: "function",
+      function: {
+        name: tool2.name,
+        description: tool2.description,
+        parameters: tool2.input_schema
+      }
+    } : tool2
+  );
+}
+var init_openrouter_tool_format = __esm({
+  "src/core/ai/openrouter-tool-format.ts"() {
+    "use strict";
+  }
+});
+
 // src/lib/reasoning-config.ts
 function getReasoningConfig(modelId, hasReasoningCapability = false, forceEnable = true, reasoningEffort) {
   if (reasoningEffort === void 0) {
@@ -359561,30 +359686,99 @@ function matchOriginAgainstDomains(origin, domains) {
   if (!origin || domains.length === 0) {
     return false;
   }
-  let originHost;
+  let parsedOrigin;
   try {
-    originHost = new URL(origin).hostname;
+    parsedOrigin = new URL(origin);
+    if (!["http:", "https:"].includes(parsedOrigin.protocol) || parsedOrigin.username || parsedOrigin.password)
+      return false;
   } catch {
     return false;
   }
   return domains.some((allowed) => {
-    const isWildcard = allowed.startsWith("*.");
-    const allowedHost = isWildcard ? allowed.slice(2) : (() => {
-      try {
-        return new URL(allowed.startsWith("http") ? allowed : `https://${allowed}`).hostname;
-      } catch {
-        return allowed;
-      }
-    })();
-    if (isWildcard) {
-      return originHost.endsWith("." + allowedHost) || originHost === allowedHost;
-    }
-    return originHost === allowedHost;
+    const rule = parseAllowedDomain(allowed);
+    if (!rule) return false;
+    if (rule.kind === "origin") return rule.value === parsedOrigin.origin;
+    const host = parsedOrigin.hostname;
+    return host === rule.value || rule.kind === "wildcard" && host.endsWith("." + rule.value);
   });
 }
+function isValidAllowedDomain(value) {
+  return parseAllowedDomain(value) !== null;
+}
+function parseAllowedDomain(allowed) {
+  if ([...allowed].some((char2) => char2.charCodeAt(0) <= 32 || char2.charCodeAt(0) === 127))
+    return null;
+  if (/^[a-z][a-z0-9+.-]*:/i.test(allowed)) {
+    if (!explicitOriginPattern.test(allowed) || allowed.includes("*")) return null;
+    try {
+      const configured = new URL(allowed);
+      if (!["http:", "https:"].includes(configured.protocol) || configured.username || configured.password || configured.pathname !== "/" || configured.search || configured.hash)
+        return null;
+      return { kind: "origin", value: configured.origin };
+    } catch {
+      return null;
+    }
+  }
+  const wildcard = allowed.startsWith("*.");
+  const host = wildcard ? allowed.slice(2) : allowed;
+  const ipv63 = !wildcard && ipv6HostPattern.test(host);
+  if (!ipv63 && /[:/\\?#@%\s]/u.test(host)) return null;
+  try {
+    const normalized = new URL(`https://${host}`).hostname;
+    if (!hostnamePattern.test(normalized) && !(ipv63 && ipv6HostPattern.test(normalized)))
+      return null;
+    return { kind: wildcard ? "wildcard" : "host", value: normalized };
+  } catch {
+    return null;
+  }
+}
+var explicitOriginPattern, hostnamePattern, ipv6HostPattern, allowedDomainValidationMessage;
 var init_origin_matcher = __esm({
   "src/lib/utils/origin-matcher.ts"() {
     "use strict";
+    explicitOriginPattern = /^https?:\/\/(?:\[[a-f0-9:.]+\]|[^:/\\?#@%\s]+)(?::[0-9]+)?\/?$/i;
+    hostnamePattern = /^(?:[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?\.)*[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?\.?$/i;
+    ipv6HostPattern = /^\[[a-f0-9:.]+\]$/i;
+    allowedDomainValidationMessage = "Use an HTTP(S) origin without a path (https://example.com:8443), a bare hostname, or *.example.com. Scheme wildcards and bare host:port are not supported.";
+  }
+});
+
+// src/core/types/embed-key.ts
+var allowedDomainSchema, createEmbedKeyObjectSchema, createEmbedKeySchema, updateEmbedKeySchema, embedKeyAccessPolicySchema, rawUsablePatSchema;
+var init_embed_key = __esm({
+  "src/core/types/embed-key.ts"() {
+    "use strict";
+    init_zod();
+    init_origin_matcher();
+    allowedDomainSchema = external_exports.string().min(1).refine(isValidAllowedDomain, allowedDomainValidationMessage);
+    createEmbedKeyObjectSchema = external_exports.object({
+      configId: external_exports.string().uuid(),
+      label: external_exports.string().min(1).max(255),
+      allowedDomains: external_exports.array(allowedDomainSchema).default([]),
+      public: external_exports.boolean().default(false),
+      expiresAt: external_exports.union([external_exports.date(), external_exports.string().datetime()]).optional()
+    });
+    createEmbedKeySchema = createEmbedKeyObjectSchema.refine(
+      (data2) => data2.public || data2.allowedDomains.length > 0,
+      {
+        message: "At least one allowed domain is required when the key is not public",
+        path: ["allowedDomains"]
+      }
+    );
+    updateEmbedKeySchema = external_exports.object({
+      label: external_exports.string().min(1).max(255).optional(),
+      allowedDomains: external_exports.array(allowedDomainSchema).optional(),
+      public: external_exports.boolean().optional(),
+      expiresAt: external_exports.union([external_exports.date(), external_exports.string().datetime()]).nullable().optional()
+    });
+    embedKeyAccessPolicySchema = external_exports.object({
+      public: external_exports.boolean(),
+      allowedDomains: external_exports.array(allowedDomainSchema)
+    }).refine((data2) => data2.public || data2.allowedDomains.length > 0, {
+      message: "At least one allowed domain is required when the key is not public",
+      path: ["allowedDomains"]
+    });
+    rawUsablePatSchema = external_exports.string().min(1).max(4096);
   }
 });
 
@@ -359710,7 +359904,16 @@ async function resolveEmbedKeyUncached(token, origin, options2) {
   if (key2.expiresAt && new Date(key2.expiresAt) < /* @__PURE__ */ new Date()) {
     return { success: false, error: { code: "KEY_EXPIRED", message: "This embed key has expired" } };
   }
-  if (key2.allowedDomains.length > 0 && !key2.public && !options2?.skipOriginCheck) {
+  if (!key2.public && key2.allowedDomains.length === 0) {
+    return {
+      success: false,
+      error: {
+        code: "ORIGIN_NOT_ALLOWED",
+        message: "This private embed key has no allowed domains"
+      }
+    };
+  }
+  if (!key2.public && !options2?.skipOriginCheck) {
     if (!origin) {
       return {
         success: false,
@@ -359762,6 +359965,7 @@ var EMBED_KEY_CACHE_TTL_MS, EMBED_KEY_CACHE_MAX_ENTRIES, embedKeyCache, EMBED_KE
 var init_embed_key_service = __esm({
   "src/lib/services/embed-key.service.ts"() {
     "use strict";
+    init_embed_key();
     init_client7();
     init_schema_embed_keys();
     init_schema3();
@@ -364010,7 +364214,7 @@ async function callLLM({
               stream_options: {
                 include_usage: true
               },
-              tools,
+              tools: tools ? toOpenRouterToolFormat(tools) : void 0,
               tool_choice: shouldEnableTools ? forcedToolName ? { type: "function", function: { name: forcedToolName } } : "auto" : void 0,
               temperature,
               max_tokens: maxTokens,
@@ -368256,6 +368460,7 @@ var init_orchestrator = __esm({
     init_mcp();
     init_model_registry();
     init_openrouter_direct();
+    init_openrouter_tool_format();
     init_codex_direct();
     init_reasoning_config();
     init_claude_stream_adapter();
@@ -391609,7 +391814,7 @@ init_tui_select();
 init_model_registry();
 
 // package.json
-var version2 = "1.208.0";
+var version2 = "1.209.0";
 
 // src/adapters/cli/model-catalog.ts
 init_codex_auth();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usabledev/usable-chat",
-  "version": "1.208.0",
+  "version": "1.209.0",
   "description": "usable-chat — terminal harness for usable-chat (headless + TUI)",
   "type": "module",
   "bin": {