@vib-rato/ai 0.16.0

package/src/cli.ts

@@ -0,0 +1,269 @@
+#!/usr/bin/env bun
+import * as readline from "node:readline";
+import { AuthStorage, SqliteAuthCredentialStore } from "./auth-storage";
+import { getOAuthProviders } from "./utils/oauth";
+import type { OAuthProvider } from "./utils/oauth/types";
+
+const PROVIDERS = getOAuthProviders();
+
+function prompt(rl: readline.Interface, question: string): Promise<string> {
+	const { promise, resolve, reject } = Promise.withResolvers<string>();
+	const input = process.stdin as NodeJS.ReadStream;
+	const supportsRawMode = input.isTTY && typeof input.setRawMode === "function";
+	const wasRaw = supportsRawMode ? input.isRaw : false;
+	let settled = false;
+
+	const cleanup = () => {
+		rl.off("SIGINT", onSigint);
+		if (supportsRawMode) {
+			input.off("keypress", onKeypress);
+			input.setRawMode?.(wasRaw);
+		}
+	};
+
+	const finish = (result: () => void) => {
+		if (settled) return;
+		settled = true;
+		cleanup();
+		result();
+	};
+
+	const cancel = () => {
+		finish(() => reject(new Error("Login cancelled")));
+	};
+
+	const onSigint = () => {
+		cancel();
+	};
+
+	const onKeypress = (_str: string, key: readline.Key) => {
+		if (key.name === "escape" || (key.ctrl && key.name === "c")) {
+			cancel();
+			rl.close();
+		}
+	};
+
+	if (supportsRawMode) {
+		readline.emitKeypressEvents(input, rl);
+		input.setRawMode(true);
+		input.on("keypress", onKeypress);
+	}
+
+	rl.once("SIGINT", onSigint);
+	rl.question(question, answer => {
+		finish(() => resolve(answer));
+	});
+	return promise;
+}
+
+async function login(provider: OAuthProvider): Promise<void> {
+	const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+	const promptFn = (msg: string) => prompt(rl, `${msg} `);
+	const store = await SqliteAuthCredentialStore.open();
+	const storage = new AuthStorage(store);
+	await storage.reload();
+
+	try {
+		await storage.login(provider, {
+			onAuth(info) {
+				const { url, instructions } = info;
+				console.log(`\nOpen this URL in your browser:\n${url}`);
+				if (instructions) console.log(instructions);
+				console.log();
+			},
+			onProgress(message) {
+				console.log(message);
+			},
+			onPrompt(p) {
+				return promptFn(`${p.message}${p.placeholder ? ` (${p.placeholder})` : ""}:`);
+			},
+		});
+		console.log(`\nCredentials saved to ~/.vib/agent/agent.db`);
+	} finally {
+		store.close();
+		rl.close();
+	}
+}
+
+async function main(): Promise<void> {
+	const args = process.argv.slice(2);
+	const command = args[0];
+
+	if (!command || command === "help" || command === "--help" || command === "-h") {
+		console.log(`Usage: bunx @vib-rato/ai <command> [provider]
+
+Commands:
+  login [provider]  Login to a provider
+  logout [provider] Logout from a provider
+  status            Show logged-in providers
+  list              List available providers
+
+Providers:
+  anthropic         Anthropic
+  github-copilot    GitHub Copilot
+  google-gemini-cli Google Gemini CLI
+  google-antigravity Antigravity (Gemini 3, Anthropic, GPT-OSS)
+  openai-codex      OpenAI code provider (ChatGPT Plus/Pro)
+  commandcode-goat    Command Code GOAT (API key)
+  kimi-code         Kimi Code
+  kilo              Kilo Gateway
+  kagi              Kagi
+  tavily            Tavily
+  zai               Z.AI (GLM Coding Plan)
+  glm-zcode         GLM ZCode OAuth (unofficial, opt-in; at your own risk)
+  deepseek          DeepSeek
+  deepinfra         DeepInfra
+  xai               xAI
+  nanogpt           NanoGPT
+  minimax-code      MiniMax Coding Plan (International)
+  minimax-code-cn   MiniMax Coding Plan (China)
+  cursor            Cursor (Anthropic, GPT, etc.)
+  zenmux            ZenMux
+  opengateway       OpenGateway by Sionic AI
+  bizrouter         BizRouter
+  mara              Mara Cloud
+  ollama-cloud      Ollama Cloud
+
+Examples:
+  bunx @vib-rato/ai login              # interactive provider selection
+  bunx @vib-rato/ai login anthropic    # login to specific provider
+  bunx @vib-rato/ai logout anthropic   # logout from specific provider
+  bunx @vib-rato/ai status             # show logged-in providers
+  bunx @vib-rato/ai list               # list providers
+`);
+		return;
+	}
+
+	if (command === "status") {
+		const storage = await SqliteAuthCredentialStore.open();
+		try {
+			const providers = storage.listProviders();
+			if (providers.length === 0) {
+				console.log("No credentials stored.");
+				console.log(`Use 'bunx @vib-rato/ai login' to authenticate.`);
+			} else {
+				console.log("Logged-in providers:\n");
+				for (const provider of providers) {
+					const oauth = storage.getOAuth(provider);
+					if (oauth) {
+						const expires = new Date(oauth.expires);
+						const expired = Date.now() >= oauth.expires;
+						const status = expired ? "(expired)" : `(expires ${expires.toLocaleString()})`;
+						console.log(`  ${provider.padEnd(20)} ${status}`);
+						continue;
+					}
+					const apiKey = storage.getApiKey(provider);
+					if (apiKey) {
+						console.log(`  ${provider.padEnd(20)} (api key)`);
+					}
+				}
+			}
+		} finally {
+			storage.close();
+		}
+		return;
+	}
+
+	if (command === "list") {
+		console.log("Available providers:\n");
+		for (const p of PROVIDERS) {
+			console.log(`  ${p.id.padEnd(20)} ${p.name}`);
+		}
+		return;
+	}
+
+	if (command === "logout") {
+		let provider = args[1] as OAuthProvider | undefined;
+		const storage = await SqliteAuthCredentialStore.open();
+
+		try {
+			if (!provider) {
+				const providers = storage.listProviders();
+				if (providers.length === 0) {
+					console.log("No credentials stored.");
+					return;
+				}
+
+				const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+				console.log("Select a provider to logout:\n");
+				for (let i = 0; i < providers.length; i++) {
+					console.log(`  ${i + 1}. ${providers[i]}`);
+				}
+				console.log();
+
+				const choice = await prompt(rl, `Enter number (1-${providers.length}): `);
+				rl.close();
+
+				const index = parseInt(choice, 10) - 1;
+				if (index < 0 || index >= providers.length) {
+					console.error("Invalid selection");
+					process.exit(1);
+				}
+				provider = providers[index] as OAuthProvider;
+			}
+			if (!provider) {
+				console.error("No provider selected");
+				process.exit(1);
+			}
+
+			const oauth = storage.getOAuth(provider);
+			const apiKey = storage.getApiKey(provider);
+			if (!oauth && !apiKey) {
+				console.error(`Not logged in to ${provider}`);
+				process.exit(1);
+			}
+
+			storage.deleteProvider(provider);
+			console.log(`Logged out from ${provider}`);
+		} finally {
+			storage.close();
+		}
+		return;
+	}
+
+	if (command === "login") {
+		let provider = args[1] as OAuthProvider | undefined;
+
+		if (!provider) {
+			const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+			console.log("Select a provider:\n");
+			for (let i = 0; i < PROVIDERS.length; i++) {
+				console.log(`  ${i + 1}. ${PROVIDERS[i].name}`);
+			}
+			console.log();
+
+			const choice = await prompt(rl, `Enter number (1-${PROVIDERS.length}): `);
+			rl.close();
+
+			const index = parseInt(choice, 10) - 1;
+			if (index < 0 || index >= PROVIDERS.length) {
+				console.error("Invalid selection");
+				process.exit(1);
+			}
+			provider = PROVIDERS[index].id as OAuthProvider;
+		}
+		if (!provider) {
+			console.error("No provider selected");
+			process.exit(1);
+		}
+
+		if (!PROVIDERS.some(p => p.id === provider)) {
+			console.error(`Unknown provider: ${provider}`);
+			console.error(`Use 'bunx @vib-rato/ai list' to see available providers`);
+			process.exit(1);
+		}
+
+		console.log(`Logging in to ${provider}…`);
+		await login(provider);
+		return;
+	}
+
+	console.error(`Unknown command: ${command}`);
+	console.error(`Use 'bunx @vib-rato/ai --help' for usage`);
+	process.exit(1);
+}
+
+main().catch(err => {
+	console.error("Error:", err.message);
+	process.exit(1);
+});

package/src/codex-tools.d.ts

@@ -0,0 +1,4 @@
+/** Maps a canonical tool name to the name Codex accepts on the wire. */
+export declare function codexToolWireName(name: string): string;
+/** Maps a Codex wire tool name back to the canonical harness tool name. */
+export declare function codexToolCanonicalName(wireName: string): string;

package/src/codex-tools.ts

@@ -0,0 +1,24 @@
+/**
+ * Core-safe Codex tool-name mapping.
+ *
+ * The mapping is shared by prompt metadata and the Codex transport, but it has
+ * no provider SDK or network dependencies. Keeping it here lets startup code
+ * use the canonical wire names without importing the Codex implementation.
+ */
+const CODEX_RESERVED_TOOL_WIRE_NAMES: ReadonlyMap<string, string> = new Map([
+	["browser", "browser_tool"],
+	["computer", "computer_tool"],
+]);
+const CODEX_CANONICAL_TOOL_NAMES: ReadonlyMap<string, string> = new Map(
+	Array.from(CODEX_RESERVED_TOOL_WIRE_NAMES, ([canonical, wire]) => [wire, canonical]),
+);
+
+/** Maps a canonical tool name to the name Codex accepts on the wire. */
+export function codexToolWireName(name: string): string {
+	return CODEX_RESERVED_TOOL_WIRE_NAMES.get(name) ?? name;
+}
+
+/** Maps a Codex wire tool name back to the canonical harness tool name. */
+export function codexToolCanonicalName(wireName: string): string {
+	return CODEX_CANONICAL_TOOL_NAMES.get(wireName) ?? wireName;
+}

package/src/context-cap-policy.d.ts

@@ -0,0 +1,68 @@
+import type { Api, Model } from "./types";
+/**
+ * Codex GPT-5.6 OAuth context-window policy.
+ *
+ * Authoritative source and ownership path
+ * ---------------------------------------
+ * The authenticated Codex backend discovery endpoint (`GET {base}/codex/models`
+ * with an OAuth bearer token) is the authoritative runtime source of Codex OAuth
+ * model context-window metadata (`models[].context_window`). OpenAI owns that
+ * value; Vibrato consumes it read-only via `fetchCodexModels` and must not silently
+ * invent a larger limit without upstream evidence.
+ *
+ * This bundled policy is a client-side conservative guard, not a primary source.
+ * It exists because OpenAI temporarily reverted the GPT-5.6 Sol product context
+ * limit from 372K to 272K on 2026-07-13 (staff announcement quoted in
+ * vib-rato issues #2240 / #2260), while planning to restore 372K later.
+ * `ceiling` must only be raised with an upstream evidence citation; an
+ * unverified report that "372K is live again" is not sufficient.
+ *
+ * Precedence (highest -> lowest)
+ * ------------------------------
+ * 1. Explicit user per-model override (`contextWindow` in `modelOverrides`).
+ *    The model registry merges it into `model.contextWindow` before this cap and
+ *    passes it here; it is honored when a positive finite number, with
+ *    diagnostics emitted at the registry. Never silently discarded.
+ * 2. Live OAuth discovery metadata (`context_window`), forced to the enforced
+ *    product window for the GPT-5.6 tier.
+ * 3. Bundled conservative generic window (`CODEX_GENERIC_CONTEXT_WINDOW`),
+ *    used when discovery metadata is absent or invalid.
+ */
+export interface CodexGpt56ContextCapPolicy {
+    /**
+     * Usable prompt budget forced for the GPT-5.6 tier on the Codex product
+     * transport. The live OpenAI code backend metadata still reports the old
+     * 272K budget (or the total-window figure), so this is an explicit product
+     * override: the tier is forced to the enforced window regardless of what
+     * discovery reports.
+     */
+    enforced: number;
+}
+export declare const CODEX_GPT_5_6_CONTEXT_CAP: CodexGpt56ContextCapPolicy;
+/**
+ * Generic usable prompt budget for OpenAI code backend models outside the
+ * GPT-5.6 tier (e.g. gpt-5.5, gpt-5.4-codex, gpt-5.6-codex). Kept separate from
+ * {@link CODEX_GPT_5_6_CONTEXT_CAP} so the forced 5.6-tier window never leaks
+ * into unrelated Codex discovery rows.
+ */
+export declare const CODEX_GENERIC_CONTEXT_WINDOW = 272000;
+export declare function isCodexProductTransport(model: Pick<Model<Api>, "api" | "provider">): boolean;
+export declare function isCodexGpt56Tier(model: Pick<Model<Api>, "id">): boolean;
+export declare function codexContextOverrideKey(provider: string, modelId: string): string;
+export declare function resolveCodexGpt56DiscoveryContext(model: Pick<Model<Api>, "api" | "id" | "provider">, rawContextWindow: unknown, policy?: CodexGpt56ContextCapPolicy): number;
+/**
+ * Applies the final Codex GPT-5.6 context ceiling, honoring explicit user
+ * overrides.
+ *
+ * `userContextWindowOverrides` maps provider-qualified composite keys
+ * (`provider:modelId`, both lowercased, built by
+ * {@link codexContextOverrideKey}) to the user's explicit `contextWindow` value
+ * (already merged into `model.contextWindow` by the model registry). A tier
+ * model present with a positive finite value keeps its value even above
+ * `enforced` — the user's explicit, diagnosed choice. Every other tier
+ * model is forced to `enforced`, so a stale larger live/cached observation
+ * (e.g. a pre-rollback 373K cache) cannot resurface without an override.
+ * Because the key is provider-qualified, an override only exempts the exact
+ * provider+model pair it was configured for.
+ */
+export declare function applyFinalCodexGpt56ContextCap<TApi extends Api>(models: readonly Model<TApi>[], policy?: CodexGpt56ContextCapPolicy, userContextWindowOverrides?: ReadonlyMap<string, number>): Model<TApi>[];

package/src/context-cap-policy.ts

@@ -0,0 +1,123 @@
+import type { Api, Model } from "./types";
+
+/**
+ * Codex GPT-5.6 OAuth context-window policy.
+ *
+ * Authoritative source and ownership path
+ * ---------------------------------------
+ * The authenticated Codex backend discovery endpoint (`GET {base}/codex/models`
+ * with an OAuth bearer token) is the authoritative runtime source of Codex OAuth
+ * model context-window metadata (`models[].context_window`). OpenAI owns that
+ * value; Vibrato consumes it read-only via `fetchCodexModels` and must not silently
+ * invent a larger limit without upstream evidence.
+ *
+ * This bundled policy is a client-side conservative guard, not a primary source.
+ * It exists because OpenAI temporarily reverted the GPT-5.6 Sol product context
+ * limit from 372K to 272K on 2026-07-13 (staff announcement quoted in
+ * vib-rato issues #2240 / #2260), while planning to restore 372K later.
+ * `ceiling` must only be raised with an upstream evidence citation; an
+ * unverified report that "372K is live again" is not sufficient.
+ *
+ * Precedence (highest -> lowest)
+ * ------------------------------
+ * 1. Explicit user per-model override (`contextWindow` in `modelOverrides`).
+ *    The model registry merges it into `model.contextWindow` before this cap and
+ *    passes it here; it is honored when a positive finite number, with
+ *    diagnostics emitted at the registry. Never silently discarded.
+ * 2. Live OAuth discovery metadata (`context_window`), forced to the enforced
+ *    product window for the GPT-5.6 tier.
+ * 3. Bundled conservative generic window (`CODEX_GENERIC_CONTEXT_WINDOW`),
+ *    used when discovery metadata is absent or invalid.
+ */
+export interface CodexGpt56ContextCapPolicy {
+	/**
+	 * Usable prompt budget forced for the GPT-5.6 tier on the Codex product
+	 * transport. The live OpenAI code backend metadata still reports the old
+	 * 272K budget (or the total-window figure), so this is an explicit product
+	 * override: the tier is forced to the enforced window regardless of what
+	 * discovery reports.
+	 */
+	enforced: number;
+}
+
+export const CODEX_GPT_5_6_CONTEXT_CAP: CodexGpt56ContextCapPolicy = {
+	enforced: 372_000,
+};
+
+/**
+ * Generic usable prompt budget for OpenAI code backend models outside the
+ * GPT-5.6 tier (e.g. gpt-5.5, gpt-5.4-codex, gpt-5.6-codex). Kept separate from
+ * {@link CODEX_GPT_5_6_CONTEXT_CAP} so the forced 5.6-tier window never leaks
+ * into unrelated Codex discovery rows.
+ */
+export const CODEX_GENERIC_CONTEXT_WINDOW = 272_000;
+
+const CODEX_GPT_5_6_MODEL_IDS: ReadonlySet<string> = new Set([
+	"gpt-5.6",
+	"gpt-5.6-sol",
+	"gpt-5.6-terra",
+	"gpt-5.6-luna",
+]);
+
+export function isCodexProductTransport(model: Pick<Model<Api>, "api" | "provider">): boolean {
+	return model.provider === "openai-codex" || model.api === "openai-codex-responses";
+}
+
+export function isCodexGpt56Tier(model: Pick<Model<Api>, "id">): boolean {
+	return CODEX_GPT_5_6_MODEL_IDS.has(model.id.toLowerCase());
+}
+export function codexContextOverrideKey(provider: string, modelId: string): string {
+	return `${provider.toLowerCase()}:${modelId.toLowerCase()}`;
+}
+
+export function resolveCodexGpt56DiscoveryContext(
+	model: Pick<Model<Api>, "api" | "id" | "provider">,
+	rawContextWindow: unknown,
+	policy: CodexGpt56ContextCapPolicy = CODEX_GPT_5_6_CONTEXT_CAP,
+): number {
+	if (!isCodexGpt56Tier(model) || !isCodexProductTransport(model)) {
+		// Non-5.6 rows keep the generic Codex prompt budget as their fallback;
+		// live observations still pass through (the 272K pin for gpt-5.5 and
+		// gpt-5.6-codex is applied later by the generated-catalog policy).
+		return isPositiveFiniteNumber(rawContextWindow) ? rawContextWindow : CODEX_GENERIC_CONTEXT_WINDOW;
+	}
+	// Force the enforced window: the backend's current metadata under-reports
+	// the GPT-5.6 tier budget, and stale smaller observations must not win.
+	return policy.enforced;
+}
+
+/**
+ * Applies the final Codex GPT-5.6 context ceiling, honoring explicit user
+ * overrides.
+ *
+ * `userContextWindowOverrides` maps provider-qualified composite keys
+ * (`provider:modelId`, both lowercased, built by
+ * {@link codexContextOverrideKey}) to the user's explicit `contextWindow` value
+ * (already merged into `model.contextWindow` by the model registry). A tier
+ * model present with a positive finite value keeps its value even above
+ * `enforced` — the user's explicit, diagnosed choice. Every other tier
+ * model is forced to `enforced`, so a stale larger live/cached observation
+ * (e.g. a pre-rollback 373K cache) cannot resurface without an override.
+ * Because the key is provider-qualified, an override only exempts the exact
+ * provider+model pair it was configured for.
+ */
+export function applyFinalCodexGpt56ContextCap<TApi extends Api>(
+	models: readonly Model<TApi>[],
+	policy: CodexGpt56ContextCapPolicy = CODEX_GPT_5_6_CONTEXT_CAP,
+	userContextWindowOverrides: ReadonlyMap<string, number> = new Map(),
+): Model<TApi>[] {
+	return models.map(model => {
+		if (!isCodexGpt56Tier(model as Model<Api>) || !isCodexProductTransport(model as Model<Api>)) {
+			return model;
+		}
+		const userOverride = userContextWindowOverrides.get(codexContextOverrideKey(model.provider, model.id));
+		if (userOverride !== undefined && isPositiveFiniteNumber(userOverride)) {
+			return model;
+		}
+		return { ...model, contextWindow: policy.enforced };
+	});
+}
+
+function isPositiveFiniteNumber(value: unknown): value is number {
+	return typeof value === "number" && Number.isFinite(value) && value > 0;
+}

package/src/core.ts

@@ -0,0 +1,44 @@
+/**
+ * Lightweight public AI runtime surface.
+ *
+ * This entrypoint intentionally exports core types, schemas, model metadata,
+ * stream dispatch, and lazy provider descriptors only. Concrete provider
+ * implementations stay behind `register-builtins` loaders and are not
+ * re-exported here.
+ */
+export { type ZodType, z } from "zod/v4";
+export * from "./api-registry";
+export * from "./auth-broker";
+export * from "./auth-gateway/types";
+export * from "./auth-storage";
+export * from "./codex-tools";
+export * from "./context-cap-policy";
+export * from "./model-cache";
+export * from "./model-manager";
+export * from "./model-thinking";
+export * from "./models";
+export * from "./provider-models";
+export {
+	getProviderRuntimeDescriptor,
+	PROVIDER_RUNTIME_DESCRIPTORS,
+	type ProviderRuntimeDescriptor,
+} from "./providers/register-builtins";
+export { hasAdjacentPrivateThinkingBlocks } from "./providers/transform-messages";
+export * from "./rate-limit-utils";
+export * from "./stream";
+export * from "./types";
+export * from "./usage";
+export * from "./utils/event-stream";
+export * from "./utils/fallback-transport";
+export * from "./utils/oauth";
+export type {
+	OAuthCredentials,
+	OAuthProvider,
+	OAuthProviderId,
+	OAuthProviderInfo,
+} from "./utils/oauth/types";
+export * from "./utils/overflow";
+export * from "./utils/retry";
+export * from "./utils/schema";
+export * from "./utils/tool-choice-capability";
+export * from "./utils/validation";

package/src/index.ts

@@ -0,0 +1,61 @@
+export { type ZodType, z } from "zod/v4";
+export * from "./api-registry";
+export * from "./auth-broker";
+export { type AuthGatewayBootOptions, type ModelResolver, startAuthGateway } from "./auth-gateway/server";
+export * from "./auth-gateway/types";
+export * from "./auth-storage";
+export * from "./context-cap-policy";
+export * from "./model-cache";
+export * from "./model-manager";
+export * from "./model-thinking";
+export * from "./models";
+export * from "./provider-details";
+export * from "./provider-models";
+export * from "./providers/anthropic";
+export * from "./providers/azure-openai-responses";
+export type * from "./providers/cursor";
+export * from "./providers/gitlab-duo";
+export type * from "./providers/google";
+export type * from "./providers/google-gemini-cli";
+export * from "./providers/google-gemini-headers";
+export type * from "./providers/google-vertex";
+export * from "./providers/kimi";
+export * from "./providers/mock";
+export * from "./providers/ollama";
+export * from "./providers/openai-codex-responses";
+export * from "./providers/openai-completions";
+export * from "./providers/openai-opencodex-responses";
+export * from "./providers/openai-responses";
+export * from "./providers/synthetic";
+export * from "./rate-limit-utils";
+export * from "./stream";
+export * from "./types";
+export * from "./usage";
+export * from "./usage/claude";
+export * from "./usage/gemini";
+export * from "./usage/github-copilot";
+export * from "./usage/google-antigravity";
+export * from "./usage/grok-cli";
+export * from "./usage/kimi";
+export * from "./usage/minimax-code";
+export * from "./usage/openai-codex";
+export * from "./usage/zai";
+export * from "./utils/anthropic-auth";
+export * from "./utils/discovery";
+export * from "./utils/event-stream";
+export * from "./utils/fallback-transport";
+export * from "./utils/h2-fetch";
+export * from "./utils/oauth";
+export type {
+	OAuthCredentials,
+	OAuthLoginOptions,
+	OAuthProvider,
+	OAuthProviderId,
+	OAuthProviderInfo,
+} from "./utils/oauth/types";
+export * from "./utils/overflow";
+export * from "./utils/provider-safety-stop";
+export * from "./utils/retry";
+export * from "./utils/schema";
+export * from "./utils/tool-choice-capability";
+export * from "./utils/validation";