@vib-rato/ai 0.17.3 → 0.19.0

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [0.19.0] - 2026-09-14
+
+### Added
+
+- Air-gapped mode support (`VIB_AIRV=1`, see the coding-agent changelog): the models.dev catalog fetch, `AuthStorage.fetchUsageReports`, both auth-broker request paths, OAuth token refresh and API-key acquisition, and proxy resolution return early or refuse before any network is touched; the proxied TLS socket path classifies its destination; and `SqliteAuthCredentialStore` accepts `excludeProviders` so excluded providers' credential rows are never read from SQLite. Provider model discovery against a private endpoint is unaffected.
+
+## [0.18.0] - 2026-09-08
+
+- Transport failure facts now retain the Vibrato Usage Gateway's `x-vug-daily-limit`, `x-vug-daily-used`, `x-vug-daily-remaining`, `x-vug-daily-reset`, `x-vug-queue-depth`, `x-vug-inflight`, and `x-vug-queued-ms` headers (raw string values, allowlisted like the existing `retry-after`/`retry-after-ms` entries), and classify a gateway `daily_token_limit` provider code as a `quota` fallback trigger instead of `rate_limit`. Previously the gateway's daily-limit 429 was treated as an ordinary rate limit with a 12-hour retry window, and the `x-vug-daily-*` headers were dropped before reaching consumers. A code-less 429 still classifies as `rate_limit`, and 503 `queue_timeout`/`queue_full` still classify as `server`.
+- OpenAI Codex HTTP failures with an empty response body and empty status text now include the HTTP status in the surfaced message instead of the opaque `Request failed`, while structured provider errors retain their existing messages and classification.
+- OAuth callback responses now serialize provider-controlled result fields as safe JSON script data, preventing callback values from terminating the embedded state element while preserving exact JSON values and callback behavior.
+- Bundled `anthropic/claude-fable-5-1` (Claude Fable 5.1): 1M context, 128K output, `anthropic-adaptive` thinking clamped to `xhigh` on the Messages API, matching the Fable 5 effort ladder exactly. The model is served only by Anthropic's first-party API and requires a Claude Code compatibility version of at least `2.1.251`; older fingerprints are answered with an HTTP 400 `claude_code_version_too_old`, which the `2.1.257` attribution bump clears. Verified live: `2.1.219` returns the 400, `2.1.257` returns 200, `low`/`high`/`xhigh` all stream, and adaptive thinking returns visible summarized content rather than signature-only billed thinking.
+- OpenAI Codex WebSockets are now opt-in on Windows. Bun 1.4.0 can segfault in its Windows TLS WebSocket handshake, so the automatic model preference uses SSE on Windows while the explicit WebSocket setting remains available for operators who have a newer safe runtime.
 ## [0.17.3] - 2026-09-03
 
 ## [0.17.2] - 2026-09-03

package/dist/types/auth-storage.d.ts

@@ -1013,10 +1013,24 @@ export declare class AuthStorage {
  * `getApiKey`, `listProviders`, `deleteProvider`) that callers can use directly
  * without going through `AuthStorage`.
  */
+/**
+ * `excludeProviders` removes those providers from every credential *read* at
+ * the SQL level: the listing statements carry a `provider NOT IN (…)` clause,
+ * so the `data` column of an excluded row is never fetched and its payload
+ * never enters the process. Writes are untouched — this hides rows from a
+ * reader, it does not make the store forget them.
+ *
+ * The air-gapped mode (`airv`) is the caller: hosted-provider credentials must
+ * not be read at all, while local-endpoint keys live in the same database and
+ * must keep working.
+ */
+export interface SqliteAuthCredentialStoreOptions {
+    excludeProviders?: readonly string[];
+}
 export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
     #private;
-    constructor(db: Database);
-    static open(dbPath?: string): Promise<SqliteAuthCredentialStore>;
+    constructor(db: Database, options?: SqliteAuthCredentialStoreOptions);
+    static open(dbPath?: string, options?: SqliteAuthCredentialStoreOptions): Promise<SqliteAuthCredentialStore>;
     listAuthCredentials(provider?: string): StoredAuthCredential[];
     listCredentialInventory(provider?: string): CredentialInventoryRecord[];
     listCredentialRemovalTargets(provider?: string): CredentialRemovalTarget[];

package/dist/types/providers/anthropic.d.ts

@@ -107,7 +107,7 @@ export interface CpaToolAliasRestoreFailure {
  */
 export declare function parseCpaToolAliasRestoreFailure(error: unknown): CpaToolAliasRestoreFailure | undefined;
 export declare function isCpaToolAliasRestoreFailure(error: unknown): boolean;
-export declare const claudeCodeVersion = "2.1.219";
+export declare const claudeCodeVersion = "2.1.257";
 export declare const claudeCodeEntrypoint = "sdk-cli";
 export declare const claudeToolPrefix: string;
 export declare const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";

package/dist/types/providers/openai-codex-responses.d.ts

@@ -25,6 +25,12 @@ export declare function normalizeCodexToolChoice(choice: ToolChoice | undefined,
 export declare function formatCodexUserAgent(platform: string, release: string, arch: string): string;
 export declare const streamOpenAICodexResponses: StreamFunction<"openai-codex-responses">;
 export declare function prewarmOpenAICodexResponses(model: Model<"openai-codex-responses">, options?: Pick<OpenAICodexResponsesOptions, "apiKey" | "headers" | "sessionId" | "signal" | "preferWebsockets" | "providerSessionState">): Promise<void>;
+/**
+ * Bun 1.4.0's Windows WebSocket client can segfault during TLS handshakes.
+ * Keep the model's websocket preference available on other platforms, while
+ * requiring an explicit opt-in on Windows until the bundled runtime is fixed.
+ */
+export declare function isCodexWebSocketSafeByDefault(platform?: NodeJS.Platform): boolean;
 export interface OpenAICodexTransportDetails {
     websocketPreferred: boolean;
     lastTransport?: CodexTransport;

package/dist/types/types.d.ts

@@ -997,6 +997,18 @@ export interface LongContextPricing {
     threshold: number;
     cost: ModelCost;
 }
+/**
+ * Capability facts the serving endpoint advertised for a discovered model
+ * (the `vibrato` object on its OpenAI-style models-list entry). Only fields
+ * that describe what the model can do are carried: a hint can never redirect a
+ * request or change its credentials.
+ */
+export interface DiscoveredModelHint {
+    name?: string;
+    reasoning?: boolean;
+    thinking?: ThinkingConfig;
+    compat?: Pick<OpenAICompat, "supportsReasoningEffort" | "reasoningContentField" | "thinkingFormat">;
+}
 export interface Model<TApi extends Api = any> {
     id: string;
     name: string;
@@ -1022,6 +1034,12 @@ export interface Model<TApi extends Api = any> {
     maxTokens: number;
     /** Explicit models.yml/model-override authority; absent keeps the safe transport default. */
     maxTokensSource?: ModelMaxTokensSource;
+    /**
+     * What the endpoint advertised about this model at discovery time. Kept on
+     * the model so a cached discovery restores it; the registry applies it after
+     * provider overrides and before the user's model overrides.
+     */
+    discoveryHint?: DiscoveredModelHint;
     headers?: Record<string, string>;
     /**
      * Streaming transport override. When `"pi-native"`, `streamSimple` routes

package/dist/types/utils/fallback-transport.d.ts

@@ -35,8 +35,9 @@ export type TransportHeaders = Headers | Record<string, string | undefined>;
  * Structured facts from an upstream HTTP or transport failure. Retry decisions
  * must use these facts rather than provider- or application-owned error text.
  *
- * `headers` is always a plain record limited to the retained retry-signal
- * entries: facts travel on persisted `AssistantMessage`s and through
+ * `headers` is always a plain record limited to the retained retry and
+ * gateway quota/queue signal entries: facts travel on persisted
+ * `AssistantMessage`s and through
  * `structuredClone` snapshots (managed fallback attempt staging), so they must
  * never carry a live `Headers` instance — cloning one throws `DataCloneError`
  * ("The object can not be cloned.") and masks the real provider failure.

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@vib-rato/ai",
-	"version": "0.17.3",
+	"version": "0.19.0",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://github.com/Keonho-Chu/Vibrato",
 	"author": "Yeachan-Heo and Vibrato Contributors",
@@ -40,8 +40,8 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@vib-rato/natives": "0.17.3",
-		"@vib-rato/utils": "0.17.3",
+		"@vib-rato/natives": "0.19.0",
+		"@vib-rato/utils": "0.19.0",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-broker/client.ts

@@ -5,7 +5,8 @@
  * `vib auth-broker status` (liveness checks). All endpoints except
  * `/v1/healthz` require a bearer token.
  */
-import { readSseEvents } from "@vib-rato/utils";
+import { logger, readSseEvents } from "@vib-rato/utils";
+import { AIR_REFUSAL_MESSAGE, isAirMode } from "@vib-rato/utils/air/mode";
 import type { ZodType, infer as zInfer } from "zod/v4";
 import type { AuthCredential } from "../auth-storage";
 import type { Provider } from "../types";
@@ -201,6 +202,13 @@ export class AuthBrokerClient {
 	 * to long-polling for the remainder of its lifetime.
 	 */
 	async *openSnapshotStream(opts: { signal?: AbortSignal } = {}): AsyncGenerator<SnapshotStreamEvent> {
+		if (isAirMode()) {
+			logger.debug("airv: skipped auth-broker-snapshot-stream", {
+				feature: "auth-broker-snapshot-stream",
+				destination: "auth-broker",
+			});
+			throw new AuthBrokerError(AIR_REFUSAL_MESSAGE);
+		}
 		const url = `${this.#baseUrl}/v1/snapshot/stream`;
 		const headers: Record<string, string> = {
 			Accept: "text/event-stream",
@@ -389,6 +397,13 @@ export class AuthBrokerClient {
 			timeoutMs?: number;
 		},
 	): Promise<Response> {
+		if (isAirMode()) {
+			logger.debug("airv: skipped auth-broker-request", {
+				feature: "auth-broker-request",
+				destination: "auth-broker",
+			});
+			throw new AuthBrokerError(AIR_REFUSAL_MESSAGE);
+		}
 		const auth = opts.auth ?? true;
 		const url = `${this.#baseUrl}${path}`;
 		const headers: Record<string, string> = { Accept: "application/json", ...(opts.headers ?? {}) };

package/src/auth-storage.ts

@@ -12,6 +12,7 @@ import * as crypto from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { getAgentDbPath, logger } from "@vib-rato/utils";
+import { isAirMode } from "@vib-rato/utils/air/mode";
 import { checkOpenCodexStatus } from "./providers/openai-opencodex-responses";
 import { getEnvApiKey } from "./stream";
 import type { Provider } from "./types";
@@ -4127,6 +4128,13 @@ export class AuthStorage {
 		/** Disable provider/account/error logging for secret-safe control surfaces. */
 		logDetails?: boolean;
 	}): Promise<UsageReport[] | null> {
+		if (isAirMode()) {
+			logger.debug("airv: skipped auth-storage-usage-reports", {
+				feature: "auth-storage-usage-reports",
+				destination: "usage-api",
+			});
+			return [];
+		}
 		// Caller override > store-level hook > local per-credential fan-out.
 		// `RemoteAuthCredentialStore` implements the store hook so a gateway
 		// backed by a broker automatically routes usage to the broker without
@@ -6411,8 +6419,24 @@ function extractOAuthTokenIdentifiers(token: string | undefined): string[] | und
  * `getApiKey`, `listProviders`, `deleteProvider`) that callers can use directly
  * without going through `AuthStorage`.
  */
+/**
+ * `excludeProviders` removes those providers from every credential *read* at
+ * the SQL level: the listing statements carry a `provider NOT IN (…)` clause,
+ * so the `data` column of an excluded row is never fetched and its payload
+ * never enters the process. Writes are untouched — this hides rows from a
+ * reader, it does not make the store forget them.
+ *
+ * The air-gapped mode (`airv`) is the caller: hosted-provider credentials must
+ * not be read at all, while local-endpoint keys live in the same database and
+ * must keep working.
+ */
+export interface SqliteAuthCredentialStoreOptions {
+	excludeProviders?: readonly string[];
+}
+
 export class SqliteAuthCredentialStore implements AuthCredentialStore {
 	#db: Database;
+	readonly #excludedProviders: readonly string[];
 	#listActiveStmt: Statement;
 	#listActiveByProviderStmt: Statement;
 	#listAllStmt: Statement;
@@ -6432,21 +6456,35 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 	#deleteExpiredCacheStmt: Statement;
 	#closed = false;
 
-	constructor(db: Database) {
+	constructor(db: Database, options: SqliteAuthCredentialStoreOptions = {}) {
 		this.#db = db;
 		this.#initializeSchema();
+		this.#excludedProviders = Object.freeze(
+			[...new Set((options.excludeProviders ?? []).map(provider => provider.trim().toLowerCase()))].filter(
+				provider => provider.length > 0,
+			),
+		);
+		// One extra `AND provider NOT IN (…)` folded into the listing statements
+		// when an exclusion is configured; with none, the SQL is byte-identical to
+		// what it has always been.
+		const notExcluded =
+			this.#excludedProviders.length === 0
+				? ""
+				: ` AND lower(provider) NOT IN (${this.#excludedProviders.map(() => "?").join(", ")})`;
 
 		this.#listActiveStmt = this.#db.prepare(
-			"SELECT id, provider, credential_type, data, disabled_cause, identity_key, revision FROM auth_credentials WHERE disabled_cause IS NULL ORDER BY id ASC",
+			`SELECT id, provider, credential_type, data, disabled_cause, identity_key, revision FROM auth_credentials WHERE disabled_cause IS NULL${notExcluded} ORDER BY id ASC`,
 		);
 		this.#listActiveByProviderStmt = this.#db.prepare(
-			"SELECT id, provider, credential_type, data, disabled_cause, identity_key, revision FROM auth_credentials WHERE provider = ? AND disabled_cause IS NULL ORDER BY id ASC",
+			`SELECT id, provider, credential_type, data, disabled_cause, identity_key, revision FROM auth_credentials WHERE provider = ? AND disabled_cause IS NULL${notExcluded} ORDER BY id ASC`,
 		);
 		this.#listAllStmt = this.#db.prepare(
-			"SELECT id, provider, credential_type, data, disabled_cause, identity_key, revision FROM auth_credentials ORDER BY id ASC",
+			`SELECT id, provider, credential_type, data, disabled_cause, identity_key, revision FROM auth_credentials${
+				notExcluded === "" ? "" : ` WHERE 1 = 1${notExcluded}`
+			} ORDER BY id ASC`,
 		);
 		this.#listAllByProviderStmt = this.#db.prepare(
-			"SELECT id, provider, credential_type, data, disabled_cause, identity_key, revision FROM auth_credentials WHERE provider = ? ORDER BY id ASC",
+			`SELECT id, provider, credential_type, data, disabled_cause, identity_key, revision FROM auth_credentials WHERE provider = ?${notExcluded} ORDER BY id ASC`,
 		);
 		this.#listDisabledByProviderStmt = this.#db.prepare(
 			"SELECT id, provider, credential_type, data, disabled_cause, identity_key, revision FROM auth_credentials WHERE provider = ? AND disabled_cause IS NOT NULL ORDER BY id ASC",
@@ -6481,7 +6519,10 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		this.#deleteExpiredCacheStmt = this.#db.prepare(`DELETE FROM cache WHERE expires_at <= ${SQLITE_NOW_EPOCH}`);
 	}
 
-	static async open(dbPath: string = getAgentDbPath()): Promise<SqliteAuthCredentialStore> {
+	static async open(
+		dbPath: string = getAgentDbPath(),
+		options: SqliteAuthCredentialStoreOptions = {},
+	): Promise<SqliteAuthCredentialStore> {
 		const dir = path.dirname(dbPath);
 		const dirExists = await fs
 			.stat(dir)
@@ -6498,7 +6539,7 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 			// Ignore chmod failures (e.g., Windows)
 		}
 
-		return new SqliteAuthCredentialStore(db);
+		return new SqliteAuthCredentialStore(db, options);
 	}
 
 	#initializeSchema(): void {
@@ -6722,11 +6763,17 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 
 	// ─── AuthCredentialStore interface ──────────────────────────────────────
 
+	/** True when reads must not see this provider's rows at all. */
+	#isExcludedProvider(provider: string): boolean {
+		return this.#excludedProviders.includes(provider.trim().toLowerCase());
+	}
+
 	listAuthCredentials(provider?: string): StoredAuthCredential[] {
+		if (provider !== undefined && this.#isExcludedProvider(provider)) return [];
 		const rows =
 			(provider
-				? (this.#listActiveByProviderStmt.all(provider) as AuthRow[])
-				: (this.#listActiveStmt.all() as AuthRow[])) ?? [];
+				? (this.#listActiveByProviderStmt.all(provider, ...this.#excludedProviders) as AuthRow[])
+				: (this.#listActiveStmt.all(...this.#excludedProviders) as AuthRow[])) ?? [];
 
 		const results: StoredAuthCredential[] = [];
 		for (const row of rows) {
@@ -6738,10 +6785,11 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 	}
 
 	listCredentialInventory(provider?: string): CredentialInventoryRecord[] {
+		if (provider !== undefined && this.#isExcludedProvider(provider)) return [];
 		const rows =
 			provider === undefined
-				? (this.#listAllStmt.all() as AuthRow[])
-				: (this.#listAllByProviderStmt.all(provider) as AuthRow[]);
+				? (this.#listAllStmt.all(...this.#excludedProviders) as AuthRow[])
+				: (this.#listAllByProviderStmt.all(provider, ...this.#excludedProviders) as AuthRow[]);
 		const results: CredentialInventoryRecord[] = [];
 		for (const row of rows) {
 			const credential = deserializeCredential(row);
@@ -6766,10 +6814,11 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 	}
 
 	listCredentialRemovalTargets(provider?: string): CredentialRemovalTarget[] {
+		if (provider !== undefined && this.#isExcludedProvider(provider)) return [];
 		const rows =
 			provider === undefined
-				? (this.#listAllStmt.all() as AuthRow[])
-				: (this.#listAllByProviderStmt.all(provider) as AuthRow[]);
+				? (this.#listAllStmt.all(...this.#excludedProviders) as AuthRow[])
+				: (this.#listAllByProviderStmt.all(provider, ...this.#excludedProviders) as AuthRow[]);
 		return rows.map(row => ({ id: row.id, provider: row.provider, expectedRevision: row.revision }));
 	}
 	removeAuthCredentialsHard(

package/src/model-manager.ts

@@ -1,4 +1,5 @@
-import { sanitizeText } from "@vib-rato/utils";
+import { logger, sanitizeText } from "@vib-rato/utils";
+import { isAirMode } from "@vib-rato/utils/air/mode";
 import { applyFinalCodexGpt56ContextCap } from "./context-cap-policy";
 import { insertModelCacheIfAbsent, readModelCache, updateModelCacheIfUnchanged, writeModelCache } from "./model-cache";
 import { isRetiredModel, isRetiredModelKey } from "./model-retirements";
@@ -178,6 +179,13 @@ async function resolveProviderModelsUncoalesced<TApi extends Api = Api, TModelsD
 	options: ModelManagerOptions<TApi, TModelsDevPayload>,
 	strategy: ModelRefreshStrategy = "online-if-uncached",
 ): Promise<ModelResolutionResult<TApi>> {
+	// airv only blocks the models.dev destination (see `fetchModelsDev` below),
+	// not this whole resolution: a provider's own `fetchDynamicModels` talks to
+	// its configured `baseUrl` (e.g. a local vLLM/Ollama gateway), which is a
+	// destination the EgressGuard and the provider's own boundary classification
+	// gate, not a feature this layer should suppress wholesale. Forcing
+	// `strategy = "offline"` here would also skip that fetcher, leaving airv
+	// users unable to discover local models without hand-writing every entry.
 	const now = options.now ?? Date.now;
 	const ttlMs = options.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS;
 	const dbPath = options.cacheDbPath;
@@ -405,6 +413,13 @@ async function fetchModelsDev<TApi extends Api, TModelsDevPayload>(
 	if (!options.modelsDev) {
 		return null;
 	}
+	if (isAirMode()) {
+		// airv blocks only the models.dev destination here; a provider's own
+		// `fetchDynamicModels` (its configured baseUrl) is unaffected — see the
+		// comment in `resolveProviderModelsUncoalesced` above.
+		logger.debug("airv: skipped models-dev-fetch", { feature: "models-dev-fetch", destination: "models.dev" });
+		return null;
+	}
 
 	try {
 		const payload = await options.modelsDev.fetch();

package/src/model-thinking.ts

@@ -230,7 +230,6 @@ export function modelSupportsReasoningControl<TApi extends Api>(
 	resolvedBaseUrl?: string,
 ): boolean {
 	if (!model.reasoning) return false;
-
 	if (model.api === "openai-completions") {
 		const completionsModel = model as ApiModel<"openai-completions">;
 		const explicitSupport = completionsModel.compat?.supportsReasoningEffort;
@@ -346,6 +345,18 @@ export function clampThinkingLevelForModel<TApi extends Api>(
 	if (!modelSupportsReasoningControl(model) || requested === undefined) {
 		return undefined;
 	}
+	if (model.api === "anthropic-messages" && model.provider === "anthropic") {
+		const baseUrl = model.baseUrl;
+		try {
+			const url = new URL(baseUrl || "https://api.anthropic.com");
+			if (url.protocol !== "https:" || url.hostname !== "api.anthropic.com") return undefined;
+		} catch {
+			return undefined;
+		}
+	}
+	if (!model.thinking) {
+		return undefined;
+	}
 
 	const levels = getSupportedEfforts(model);
 	if (levels.includes(requested)) {

package/src/models.json

@@ -3853,6 +3853,31 @@
 				"maxLevel": "xhigh"
 			}
 		},
+		"claude-fable-5-1": {
+			"id": "claude-fable-5-1",
+			"name": "Anthropic Fable 5.1",
+			"api": "anthropic-messages",
+			"provider": "anthropic",
+			"baseUrl": "https://api.anthropic.com",
+			"reasoning": true,
+			"input": [
+				"text",
+				"image"
+			],
+			"cost": {
+				"input": 10,
+				"output": 50,
+				"cacheRead": 0.25,
+				"cacheWrite": 12.5
+			},
+			"contextWindow": 1000000,
+			"maxTokens": 128000,
+			"thinking": {
+				"mode": "anthropic-adaptive",
+				"minLevel": "minimal",
+				"maxLevel": "xhigh"
+			}
+		},
 		"claude-haiku-4-5": {
 			"id": "claude-haiku-4-5",
 			"name": "Anthropic Haiku 4.5 (latest)",

package/src/providers/anthropic.d.ts

@@ -107,7 +107,7 @@ export interface CpaToolAliasRestoreFailure {
  */
 export declare function parseCpaToolAliasRestoreFailure(error: unknown): CpaToolAliasRestoreFailure | undefined;
 export declare function isCpaToolAliasRestoreFailure(error: unknown): boolean;
-export declare const claudeCodeVersion = "2.1.219";
+export declare const claudeCodeVersion = "2.1.257";
 export declare const claudeCodeEntrypoint = "sdk-cli";
 export declare const claudeToolPrefix: string;
 export declare const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";

package/src/providers/anthropic.ts

@@ -828,7 +828,7 @@ function getCacheControl(
 }
 
 // Stealth mode: Mimic Anthropic Code headers and tool prefixing.
-export const claudeCodeVersion = "2.1.219";
+export const claudeCodeVersion = "2.1.257";
 export const claudeCodeEntrypoint = "sdk-cli";
 export const claudeToolPrefix: string = "proxy_";
 export const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";

package/src/providers/openai-codex/response-handler.ts

@@ -25,7 +25,7 @@ const REQUEST_BLOCKED_MESSAGE_RE = /^\s*request blocked\b/i;
 
 export async function parseCodexError(response: Response): Promise<CodexErrorInfo> {
 	const raw = await response.text();
-	let message = raw || response.statusText || "Request failed";
+	let message = raw || response.statusText || `Codex request failed (HTTP ${response.status})`;
 	let friendlyMessage: string | undefined;
 	let rateLimits: CodexRateLimits | undefined;
 	let code: string | undefined;

package/src/providers/openai-codex-responses.d.ts

@@ -25,6 +25,12 @@ export declare function normalizeCodexToolChoice(choice: ToolChoice | undefined,
 export declare function formatCodexUserAgent(platform: string, release: string, arch: string): string;
 export declare const streamOpenAICodexResponses: StreamFunction<"openai-codex-responses">;
 export declare function prewarmOpenAICodexResponses(model: Model<"openai-codex-responses">, options?: Pick<OpenAICodexResponsesOptions, "apiKey" | "headers" | "sessionId" | "signal" | "preferWebsockets" | "providerSessionState">): Promise<void>;
+/**
+ * Bun 1.4.0's Windows WebSocket client can segfault during TLS handshakes.
+ * Keep the model's websocket preference available on other platforms, while
+ * requiring an explicit opt-in on Windows until the bundled runtime is fixed.
+ */
+export declare function isCodexWebSocketSafeByDefault(platform?: NodeJS.Platform): boolean;
 export interface OpenAICodexTransportDetails {
     websocketPreferred: boolean;
     lastTransport?: CodexTransport;

package/src/providers/openai-codex-responses.ts

@@ -2307,6 +2307,15 @@ function recordCodexWebSocketFailure(state: CodexWebSocketSessionState, activate
 	}
 }
 
+/**
+ * Bun 1.4.0's Windows WebSocket client can segfault during TLS handshakes.
+ * Keep the model's websocket preference available on other platforms, while
+ * requiring an explicit opt-in on Windows until the bundled runtime is fixed.
+ */
+export function isCodexWebSocketSafeByDefault(platform: NodeJS.Platform = process.platform): boolean {
+	return platform !== "win32";
+}
+
 function shouldUseCodexWebSocket(
 	model: Model<"openai-codex-responses">,
 	state: CodexWebSocketSessionState | undefined,
@@ -2314,7 +2323,11 @@ function shouldUseCodexWebSocket(
 ): boolean {
 	if (!state || state.disableWebsocket) return false;
 	if (preferWebsockets === false) return false;
-	return isCodexWebSocketEnvEnabled() || preferWebsockets === true || model.preferWebsockets === true;
+	return (
+		isCodexWebSocketEnvEnabled() ||
+		preferWebsockets === true ||
+		(isCodexWebSocketSafeByDefault() && model.preferWebsockets === true)
+	);
 }
 
 export interface OpenAICodexTransportDetails {
@@ -2372,7 +2385,9 @@ export function getOpenAICodexTransportDetails(
 	const websocketPreferred =
 		options?.preferWebsockets === false
 			? false
-			: isCodexWebSocketEnvEnabled() || options?.preferWebsockets === true || model.preferWebsockets === true;
+			: isCodexWebSocketEnvEnabled() ||
+				options?.preferWebsockets === true ||
+				(isCodexWebSocketSafeByDefault() && model.preferWebsockets === true);
 	const state = getCodexWebSocketStateForPublicSession(model, options);
 
 	return {

package/src/providers/pi-native-client.ts

@@ -49,6 +49,29 @@ const NON_WIRE_KEYS = new Set<keyof SimpleStreamOptions>([
 	"fallbackAttempt",
 ]);
 
+/**
+ * Project the caller's {@link Context} onto the wire schema. Runtime tool
+ * objects routinely carry harness-only state (runners, session managers,
+ * fs-stat BigInts) that must never be serialized: BigInt fields make
+ * `JSON.stringify` throw outright, and the rest is dead weight the gateway
+ * re-derives from its own tool registry. Only the protocol-meaningful,
+ * JSON-safe `Tool` fields cross the wire.
+ */
+function buildWireContext(context: Context): Context {
+	if (!context.tools || context.tools.length === 0) return context;
+	return {
+		...context,
+		tools: context.tools.map(tool => ({
+			name: tool.name,
+			description: tool.description,
+			parameters: tool.parameters,
+			...(tool.strict !== undefined ? { strict: tool.strict } : {}),
+			...(tool.customFormat !== undefined ? { customFormat: tool.customFormat } : {}),
+			...(tool.customWireName !== undefined ? { customWireName: tool.customWireName } : {}),
+		})),
+	};
+}
+
 function buildWireOptions(options: SimpleStreamOptions | undefined): Record<string, unknown> {
 	if (!options) return {};
 	const wire: Record<string, unknown> = {};
@@ -166,7 +189,7 @@ export function streamPiNative<TApi extends Api>(
 			const headers = buildHeaders(model as Model<Api>, options?.apiKey);
 			const body = JSON.stringify({
 				modelId: model.id,
-				context,
+				context: buildWireContext(context),
 				options: buildWireOptions(options),
 				stream: true,
 			});

package/src/types.d.ts

@@ -997,6 +997,18 @@ export interface LongContextPricing {
     threshold: number;
     cost: ModelCost;
 }
+/**
+ * Capability facts the serving endpoint advertised for a discovered model
+ * (the `vibrato` object on its OpenAI-style models-list entry). Only fields
+ * that describe what the model can do are carried: a hint can never redirect a
+ * request or change its credentials.
+ */
+export interface DiscoveredModelHint {
+    name?: string;
+    reasoning?: boolean;
+    thinking?: ThinkingConfig;
+    compat?: Pick<OpenAICompat, "supportsReasoningEffort" | "reasoningContentField" | "thinkingFormat">;
+}
 export interface Model<TApi extends Api = any> {
     id: string;
     name: string;
@@ -1022,6 +1034,12 @@ export interface Model<TApi extends Api = any> {
     maxTokens: number;
     /** Explicit models.yml/model-override authority; absent keeps the safe transport default. */
     maxTokensSource?: ModelMaxTokensSource;
+    /**
+     * What the endpoint advertised about this model at discovery time. Kept on
+     * the model so a cached discovery restores it; the registry applies it after
+     * provider overrides and before the user's model overrides.
+     */
+    discoveryHint?: DiscoveredModelHint;
     headers?: Record<string, string>;
     /**
      * Streaming transport override. When `"pi-native"`, `streamSimple` routes

package/src/types.ts

@@ -1213,6 +1213,19 @@ export interface LongContextPricing {
 	cost: ModelCost;
 }
 
+/**
+ * Capability facts the serving endpoint advertised for a discovered model
+ * (the `vibrato` object on its OpenAI-style models-list entry). Only fields
+ * that describe what the model can do are carried: a hint can never redirect a
+ * request or change its credentials.
+ */
+export interface DiscoveredModelHint {
+	name?: string;
+	reasoning?: boolean;
+	thinking?: ThinkingConfig;
+	compat?: Pick<OpenAICompat, "supportsReasoningEffort" | "reasoningContentField" | "thinkingFormat">;
+}
+
 export interface Model<TApi extends Api = any> {
 	id: string;
 	name: string;
@@ -1238,6 +1251,12 @@ export interface Model<TApi extends Api = any> {
 	maxTokens: number;
 	/** Explicit models.yml/model-override authority; absent keeps the safe transport default. */
 	maxTokensSource?: ModelMaxTokensSource;
+	/**
+	 * What the endpoint advertised about this model at discovery time. Kept on
+	 * the model so a cached discovery restores it; the registry applies it after
+	 * provider overrides and before the user's model overrides.
+	 */
+	discoveryHint?: DiscoveredModelHint;
 	headers?: Record<string, string>;
 	/**
 	 * Streaming transport override. When `"pi-native"`, `streamSimple` routes

package/src/utils/fallback-transport.d.ts

@@ -35,8 +35,9 @@ export type TransportHeaders = Headers | Record<string, string | undefined>;
  * Structured facts from an upstream HTTP or transport failure. Retry decisions
  * must use these facts rather than provider- or application-owned error text.
  *
- * `headers` is always a plain record limited to the retained retry-signal
- * entries: facts travel on persisted `AssistantMessage`s and through
+ * `headers` is always a plain record limited to the retained retry and
+ * gateway quota/queue signal entries: facts travel on persisted
+ * `AssistantMessage`s and through
  * `structuredClone` snapshots (managed fallback attempt staging), so they must
  * never carry a live `Headers` instance — cloning one throws `DataCloneError`
  * ("The object can not be cloned.") and masks the real provider failure.

package/src/utils/fallback-transport.ts

@@ -40,8 +40,9 @@ export type TransportHeaders = Headers | Record<string, string | undefined>;
  * Structured facts from an upstream HTTP or transport failure. Retry decisions
  * must use these facts rather than provider- or application-owned error text.
  *
- * `headers` is always a plain record limited to the retained retry-signal
- * entries: facts travel on persisted `AssistantMessage`s and through
+ * `headers` is always a plain record limited to the retained retry and
+ * gateway quota/queue signal entries: facts travel on persisted
+ * `AssistantMessage`s and through
  * `structuredClone` snapshots (managed fallback attempt staging), so they must
  * never carry a live `Headers` instance — cloning one throws `DataCloneError`
  * ("The object can not be cloned.") and masks the real provider failure.
@@ -147,14 +148,29 @@ function stringValue(value: unknown): string | undefined {
 	return typeof value === "string" ? value : undefined;
 }
 
-/** Retry-signal headers retained on transport facts; everything else is dropped. */
-const RETAINED_TRANSPORT_HEADERS = ["retry-after", "retry-after-ms"] as const;
+/**
+ * Retry-signal headers retained on transport facts; everything else is
+ * dropped. The `x-vug-*` entries are the Vibrato Usage Gateway's quota and
+ * queue-depth signals; their values are preserved as raw strings and
+ * interpreted by consumers, not by this module.
+ */
+const RETAINED_TRANSPORT_HEADERS = [
+	"retry-after",
+	"retry-after-ms",
+	"x-vug-daily-limit",
+	"x-vug-daily-used",
+	"x-vug-daily-remaining",
+	"x-vug-daily-reset",
+	"x-vug-queue-depth",
+	"x-vug-inflight",
+	"x-vug-queued-ms",
+] as const;
 
 const RETAINED_TRANSPORT_HEADER_SET: ReadonlySet<string> = new Set(RETAINED_TRANSPORT_HEADERS);
 
 /**
- * Reduce transport headers to the retained retry-signal entries in a plain
- * record, so facts stay structured-cloneable and JSON-serializable and never
+ * Reduce transport headers to the retained retry and gateway quota/queue
+ * signal entries in a plain record, so facts stay structured-cloneable and JSON-serializable and never
  * persist arbitrary response headers into session files.
  *
  * Exception-safe by contract: inspection uses only `Headers.get()` results
@@ -276,9 +292,22 @@ export function transportFailureFacts(
 	};
 }
 
+/**
+ * Exception-safe by contract: `new Headers(record)` throws on an invalid
+ * header value (e.g. a CRLF in a gateway-supplied timestamp like
+ * `x-vug-daily-reset`), and the retained record is otherwise free-form
+ * provider input. A throw here falls through to `undefined` — the same
+ * "no retry hint" result as if no headers were retained at all — instead of
+ * propagating a TypeError out of classification.
+ */
 function headersOf(headers: TransportHeaders | undefined): Headers | undefined {
 	if (headers instanceof Headers) return headers;
-	return headers ? new Headers(headers as Record<string, string>) : undefined;
+	if (!headers) return undefined;
+	try {
+		return new Headers(headers as Record<string, string>);
+	} catch {
+		return undefined;
+	}
 }
 
 function parseRetryAfterSeconds(value: string | null, now = Date.now()): number | undefined {
@@ -305,7 +334,12 @@ function isQuotaCode(code: string | undefined): boolean {
 		code === "quota_exhausted" ||
 		code === "usage_limit_reached" ||
 		code === "usage_not_included" ||
-		code === "out_of_credits"
+		code === "out_of_credits" ||
+		// Vibrato Usage Gateway daily-limit code: a 429 with this code is a
+		// quota exhaustion, not an ordinary rate limit, even though the
+		// gateway's retry-after window can be many hours long. A code-less
+		// 429 from an older gateway still falls through to `rate_limit`.
+		code === "daily_token_limit"
 	);
 }
 

package/src/utils/oauth/callback-server.ts

@@ -19,6 +19,13 @@ const DEFAULT_TIMEOUT = 300_000;
 const DEFAULT_HOSTNAME = "localhost";
 const CALLBACK_PATH = "/callback";
 
+function serializeScriptData(value: unknown): string {
+	return JSON.stringify(value)
+		.replaceAll("<", "\\u003c")
+		.replaceAll("\u2028", "\\u2028")
+		.replaceAll("\u2029", "\\u2029");
+}
+
 export type CallbackResult = { code: string; state: string };
 
 export interface OAuthCallbackFlowOptions {
@@ -259,7 +266,7 @@ export abstract class OAuthCallbackFlow {
 		});
 
 		return new Response(
-			(templateHtml as unknown as string).replaceAll("__OAUTH_STATE__", JSON.stringify(resultState)),
+			(templateHtml as unknown as string).replaceAll("__OAUTH_STATE__", () => serializeScriptData(resultState)),
 			{
 				status: resultState.ok ? 200 : 500,
 				headers: { "Content-Type": "text/html" },

package/src/utils/oauth/index.ts

@@ -1,6 +1,7 @@
 // ============================================================================
 // High-level API
 // ============================================================================
+import { AIR_REFUSAL_MESSAGE, isAirMode } from "@vib-rato/utils/air/mode";
 import type {
 	OAuthCredentials,
 	OAuthProvider,
@@ -332,6 +333,12 @@ export async function refreshOAuthToken(
 	provider: OAuthProvider,
 	credentials: OAuthCredentials,
 ): Promise<OAuthCredentials> {
+	// Rule (c): a refresh POSTs a stored credential to a provider token endpoint
+	// and runs without an explicit user command, so it is refused before the
+	// provider module is even imported. `@vib-rato/ai` cannot reach
+	// coding-agent's `AirRefusedError`, so the standard message is thrown
+	// directly; the string itself is the shared constant.
+	if (isAirMode()) throw new Error(AIR_REFUSAL_MESSAGE);
 	if (!credentials) {
 		throw new Error(`No OAuth credentials found for ${provider}`);
 	}
@@ -476,6 +483,10 @@ export async function getOAuthApiKey(
 	provider: OAuthProvider,
 	credentials: Record<string, OAuthCredentials>,
 ): Promise<{ newCredentials: OAuthCredentials; apiKey: string } | null> {
+	// Rule (c): handing back an OAuth access token exists only to authenticate a
+	// request to that provider's cloud endpoint. Refuse ahead of the lookup so no
+	// credential is read, not merely unused.
+	if (isAirMode()) throw new Error(AIR_REFUSAL_MESSAGE);
 	let creds = credentials[provider];
 	if (!creds) {
 		return null;

package/src/utils/proxy.ts

@@ -1,5 +1,7 @@
 import * as net from "node:net";
 import * as tls from "node:tls";
+import { classifyDestination } from "@vib-rato/utils/air/boundary";
+import { AIR_REFUSAL_MESSAGE, airAllowedSuffixes, isAirMode } from "@vib-rato/utils/air/mode";
 
 export interface ProxyConnectOptions {
 	signal?: AbortSignal;
@@ -248,6 +250,10 @@ function matchesNoProxy(hostname: string, port: number | undefined): boolean {
 }
 
 export function getProxyForUrl(provider: string, url: URL): string | undefined {
+	// airv: a proxy is by definition a third host, and this function already
+	// declines to proxy private targets, so in air-gapped mode a proxy is never
+	// the right answer. Refuse unconditionally rather than dial an env-supplied host.
+	if (isAirMode()) return undefined;
 	const hostname = normalizeHost(url.hostname);
 	if (!hostname || isPrivateOrLocalHost(hostname) || matchesNoProxy(hostname, effectiveUrlPort(url))) return undefined;
 
@@ -586,6 +592,18 @@ export function connectProxiedSocket(
 	targetUrl: string,
 	options: ProxyConnectOptions = {},
 ): Promise<tls.TLSSocket> {
+	// airv defense in depth. `getProxyForUrl` already returns undefined in
+	// air-gapped mode, so nothing should reach here; classify anyway, because
+	// these raw `net.connect` / `tls.connect` sockets never pass the fetch guard.
+	if (isAirMode()) {
+		const suffixes = airAllowedSuffixes();
+		const target = classifyDestination(targetUrl, suffixes);
+		const proxy = classifyDestination(proxyUrl, suffixes);
+		if (!target.allowed || !proxy.allowed) {
+			const reason = target.allowed ? (proxy as { reason: string }).reason : (target as { reason: string }).reason;
+			return Promise.reject(transportError(`${AIR_REFUSAL_MESSAGE} (${reason})`));
+		}
+	}
 	const { promise, resolve, reject } = Promise.withResolvers<tls.TLSSocket>();
 	const sockets = new Set<net.Socket>();
 	const abortController = new AbortController();