@xiaoso/dsh-tool-plus 0.1.5 → 0.1.7-beta.0

package/lib/anthropic-CXfWlp-x.mjs

@@ -0,0 +1,105 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { r as __exportAll } from "./fs-promises-shim-Bx0fpxuk.mjs";
+import { V as ProviderHttpError, f as OAuthError } from "./error-CORgGg5a.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/providers/claude-code-fingerprint.ts
+/**
+* Claude Code inference-fingerprint constants, kept in a leaf module so consumers
+* outside the provider (`registry/oauth/anthropic`, `usage/claude`) don't
+* import the heavy `providers/anthropic` module.
+*
+* That import edge was a live init cycle: `providers/anthropic` → `stream` →
+* `registry` → `registry/oauth/anthropic` → back into the still-initializing
+* provider module.
+*/
+/** Current Claude Code CLI version represented on the Anthropic wire. */
+const claudeCodeVersion = "2.1.257";
+/** `@anthropic-ai/sdk` version bundled by the current Claude Code release. */
+const claudeCodeSdkVersion = "0.112.1";
+/** User-Agent emitted by Claude Code's CLI inference entrypoint. */
+const claudeCodeUserAgent = `claude-cli/${claudeCodeVersion} (external, cli)`;
+/** Identity block prepended by Claude Code's CLI runtime. */
+const claudeCodeSystemInstruction = "You are Claude Code, Anthropic's official CLI for Claude.";
+/** Claude Code's per-request output-token ceiling. */
+const CLAUDE_CODE_MAX_OUTPUT_TOKENS = 64e3;
+//#endregion
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/anthropic.ts
+/**
+* Anthropic (Claude Pro/Max) sign-in residue. The OAuth flow itself is
+* declared in `rules/auth/anthropic.kdl`; this module supplies the
+* `anthropic-identity` after-exchange hook that recovers account /
+* organization identity from `/api/claude_cli/bootstrap` when the token
+* response omits it.
+*/
+var anthropic_exports = /* @__PURE__ */ __exportAll({
+	ANTHROPIC_OAUTH_GRANT_TTL_MS: () => ANTHROPIC_OAUTH_GRANT_TTL_MS,
+	anthropicIdentityHook: () => anthropicIdentityHook,
+	fetchAnthropicBootstrapIdentity: () => fetchAnthropicBootstrapIdentity
+});
+const BOOTSTRAP_URL = "https://api.anthropic.com/api/claude_cli/bootstrap";
+const CLAUDE_CODE_BOOTSTRAP_MODEL = "claude-opus-4-8";
+const CLAUDE_CODE_BOOTSTRAP_USER_AGENT = `claude-code/${claudeCodeVersion}`;
+function nonEmpty(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+/** Fetches the signed-in account/org identity Claude Code's CLI bootstrap reports. */
+async function fetchAnthropicBootstrapIdentity(accessToken, fetchImpl) {
+	const url = `${BOOTSTRAP_URL}?entrypoint=cli&model=${encodeURIComponent(CLAUDE_CODE_BOOTSTRAP_MODEL)}`;
+	const response = await fetchImpl(url, {
+		method: "GET",
+		headers: {
+			Accept: "application/json, text/plain, */*",
+			Authorization: `Bearer ${accessToken}`,
+			"Content-Type": "application/json",
+			"User-Agent": CLAUDE_CODE_BOOTSTRAP_USER_AGENT,
+			"anthropic-beta": "oauth-2025-04-20"
+		},
+		signal: AbortSignal.timeout(3e4)
+	});
+	const responseBody = await response.text();
+	if (!response.ok) throw new ProviderHttpError(`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`, response.status);
+	let data;
+	try {
+		data = JSON.parse(responseBody);
+	} catch (error) {
+		throw new OAuthError(`Anthropic bootstrap returned invalid JSON. url=${url}; body=${responseBody}`, {
+			kind: "validation",
+			provider: "anthropic",
+			cause: error
+		});
+	}
+	return {
+		accountId: nonEmpty(data.oauth_account?.account_uuid),
+		email: nonEmpty(data.oauth_account?.account_email),
+		orgId: nonEmpty(data.oauth_account?.organization_uuid),
+		orgName: nonEmpty(data.oauth_account?.organization_name)
+	};
+}
+/**
+* `anthropic-identity` hook: fills account (and, at login only, organization)
+* identity from the bootstrap endpoint when the token response left it
+* unset. The org an access token is scoped to is captured once at login and
+* deliberately never refreshed — rewriting identity during background
+* refreshes could silently re-key stored credentials.
+*/
+const anthropicIdentityHook = async (credentials, context) => {
+	const includeOrg = context.phase === "login";
+	const orgSatisfied = !includeOrg || credentials.orgId !== void 0;
+	if (credentials.accountId && credentials.email && orgSatisfied) return credentials;
+	try {
+		const bootstrap = await fetchAnthropicBootstrapIdentity(credentials.access, context.fetch);
+		return {
+			...credentials,
+			accountId: credentials.accountId ?? bootstrap.accountId,
+			email: credentials.email ?? bootstrap.email,
+			...includeOrg ? {
+				orgId: credentials.orgId ?? bootstrap.orgId,
+				orgName: credentials.orgName ?? bootstrap.orgName
+			} : {}
+		};
+	} catch {
+		return credentials;
+	}
+};
+//#endregion
+export { claudeCodeUserAgent as a, claudeCodeSystemInstruction as i, CLAUDE_CODE_MAX_OUTPUT_TOKENS as n, claudeCodeVersion as o, claudeCodeSdkVersion as r, anthropic_exports as t };

package/lib/{aws-credentials-B20dliS7.mjs → anthropic-wire-CKuhDwZ1.mjs}

@@ -1,13 +1,16 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { I as $flag, P as $env, S as debug, y as isEnoent } from "./src-BcD0_rQR.mjs";
-import { H as AwsCredentialsError } from "./error-C-f_Wnw4.mjs";
-import { n as raceWithSignal } from "./abort-Cwwm4Err.mjs";
-import { i as isLocalOrMetadataHost } from "./proxy-D9lm7ONA.mjs";
+import { $ as isEnoent, F as $flag, N as $env, b as debug } from "./src-BwW51vA5.mjs";
+import { H as AwsCredentialsError } from "./error-CORgGg5a.mjs";
+import "./utils-CUPhpw9A.mjs";
+import { n as isRecord } from "./type-guards-CttAANEx.mjs";
+import { n as raceWithSignal } from "./abort-Caqff3M6.mjs";
+import { r as isLocalOrMetadataHost } from "./proxy-5nWqRL1f.mjs";
+import "./effort-BdtQMN-_.mjs";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as os from "node:os";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/utils/aws-profile.ts
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/utils/aws-profile.ts
 function parseAwsIni(text) {
 	const out = {};
 	let current = null;
@@ -84,8 +87,8 @@ function profileHasCredentialSource(profile, credentialsIni, configIni, seen) {
 	if (seen.has(profile)) return false;
 	seen.add(profile);
 	const merged = {
-		...configIni?.[profile] ?? {},
-		...credentialsIni?.[profile] ?? {}
+		...configIni?.[profile],
+		...credentialsIni?.[profile]
 	};
 	if (merged.role_arn) {
 		if (merged.web_identity_token_file) return true;
@@ -107,11 +110,11 @@ function profileHasCredentialSource(profile, credentialsIni, configIni, seen) {
 	return !!(session?.sso_start_url && session.sso_region);
 }
 //#endregion
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/types.ts
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/types.ts
 /** Credentials are resolved by the provider transport rather than used as a bearer string. */
 const AUTHENTICATED_SENTINEL = "<authenticated>";
 //#endregion
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/aws.ts
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/aws.ts
 function isEc2Host() {
 	const checks = [
 		["/sys/hypervisor/uuid", (v) => v.startsWith("ec2")],
@@ -142,7 +145,7 @@ function resolveAwsBearerToken(apiKey, bearerToken) {
 	return bearerToken || (apiKey === "<authenticated>" ? void 0 : apiKey) || $env.AWS_BEARER_TOKEN_BEDROCK;
 }
 //#endregion
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/providers/aws-sigv4.ts
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/providers/aws-sigv4.ts
 const ALGORITHM = "AWS4-HMAC-SHA256";
 const KEY_TYPE = "aws4_request";
 const UNSIGNABLE = {
@@ -285,7 +288,7 @@ async function signRequest(params) {
 	return out;
 }
 //#endregion
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/providers/aws-credentials.ts
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/providers/aws-credentials.ts
 /**
 * AWS credential resolution for the Bedrock provider.
 *
@@ -415,8 +418,8 @@ async function resolveProfileChain(profile, ctx, seen) {
 	if (seen.has(profile)) throw new AwsCredentialsError(`AWS profile role chain contains a cycle at '${profile}'.`, "profile");
 	seen.add(profile);
 	const merged = {
-		...ctx.configIni?.[profile] ?? {},
-		...ctx.credentialsIni?.[profile] ?? {}
+		...ctx.configIni?.[profile],
+		...ctx.credentialsIni?.[profile]
 	};
 	if (Object.keys(merged).length === 0) return void 0;
 	if (merged.role_arn) return assumeRoleFromProfile(profile, merged, ctx, seen);
@@ -864,4 +867,61 @@ function invalidateAwsCredentialCache(opts = {}) {
 	cache.delete(credentialCacheKey(profile, region, shouldLoadAwsSharedConfig(opts.profile)));
 }
 //#endregion
-export { resolveAwsRegistryApiKey as a, resolveAwsRegion as c, resolveAwsBearerToken as i, resolveAwsCredentials as n, AUTHENTICATED_SENTINEL as o, signRequest as r, resolveAwsAmbientRegion as s, invalidateAwsCredentialCache as t };
+//#region node_modules/.pnpm/@oh-my-pi+pi-catalog@18.1.17/node_modules/@oh-my-pi/pi-catalog/src/model-thinking.ts
+/**
+* Returns the supported thinking efforts declared on the model metadata.
+* Empty for non-reasoning models and for reasoning models without a
+* controllable effort surface (`thinking: undefined`).
+*/
+function getSupportedEfforts(model) {
+	if (!model.reasoning) return [];
+	return model.thinking?.efforts ?? [];
+}
+function requireSupportedEffort(model, effort) {
+	if (!model.reasoning) throw new Error(`Model ${model.provider}/${model.id} does not support thinking`);
+	const levels = getSupportedEfforts(model);
+	if (!levels.includes(effort)) throw new Error(`Thinking effort ${effort} is not supported by ${model.provider}/${model.id}. Supported efforts: ${levels.join(", ")}`);
+	return effort;
+}
+/**
+* Maps a normalized thinking effort to Anthropic adaptive effort values via
+* the model's baked `thinking.effortMap` (identity for unmapped efforts).
+*/
+function mapEffortToAnthropicAdaptiveEffort(model, effort) {
+	const supported = requireSupportedEffort(model, effort);
+	return model.thinking?.effortMap?.[supported] ?? supported;
+}
+/**
+* Resolves the upstream wire model id for a request at the given effort
+* (`undefined` = thinking off). Collapsed effort-tier variants route through
+* `thinking.effortRouting`; everything else falls back to
+* `requestModelId ?? id`.
+*/
+function resolveWireModelId(model, effort) {
+	return model.thinking?.effortRouting?.[effort ?? "off"] ?? model.requestModelId ?? model.id;
+}
+//#endregion
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/providers/anthropic-wire.ts
+/** Beta enabling preserved-thinking block controls and transformation reports. */
+const THINKING_BINDING_CONTROLS_BETA = "thinking-binding-controls-2026-08-01";
+/** True when a block is complete Anthropic server-tool history omp can replay. */
+function isAnthropicServerToolHistoryBlock(block) {
+	if (block.type === "server_tool_use") return (block.name === "web_search" || block.name === "tool_search_tool_regex" || block.name === "tool_search_tool_bm25") && typeof block.id === "string" && block.id.length > 0;
+	if (block.type === "web_search_tool_result" || block.type === "tool_search_tool_result") return typeof block.tool_use_id === "string" && block.tool_use_id.length > 0 && Object.hasOwn(block, "content");
+	return false;
+}
+/** Parse Anthropic's forward-compatible input transformation list. */
+function parseAnthropicInputTransformations(value) {
+	if (!Array.isArray(value)) return [];
+	const transformations = [];
+	for (const entry of value) {
+		if (!isRecord(entry) || typeof entry.type !== "string") continue;
+		transformations.push({
+			...entry,
+			type: entry.type
+		});
+	}
+	return transformations;
+}
+//#endregion
+export { mapEffortToAnthropicAdaptiveEffort as a, invalidateAwsCredentialCache as c, resolveAwsBearerToken as d, resolveAwsRegistryApiKey as f, resolveAwsRegion as h, getSupportedEfforts as i, resolveAwsCredentials as l, resolveAwsAmbientRegion as m, isAnthropicServerToolHistoryBlock as n, requireSupportedEffort as o, AUTHENTICATED_SENTINEL as p, parseAnthropicInputTransformations as r, resolveWireModelId as s, THINKING_BINDING_CONTROLS_BETA as t, signRequest as u };

package/lib/{api-key-login-CIDnXeYd.mjs → api-key-validation-CGCJFbFr.mjs}

@@ -1,7 +1,7 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { V as ProviderHttpError, _ as OnPromptRequiredError, h as LoginCancelledError, m as ApiKeyRequiredError } from "./error-C-f_Wnw4.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/api-key-validation.ts
+import { B as OpenAIHttpError, V as ProviderHttpError } from "./error-CORgGg5a.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/api-key-validation.ts
 const VALIDATION_TIMEOUT_MS = 15e3;
 function normalizeAnthropicCompatibleBaseUrl(baseUrl) {
 	const trimmed = baseUrl.trim().replace(/\/+$/, "");
@@ -10,13 +10,30 @@ function normalizeAnthropicCompatibleBaseUrl(baseUrl) {
 function resolveValidationHeaders(headers) {
 	return typeof headers === "function" ? headers() : headers;
 }
-async function createApiKeyValidationError(provider, response) {
+async function readErrorEnvelope(response) {
 	let details = "";
 	try {
 		details = (await response.text()).trim();
 	} catch {}
+	let bodyJson;
+	try {
+		bodyJson = details ? JSON.parse(details) : void 0;
+	} catch {
+		bodyJson = void 0;
+	}
+	const { code } = OpenAIHttpError.parseEnvelope(bodyJson, details);
+	return {
+		details,
+		code
+	};
+}
+async function createApiKeyValidationError(provider, response, envelope) {
+	const { details, code } = envelope ?? await readErrorEnvelope(response);
 	const message = details ? `${provider} API key validation failed (${response.status}): ${details}` : `${provider} API key validation failed (${response.status})`;
-	return new ProviderHttpError(message, response.status, { headers: response.headers });
+	return new ProviderHttpError(message, response.status, {
+		headers: response.headers,
+		code
+	});
 }
 /**
 * Validate an API key against an OpenAI-compatible chat completions endpoint.
@@ -38,13 +55,15 @@ async function validateOpenAICompatibleApiKey(options) {
 				role: "user",
 				content: "ping"
 			}],
-			max_tokens: 1,
+			[options.maxTokensField ?? "max_tokens"]: options.maxTokens ?? 1,
 			temperature: 0
 		}),
 		signal
 	});
 	if (response.ok) return;
-	throw await createApiKeyValidationError(options.provider, response);
+	const envelope = await readErrorEnvelope(response);
+	if (options.tolerateModelDenied && response.status === 401 && envelope.code === "invalid_model") return;
+	throw await createApiKeyValidationError(options.provider, response, envelope);
 }
 /**
 * Validate an API key against an Anthropic-compatible messages endpoint.
@@ -85,7 +104,7 @@ async function validateApiKeyAgainstModelsEndpoint(options) {
 	const response = await (options.fetch ?? fetch)(options.modelsUrl, {
 		method: "GET",
 		headers: {
-			...resolveValidationHeaders(options.headers) ?? {},
+			...resolveValidationHeaders(options.headers),
 			Authorization: `Bearer ${options.apiKey}`
 		},
 		signal
@@ -94,64 +113,4 @@ async function validateApiKeyAgainstModelsEndpoint(options) {
 	throw await createApiKeyValidationError(options.provider, response);
 }
 //#endregion
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/api-key-login.ts
-/**
-* Shared factory for API-key-paste "login" flows.
-*
-* Several providers (Cerebras, Synthetic, Moonshot, Together, NanoGPT, ZenMux)
-* don't actually implement OAuth — they just ask the user to paste an API key,
-* optionally validate it, and return the trimmed key.
-*/
-function createApiKeyLogin(config) {
-	return async function login(options) {
-		if (!options.onPrompt) throw new OnPromptRequiredError(config.providerLabel);
-		if (config.authUrl && config.instructions) options.onAuth?.({
-			url: config.authUrl,
-			instructions: config.instructions
-		});
-		const apiKey = config.emptyKeyFallback === void 0 ? await options.onPrompt({
-			message: config.promptMessage,
-			placeholder: config.placeholder
-		}) : await options.onPrompt({
-			message: config.promptMessage,
-			placeholder: config.placeholder,
-			allowEmpty: true
-		});
-		if (options.signal?.aborted) throw new LoginCancelledError();
-		const trimmed = apiKey.trim();
-		if (!trimmed) {
-			if (config.emptyKeyFallback !== void 0) return config.emptyKeyFallback;
-			throw new ApiKeyRequiredError();
-		}
-		if (config.validation) {
-			options.onProgress?.("Validating API key...");
-			if (config.validation.kind === "chat-completions") await validateOpenAICompatibleApiKey({
-				provider: config.validation.provider,
-				apiKey: trimmed,
-				baseUrl: config.validation.baseUrl,
-				model: config.validation.model,
-				signal: options.signal,
-				fetch: options.fetch
-			});
-			else if (config.validation.kind === "anthropic-messages") await validateAnthropicCompatibleApiKey({
-				provider: config.validation.provider,
-				apiKey: trimmed,
-				baseUrl: config.validation.baseUrl,
-				model: config.validation.model,
-				signal: options.signal,
-				fetch: options.fetch
-			});
-			else await validateApiKeyAgainstModelsEndpoint({
-				provider: config.validation.provider,
-				apiKey: trimmed,
-				modelsUrl: typeof config.validation.modelsUrl === "function" ? config.validation.modelsUrl() : config.validation.modelsUrl,
-				headers: config.validation.headers,
-				signal: options.signal,
-				fetch: options.fetch
-			});
-		}
-		return trimmed;
-	};
-}
-//#endregion
-export { validateApiKeyAgainstModelsEndpoint as n, validateOpenAICompatibleApiKey as r, createApiKeyLogin as t };
+export { validateApiKeyAgainstModelsEndpoint as n, validateOpenAICompatibleApiKey as r, validateAnthropicCompatibleApiKey as t };

package/lib/{azure-openai-responses-BkhsLmN3.mjs → azure-openai-responses-ChFbWaGj.mjs}

@@ -1,15 +1,15 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
 import { r as __exportAll } from "./fs-promises-shim-Bx0fpxuk.mjs";
-import { P as $env } from "./src-BcD0_rQR.mjs";
-import { B as OpenAIHttpError, g as MissingApiKeyError, l as finalize, n as StreamTimeoutError, s as ProviderResponseError, t as ConfigurationError, v as AbortError } from "./error-C-f_Wnw4.mjs";
-import { L as sanitizeSchemaForOpenAIResponses, k as toolWireSchema, s as resolveCacheRetention } from "./utils-Cp2Mxf_U.mjs";
-import { C as applyResponsesReasoningParams, D as buildResponsesInput, K as getOpenAIPromptCacheKey, N as createInitialResponsesAssistantMessage, Q as isOpenAIResponsesProgressEvent, g as applyCommonResponsesSamplingParams, it as parseAzureDeploymentNameMap, n as getEnvApiKey, ot as processResponsesStream, yt as mapToOpenAIResponsesToolChoice } from "./stream-Bjq8wjfr.mjs";
-import { t as createAbortSourceTracker } from "./abort-Cwwm4Err.mjs";
-import { t as AssistantMessageEventStream } from "./event-stream-Dh2guZxS.mjs";
-import { n as getOpenAIStreamFirstEventTimeoutMs, o as iterateWithIdleTimeout, r as getOpenAIStreamIdleTimeoutMs } from "./idle-iterator-CYAxUkSD.mjs";
-import { c as postOpenAIStream, r as createOpenAIReasoningEffortFallbackKey, s as resolveOpenAIReasoningEffortFallback, t as applyOpenAIReasoningEffortFallback } from "./openai-reasoning-fallback-DXsfiSXO.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/providers/azure-openai-responses.ts
+import { N as $env } from "./src-BwW51vA5.mjs";
+import { B as OpenAIHttpError, _ as AbortError, c as finalize, h as MissingApiKeyError, n as StreamTimeoutError, s as ProviderResponseError, t as ConfigurationError } from "./error-CORgGg5a.mjs";
+import { A as toolWireSchema, c as resolveCacheRetention, z as sanitizeSchemaForOpenAIResponses } from "./utils-CUPhpw9A.mjs";
+import { At as withReplaySafeStreamRetry, Et as mapToOpenAIResponsesToolChoice, F as buildResponsesInput, V as createInitialResponsesAssistantMessage, dt as parseAzureDeploymentNameMap, et as getOpenAIPromptCacheKey, j as applyResponsesReasoningParams, n as getEnvApiKey, ot as isOpenAIResponsesProgressEvent, pt as processResponsesStream, w as applyCommonResponsesSamplingParams } from "./stream-B_7qN-bA.mjs";
+import { t as createAbortSourceTracker } from "./abort-Caqff3M6.mjs";
+import { t as AssistantMessageEventStream } from "./event-stream-ulcDenZD.mjs";
+import { n as getOpenAIStreamFirstEventTimeoutMs, o as iterateWithIdleTimeout, r as getOpenAIStreamIdleTimeoutMs } from "./idle-iterator-DlUkEfzW.mjs";
+import { c as postOpenAIStream, r as createOpenAIReasoningEffortFallbackKey, s as resolveOpenAIReasoningEffortFallback, t as applyOpenAIReasoningEffortFallback } from "./openai-reasoning-fallback-BdB3RCbj.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/providers/azure-openai-responses.ts
 var azure_openai_responses_exports = /* @__PURE__ */ __exportAll({ streamAzureOpenAIResponses: () => streamAzureOpenAIResponses });
 const DEFAULT_AZURE_API_VERSION = "v1";
 const AZURE_OPENAI_RESPONSES_FIRST_EVENT_TIMEOUT_MESSAGE = "Azure OpenAI responses stream timed out while waiting for the first event";
@@ -17,11 +17,8 @@ function resolveDeploymentName(model, options) {
 	if (options?.azureDeploymentName) return options.azureDeploymentName;
 	return parseAzureDeploymentNameMap($env.AZURE_OPENAI_DEPLOYMENT_NAME_MAP).get(model.id) ?? model.id;
 }
-/**
-* Generate function for Azure OpenAI Responses API
-*/
-const streamAzureOpenAIResponses = (model, context, options) => {
-	if (options?.promptCache?.mode === "explicit" && resolveCacheRetention(options.cacheRetention) !== "none") throw new ConfigurationError(`OpenAI explicit prompt caching is unsupported for ${model.provider}/${model.id}; Azure Responses does not emit explicit cache controls.`);
+/** Runs one Azure OpenAI Responses request and decodes its event stream. */
+const streamAzureOpenAIResponsesOnce = (model, context, options) => {
 	const stream = new AssistantMessageEventStream();
 	(async () => {
 		const startTime = performance.now();
@@ -156,6 +153,19 @@ const streamAzureOpenAIResponses = (model, context, options) => {
 	})();
 	return stream;
 };
+/**
+* Retries transient Azure stream failures only before assistant output commits
+* the attempt. The unsupported explicit prompt-cache config is rejected
+* synchronously here — callers of the direct entrypoint get the immediate
+* `ConfigurationError` rather than a stream whose `.result()` rejects later.
+*/
+const streamAzureOpenAIResponses = (model, context, options) => {
+	if (options?.promptCache?.mode === "explicit" && resolveCacheRetention(options.cacheRetention) !== "none") throw new ConfigurationError(`OpenAI explicit prompt caching is unsupported for ${model.provider}/${model.id}; Azure Responses does not emit explicit cache controls.`);
+	return withReplaySafeStreamRetry(model, context, options, streamAzureOpenAIResponsesOnce, {
+		retryProviderErrors: true,
+		maxProviderErrorRetries: 1
+	});
+};
 function resolveAzureConfig(model, options) {
 	const apiVersion = options?.azureApiVersion || $env.AZURE_OPENAI_API_VERSION || DEFAULT_AZURE_API_VERSION;
 	const baseUrl = options?.azureBaseUrl?.trim() || $env.AZURE_OPENAI_BASE_URL?.trim() || void 0;
@@ -197,7 +207,7 @@ function buildAzureResponsesRequest(model, apiKey, options) {
 	}
 	const headers = {
 		"api-key": apiKey,
-		...model.headers ?? {}
+		...model.headers
 	};
 	if (options?.headers) Object.assign(headers, options.headers);
 	const { baseUrl, apiVersion } = resolveAzureConfig(model, options);
@@ -223,7 +233,8 @@ function buildParams(model, context, options, deploymentName) {
 			},
 			includeThinkingSignatures: true,
 			developerStringContent: true,
-			preserveAssistantMessageIds: true
+			preserveAssistantMessageIds: true,
+			repairOrphanOutputs: true
 		}),
 		stream: true,
 		prompt_cache_key: getOpenAIPromptCacheKey(options),

package/lib/{browser-render-CmgvSNte.mjs → browser-render-9o0Rknop.mjs}

@@ -1,7 +1,7 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { t as ensureChromiumExecutable } from "./launch-BmgEUycu.mjs";
-import { l as htmlToBasicMarkdown } from "./types-DX_bvuus.mjs";
+import { t as ensureChromiumExecutable } from "./launch-DKDH71En.mjs";
+import { l as htmlToBasicMarkdown } from "./types-PVueGi9S.mjs";
 //#region src/tools/omp/browser/readable.ts
 /** Trim to non-empty string or undefined. */
 function normalize(text) {
@@ -9,12 +9,12 @@ function normalize(text) {
 }
 let readabilityModule;
 async function loadReadability() {
-	if (!readabilityModule) readabilityModule = await import("./readability-Cpm-ocau.mjs");
+	if (!readabilityModule) readabilityModule = await import("./readability-uGhqb4GC.mjs");
 	return readabilityModule;
 }
 let domModule;
 async function loadDom() {
-	if (!domModule) domModule = await import("./dom-CawWi8fa.mjs");
+	if (!domModule) domModule = await import("./dom-DG3sPESc.mjs");
 	return domModule;
 }
 /**

package/lib/bun-shim.mjs

@@ -4,6 +4,50 @@ import * as path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import { gzipSync } from "node:zlib";
 import JSON5 from "json5";
+//#region src/tools/bash/which.ts
+/**
+* Minimal PATH (+ PATHEXT on Windows) executable lookup — the plugin's single
+* implementation of `Bun.which` semantics on the Node runtime.
+*
+* Two callers, one scanner: DSH code that must resolve executables the way OMP
+* does (procmgr `resolveWindowsShell` for shell discovery, `REJECT_PROMPT_COMMAND`
+* in non-interactive-env) calls `findOnPath` directly, and the bun-shim installs
+* `Bun.which` on top of it — which is also how upstream pi-utils' `$which` lands
+* here (@oh-my-pi/pi-utils src/which.ts:201 calls `Bun.which` on non-darwin).
+* Single implementation — any new caller resolves executables through here,
+* never hand-rolls a PATH walk.
+* @module @xiaoso/dsh-tool-plus/bash/which
+*/
+/** Windows default extension order when PATHEXT is unset. */
+const WIN32_DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
+/** True when `command` carries its own directory component. */
+function hasPathSeparator(command) {
+	return command.includes("/") || command.includes("\\");
+}
+/**
+* Resolve `command` against PATH the way `Bun.which` would: absolute/relative
+* candidates are returned as-is when they name an existing file; bare names
+* are looked up in each PATH dir (appending PATHEXT extensions on win32, in
+* order). Returns the first existing regular file, or `undefined`.
+*/
+function findOnPath(command, env = process.env) {
+	if (command.length === 0) return void 0;
+	if (hasPathSeparator(command)) try {
+		return fs.statSync(command).isFile() ? path.resolve(command) : void 0;
+	} catch {
+		return;
+	}
+	const dirs = (env.PATH ?? "").split(path.delimiter).filter(Boolean);
+	const extensions = process.platform === "win32" ? (env.PATHEXT && env.PATHEXT.length > 0 ? env.PATHEXT : WIN32_DEFAULT_PATHEXT).split(";").filter(Boolean) : [];
+	const candidates = process.platform === "win32" ? [command, ...extensions.map((ext) => command + ext)] : [command];
+	for (const dir of dirs) for (const candidate of candidates) {
+		const full = path.join(dir, candidate);
+		try {
+			if (fs.statSync(full).isFile()) return full;
+		} catch {}
+	}
+}
+//#endregion
 //#region src/tools/shared/bun-shim.ts
 /**
 * DSH Bun compatibility shim — installs a Node implementation of the `Bun`
@@ -276,18 +320,35 @@ function xxHash64Core(bytes, seed) {
 	h ^= h >> 32n;
 	return h & MASK64;
 }
-function bunHash(data) {
+/**
+* `Bun.hash(input, seed?)` — FNV-1a 32-bit stand-in, seeded form included.
+*
+* The seed is load-bearing: pi-utils folds `command` → `cwd` → `PATH` into one
+* cache key by re-seeding at each step (@oh-my-pi/pi-utils src/which.ts:207-209),
+* so a shim that drops the seed collapses every command sharing a PATH onto a
+* single `$which` cache slot (`$which("b")` returning `a`'s path). FNV steps are
+* bijections mod 2^32, so distinct seeds stay distinct for equal input — exactly
+* what a cache key needs. Single-argument values are unchanged (no seed → FNV
+* offset basis).
+*/
+function bunHash(data, seed) {
 	let bytes;
 	if (typeof data === "string") bytes = new TextEncoder().encode(data);
 	else if (data instanceof ArrayBuffer) bytes = new Uint8Array(data);
 	else bytes = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
-	let h = 2166136261;
+	let h = seedToBasis(seed);
 	for (const b of bytes) {
 		h ^= b;
 		h = Math.imul(h, 16777619) >>> 0;
 	}
 	return h >>> 0;
 }
+/** Seed → FNV-1a offset basis (non-finite numbers fall back to the default). */
+function seedToBasis(seed) {
+	if (seed === void 0) return 2166136261;
+	if (typeof seed === "bigint") return Number(BigInt.asUintN(32, seed)) >>> 0;
+	return Number.isFinite(seed) ? Math.trunc(seed) >>> 0 : 2166136261;
+}
 function isWideChar(c) {
 	return c >= 4352 && (c <= 4447 || c === 9001 || c === 9002 || c >= 11904 && c <= 42191 && c !== 12351 || c >= 44032 && c <= 55203 || c >= 63744 && c <= 64255 || c >= 65040 && c <= 65049 || c >= 65072 && c <= 65135 || c >= 65280 && c <= 65376 || c >= 65504 && c <= 65510 || c >= 127744 && c <= 129791 || c >= 131072 && c <= 262141);
 }
@@ -618,6 +679,13 @@ function bunStripANSI(text) {
 	}
 	return out;
 }
+function bunWhich(command, options) {
+	const cwd = options?.cwd;
+	return findOnPath(cwd !== void 0 && !path.isAbsolute(command) && (command.includes("/") || command.includes("\\")) ? path.resolve(cwd, command) : command, options?.PATH !== void 0 ? {
+		...process.env,
+		PATH: options.PATH
+	} : process.env) ?? null;
+}
 function installBunShim() {
 	patchBase64();
 	const g = globalThis;
@@ -626,6 +694,7 @@ function installBunShim() {
 		file: (p) => new BunFileShim(p),
 		write: bunWrite,
 		env: process.env,
+		which: bunWhich,
 		sleep: bunSleep,
 		hash: bunHash,
 		randomUUIDv7: bunRandomUUIDv7,

package/lib/{bundled-references-ChZSPDFw.mjs → bundled-references-DY3EJxZV.mjs}

@@ -1,8 +1,8 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { i as getBundledProviders, r as getBundledModels } from "./models-DRA2c_8U.mjs";
-import { r as isZeroCostXaiOAuthReference } from "./identity-HNO1Oe9B.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-catalog@17.3.5/node_modules/@oh-my-pi/pi-catalog/src/provider-models/bundled-references.ts
+import { i as getBundledProviders, r as getBundledModels } from "./models-DnXMYGcJ.mjs";
+import { n as isZeroCostXaiOAuthReference } from "./reference-CtvM4zLU.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-catalog@18.1.17/node_modules/@oh-my-pi/pi-catalog/src/provider-models/bundled-references.ts
 /**
 * Project a built `Model` back to spec stage: `compat` becomes the verbatim
 * sparse override record (`compatConfig`), never the resolved view. Discovery
@@ -10,9 +10,10 @@ import { r as isZeroCostXaiOAuthReference } from "./identity-HNO1Oe9B.mjs";
 * manager, which rebuilds via `buildModel`.
 */
 function toModelSpec(model) {
-	const { compat: _compat, compatConfig, ...rest } = model;
+	const { compat: _compat, compatConfig, supportsComputerUse: _derivedComputerUse, supportsComputerUseConfig, ...rest } = model;
 	return {
 		...rest,
+		...supportsComputerUseConfig !== void 0 ? { supportsComputerUse: supportsComputerUseConfig } : {},
 		compat: compatConfig
 	};
 }
@@ -27,7 +28,7 @@ function getGlobalReferences() {
 	const references = /* @__PURE__ */ new Map();
 	for (const provider of getBundledProviders()) for (const model of getBundledModels(provider)) {
 		const candidate = model;
-		if (isZeroCostXaiOAuthReference(candidate)) continue;
+		if (candidate.provider === "cline-pass" || isZeroCostXaiOAuthReference(candidate)) continue;
 		const existing = references.get(candidate.id);
 		if (!existing) references.set(candidate.id, candidate);
 		else if (candidate.contextWindow !== existing.contextWindow) {