@xiaoso/dsh-tool-plus 0.1.6 → 0.1.7-beta.0

package/THIRD_PARTY_NOTICES.md

@@ -7,9 +7,15 @@ Scope of ported upstream code:
 
 - from **oh-my-pi** (MIT, notice below): the tool suite sources under
   `src/tools/` (bash runtime, read, write, edit, grep, glob, plus the OMP
-  `omp/` engine sources they wrap), and the hashline patch engine fused
-  in-repo at `src/tools/hashline/engine/` (upstream `packages/hashline`,
-  with small Node-runtime adaptations).
+  `omp/` engine sources they wrap), and the thin hashline adapter at
+  `src/tools/hashline/native/` (`diff-preview.ts` is a verbatim port of the
+  former upstream TypeScript engine). The hashline engine itself is no longer
+  vendored: since oh-my-pi 18.x it lives in Rust (`crates/pi-edit`) and reaches
+  this plugin through the `@oh-my-pi/pi-natives` dependency, which ships
+  upstream's compiled binary.
+- upstream hashline **test fixtures** vendored for regression testing under
+  `src/tools/hashline/test/fixtures/` (copied from
+  `crates/pi-edit/tests/fixtures/hashline/`), MIT, same notice below.
 
 ---
 

package/lib/{abort-Cwwm4Err.mjs → abort-Caqff3M6.mjs}

@@ -1,7 +1,7 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { v as AbortError } from "./error-C-f_Wnw4.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/utils/abort.ts
+import { _ as AbortError } from "./error-CORgGg5a.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/utils/abort.ts
 /**
 * Tracks whether a merged request signal was aborted by the caller or by provider-local logic.
 *

package/lib/alibaba-coding-plan-DTupMiAi.mjs

@@ -0,0 +1,73 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { g as OnPromptRequiredError, m as LoginCancelledError, p as ApiKeyRequiredError, t as ConfigurationError } from "./error-CORgGg5a.mjs";
+import { n as validateApiKeyAgainstModelsEndpoint, r as validateOpenAICompatibleApiKey } from "./api-key-validation-CGCJFbFr.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/alibaba-coding-plan.ts
+const DEFAULT_AUTH_URL = "https://modelstudio.console.alibabacloud.com/";
+const CHINA_AUTH_URL = "https://bailian.console.aliyun.com/?tab=model#/api-key";
+const DEFAULT_API_BASE_URL = "https://coding-intl.dashscope.aliyuncs.com/v1";
+const CHINA_API_BASE_URL = "https://coding.dashscope.aliyuncs.com/v1";
+const VALIDATION_MODEL = "qwen3.5-plus";
+async function loginAlibabaCodingPlan(options) {
+	if (!options.onPrompt) throw new OnPromptRequiredError("Alibaba Coding Plan");
+	const endpointChoice = await options.onPrompt({
+		message: "Select Alibaba Coding Plan endpoint: 1=International (default), 2=China, 3=Custom — enter 1, 2, or 3",
+		placeholder: "1"
+	});
+	if (options.signal?.aborted) throw new LoginCancelledError();
+	const choice = endpointChoice.trim();
+	let baseUrl;
+	let authUrl;
+	let instructions;
+	if (choice === "2") {
+		baseUrl = CHINA_API_BASE_URL;
+		authUrl = CHINA_AUTH_URL;
+		instructions = "Copy your API key from the Alibaba Cloud Bailian console (China mainland)";
+	} else if (choice === "3") {
+		const trimmedUrl = (await options.onPrompt({
+			message: "Enter custom base URL",
+			placeholder: "https://your-proxy.com/v1"
+		})).trim().replace(/\/+$/, "");
+		if (!trimmedUrl) throw new ConfigurationError("Custom URL is required for option 3");
+		baseUrl = trimmedUrl;
+		authUrl = DEFAULT_AUTH_URL;
+		instructions = "Copy your API key from the Alibaba Cloud DashScope console";
+	} else {
+		baseUrl = DEFAULT_API_BASE_URL;
+		authUrl = DEFAULT_AUTH_URL;
+		instructions = "Copy your API key from the Alibaba Cloud DashScope console (International)";
+	}
+	options.onAuth?.({
+		url: authUrl,
+		instructions
+	});
+	const apiKey = await options.onPrompt({
+		message: "Paste your Alibaba Coding Plan API key",
+		placeholder: "sk-..."
+	});
+	if (options.signal?.aborted) throw new LoginCancelledError();
+	const trimmed = apiKey.trim();
+	if (!trimmed) throw new ApiKeyRequiredError();
+	options.onProgress?.("Validating API key...");
+	if (choice === "3") await validateApiKeyAgainstModelsEndpoint({
+		provider: "Alibaba Coding Plan",
+		apiKey: trimmed,
+		modelsUrl: `${baseUrl}/models`,
+		signal: options.signal
+	});
+	else await validateOpenAICompatibleApiKey({
+		provider: "Alibaba Coding Plan",
+		apiKey: trimmed,
+		baseUrl,
+		model: VALIDATION_MODEL,
+		signal: options.signal
+	});
+	return {
+		access: trimmed,
+		refresh: trimmed,
+		expires: Number.MAX_SAFE_INTEGER,
+		enterpriseUrl: baseUrl
+	};
+}
+//#endregion
+export { loginAlibabaCodingPlan };

package/lib/alibaba-token-plan-CHGyWOfX.mjs

@@ -0,0 +1,46 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+//#region node_modules/.pnpm/@oh-my-pi+pi-catalog@18.1.17/node_modules/@oh-my-pi/pi-catalog/src/wire/alibaba-token-plan.ts
+/**
+* International (Singapore) Token Plan endpoint. Default region; keys issued by
+* the international product authenticate only here.
+*/
+const ALIBABA_TOKEN_PLAN_BASE_URL = "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1";
+/**
+* China (Beijing) Token Plan endpoint (百炼 Token Plan). Keys are region-locked:
+* a Beijing-issued key is rejected by the international endpoint with
+* `invalid_api_key`, and vice versa (#6682).
+*/
+const ALIBABA_TOKEN_PLAN_CN_BASE_URL = "https://token-plan.cn-beijing.maas.aliyuncs.com/compatible-mode/v1";
+const TOKEN_PATTERN = /^sk-[A-Za-z0-9._~+/-]+={0,2}$/;
+function parseAlibabaTokenPlanCredential(value) {
+	const trimmed = value.trim();
+	if (!trimmed) return null;
+	if (!trimmed.startsWith("{")) return TOKEN_PATTERN.test(trimmed) ? { token: trimmed } : null;
+	try {
+		const parsed = JSON.parse(trimmed);
+		if (typeof parsed.token !== "string" || !TOKEN_PATTERN.test(parsed.token.trim())) return null;
+		if (parsed.cookie !== void 0 && typeof parsed.cookie !== "string") return null;
+		if (parsed.baseUrl !== void 0 && typeof parsed.baseUrl !== "string") return null;
+		const token = parsed.token.trim();
+		const cookie = parsed.cookie?.trim();
+		const baseUrl = parsed.baseUrl?.trim();
+		const credential = { token };
+		if (cookie) credential.cookie = cookie;
+		if (baseUrl) credential.baseUrl = baseUrl;
+		return credential;
+	} catch {
+		return null;
+	}
+}
+function serializeAlibabaTokenPlanCredential(token, cookie, baseUrl) {
+	const trimmedCookie = cookie.trim();
+	const trimmedBaseUrl = baseUrl?.trim();
+	if (!trimmedCookie && !trimmedBaseUrl) return token;
+	const payload = { token };
+	if (trimmedCookie) payload.cookie = trimmedCookie;
+	if (trimmedBaseUrl) payload.baseUrl = trimmedBaseUrl;
+	return JSON.stringify(payload);
+}
+//#endregion
+export { serializeAlibabaTokenPlanCredential as i, ALIBABA_TOKEN_PLAN_CN_BASE_URL as n, parseAlibabaTokenPlanCredential as r, ALIBABA_TOKEN_PLAN_BASE_URL as t };

package/lib/alibaba-token-plan-Dj3OZhEE.mjs

@@ -0,0 +1,82 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { g as OnPromptRequiredError, m as LoginCancelledError, p as ApiKeyRequiredError, t as ConfigurationError } from "./error-CORgGg5a.mjs";
+import { i as serializeAlibabaTokenPlanCredential, n as ALIBABA_TOKEN_PLAN_CN_BASE_URL, t as ALIBABA_TOKEN_PLAN_BASE_URL } from "./alibaba-token-plan-CHGyWOfX.mjs";
+import { n as validateApiKeyAgainstModelsEndpoint } from "./api-key-validation-CGCJFbFr.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/alibaba-token-plan.ts
+const INTERNATIONAL_AUTH_URL = "https://home.qwencloud.com/billing/subscription/token-plan-individual";
+const CHINA_AUTH_URL = "https://www.aliyun.com/benefit/scene/tokenplan";
+/**
+* Log in to the QwenCloud Token Plan provider.
+*
+* The Token Plan ships as two regionally separate products with
+* non-interchangeable keys — International (Singapore) and China (Beijing) —
+* so login first selects the region (or a custom base URL) before pasting the
+* key, mirroring {@link loginAlibabaCodingPlan}. The chosen region is validated
+* against its own `/models` endpoint and, when it diverges from the default
+* international endpoint, stored in the credential so inference and discovery
+* both target it (#6682).
+*/
+async function loginAlibabaTokenPlan(options) {
+	if (!options.onPrompt) throw new OnPromptRequiredError("QwenCloud Token Plan");
+	const endpointChoice = await options.onPrompt({
+		message: "Select QwenCloud Token Plan region: 1=International (default), 2=China (Beijing), 3=Custom — enter 1, 2, or 3",
+		placeholder: "1"
+	});
+	if (options.signal?.aborted) throw new LoginCancelledError();
+	const choice = endpointChoice.trim();
+	let baseUrl;
+	let authUrl;
+	let instructions;
+	if (choice === "2") {
+		baseUrl = ALIBABA_TOKEN_PLAN_CN_BASE_URL;
+		authUrl = CHINA_AUTH_URL;
+		instructions = "Subscribe to the China (Beijing) 百炼 Token Plan and copy its dedicated API key";
+	} else if (choice === "3") {
+		const trimmedUrl = (await options.onPrompt({
+			message: "Enter custom Token Plan base URL",
+			placeholder: "https://token-plan.<region>.maas.aliyuncs.com/compatible-mode/v1"
+		})).trim().replace(/\/+$/, "");
+		if (!trimmedUrl) throw new ConfigurationError("Custom URL is required for option 3");
+		baseUrl = trimmedUrl;
+		authUrl = INTERNATIONAL_AUTH_URL;
+		instructions = "Copy your Token Plan API key for the custom endpoint";
+	} else {
+		baseUrl = ALIBABA_TOKEN_PLAN_BASE_URL;
+		authUrl = INTERNATIONAL_AUTH_URL;
+		instructions = "Subscribe to Token Plan Individual and copy its dedicated API key. Keep this page open; the next prompt explains how to enable optional quota reporting.";
+	}
+	options.onAuth?.({
+		url: authUrl,
+		instructions
+	});
+	const apiKeyInput = await options.onPrompt({
+		message: "Paste your QwenCloud Token Plan API key",
+		placeholder: "sk-sp-..."
+	});
+	if (options.signal?.aborted) throw new LoginCancelledError();
+	const apiKey = apiKeyInput.trim();
+	if (!apiKey) throw new ApiKeyRequiredError();
+	options.onProgress?.("Validating API key...");
+	await validateApiKeyAgainstModelsEndpoint({
+		provider: "QwenCloud Token Plan",
+		apiKey,
+		modelsUrl: `${baseUrl}/models`,
+		signal: options.signal,
+		fetch: options.fetch
+	});
+	const cookieRequestHost = baseUrl === "https://token-plan.cn-beijing.maas.aliyuncs.com/compatible-mode/v1" ? "bailian-cs.console.aliyun.com" : "cs-data.qwencloud.com";
+	const cookie = (await options.onPrompt({
+		message: baseUrl === "https://token-plan.cn-beijing.maas.aliyuncs.com/compatible-mode/v1" ? "Optional quota reporting: open browser DevTools → Network, reload the Token Plan page, filter for api.json, and select the bailian-cs.console.aliyun.com/data/api.json request whose api query ends in /tokenplan/personal/api/v2/usage. Copy Request Headers → Cookie, then paste the complete name=value; ... value here, or press Enter to skip." : "Optional quota reporting: open browser DevTools → Network, reload the Token Plan page, filter for api.json, and select the cs-data.qwencloud.com/data/api.json request whose api query ends in /tokenplan/personal/api/v2/usage. Copy Request Headers → Cookie, then paste the complete name=value; ... value here, or press Enter to skip.",
+		placeholder: "name=value; name=value; ...",
+		allowEmpty: true
+	})).trim().replace(/^Cookie:\s*/i, "").trim();
+	if (options.signal?.aborted) throw new LoginCancelledError();
+	if (cookie && !cookie.split(";").some((segment) => {
+		const separator = segment.indexOf("=");
+		return separator > 0 && Boolean(segment.slice(0, separator).trim() && segment.slice(separator + 1).trim());
+	})) throw new ConfigurationError(`Invalid QwenCloud Cookie header. Copy the complete Cookie request header from the ${cookieRequestHost} usage request, not a single cookie value.`);
+	return serializeAlibabaTokenPlanCredential(apiKey, cookie, baseUrl === "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1" ? void 0 : baseUrl);
+}
+//#endregion
+export { loginAlibabaTokenPlan };

package/lib/{amazon-bedrock-TVMpUTRG.mjs → amazon-bedrock-DbFSYXfJ.mjs}

@@ -1,13 +1,14 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { I as $flag, _ as parseStreamingJsonThrottled, g as parseStreamingJson } from "./src-BcD0_rQR.mjs";
-import { G as fetchWithRetry, I as BedrockApiError, U as EventStreamFrameError, l as finalize, r as ValidationError, v as AbortError } from "./error-C-f_Wnw4.mjs";
-import { C as kStreamingPartialJson, S as kStreamingLastParseLen, a as normalizeSystemPrompts, h as clearStreamingPartialJson, k as toolWireSchema, m as transformMessages, o as normalizeToolCallId, s as resolveCacheRetention, w as renderDemotedThinking, y as kStreamingBlockIndex } from "./utils-Cp2Mxf_U.mjs";
-import { i as resolveAwsBearerToken, n as resolveAwsCredentials, r as signRequest, s as resolveAwsAmbientRegion, t as invalidateAwsCredentialCache } from "./aws-credentials-B20dliS7.mjs";
-import { o as mapEffortToAnthropicAdaptiveEffort, s as requireSupportedEffort, t as calculateCost } from "./models-DRA2c_8U.mjs";
-import { t as AssistantMessageEventStream } from "./event-stream-Dh2guZxS.mjs";
-import { i as getStreamFirstEventTimeoutMs, t as armPreResponseTimeout } from "./idle-iterator-CYAxUkSD.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/providers/aws-eventstream.ts
+import { B as USER_AGENT, C as warn, F as $flag, _ as parseStreamingJson, v as parseStreamingJsonThrottled } from "./src-BwW51vA5.mjs";
+import { G as fetchWithRetry, I as BedrockApiError, U as EventStreamFrameError, _ as AbortError, c as finalize, r as ValidationError } from "./error-CORgGg5a.mjs";
+import { A as toolWireSchema, C as kStreamingLastParseLen, T as renderDemotedThinking, b as kStreamingBlockIndex, c as resolveCacheRetention, g as clearStreamingPartialJson, h as transformMessages, o as normalizeSystemPrompts, s as normalizeToolCallId, w as kStreamingPartialJson } from "./utils-CUPhpw9A.mjs";
+import { n as isRecord } from "./type-guards-CttAANEx.mjs";
+import { a as mapEffortToAnthropicAdaptiveEffort, c as invalidateAwsCredentialCache, d as resolveAwsBearerToken, l as resolveAwsCredentials, m as resolveAwsAmbientRegion, o as requireSupportedEffort, r as parseAnthropicInputTransformations, t as THINKING_BINDING_CONTROLS_BETA, u as signRequest } from "./anthropic-wire-CKuhDwZ1.mjs";
+import { t as calculateCost } from "./models-DnXMYGcJ.mjs";
+import { t as AssistantMessageEventStream } from "./event-stream-ulcDenZD.mjs";
+import { i as getStreamFirstEventTimeoutMs, t as armPreResponseTimeout } from "./idle-iterator-DlUkEfzW.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/providers/aws-eventstream.ts
 /**
 * `application/vnd.amazon.eventstream` decoder.
 *
@@ -162,7 +163,7 @@ async function* decodeEventStream(source) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/providers/amazon-bedrock.ts
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/providers/amazon-bedrock.ts
 /**
 * Headers SigV4 generates for itself. A caller cannot be allowed to supply these:
 * `signRequest` would sign the caller's value but return its own, so the signature
@@ -229,24 +230,27 @@ function regionServesGeo(region, geo) {
 }
 /**
 * Resolve the Bedrock runtime region for a request. An explicit per-request
-* region and an ARN-embedded region win outright. Otherwise, for a geo-prefixed
-* cross-region inference profile (`us.`/`eu.`/`apac.`/`au.`/`jp.`/`us-gov.`), an
-* ambient region (`AWS_REGION` / `AWS_DEFAULT_REGION`) is honored only when it
-* can serve the profile's geo; a mismatched or absent ambient region is
-* corrected to the geo default so an `eu.`/`apac.` profile never POSTs to a `us`
-* endpoint (and vice versa). `global.` profiles have no geo entry, so the
-* ambient region (or `us-east-1`) is used unchanged.
+* region and an ARN-embedded model region win outright. Otherwise, for a
+* geo-prefixed cross-region inference profile (`us.`/`eu.`/`apac.`/`au.`/`jp.`/
+* `us-gov.`), an ambient region (`AWS_REGION` / `AWS_DEFAULT_REGION`) is
+* honored only when it can serve the profile's geo. If the ambient region is
+* absent or mismatched, a same-geo guardrail ARN region is used when available;
+* otherwise the geo default is used. `global.` profiles have no geo entry, so
+* the ambient region (or, when absent, a guardrail ARN's region or
+* `us-east-1`) is used unchanged.
 */
 function resolveBedrockRegion(modelId, options) {
 	const explicit = options.region || inferRegionFromBedrockArn(modelId);
 	if (explicit) return explicit;
 	const ambient = resolveAwsAmbientRegion(options.profile);
+	const guardrailRegion = inferRegionFromBedrockArn(options.guardrailIdentifier ?? "");
 	const geo = inferenceProfileGeo(modelId);
 	if (geo) {
 		if (ambient && regionServesGeo(ambient, geo)) return ambient;
+		if (guardrailRegion && regionServesGeo(guardrailRegion, geo)) return guardrailRegion;
 		return INFERENCE_PROFILE_GEO_DEFAULT_REGION[geo];
 	}
-	return ambient || "us-east-1";
+	return ambient || guardrailRegion || "us-east-1";
 }
 /**
 * Bedrock validates that requests carrying any `toolUse`/`toolResult` history
@@ -264,6 +268,31 @@ const NO_TOOLS_SENTINEL = { toolSpec: {
 		properties: {}
 	} }
 } };
+const REQUEST_METADATA_PATTERN = /^[a-zA-Z0-9\s:_@$#=/+,\-.]*$/;
+const REQUEST_METADATA_MAX_ENTRIES = 16;
+const REQUEST_METADATA_MAX_LENGTH = 256;
+/**
+* Bedrock rejects the whole invocation on a malformed `requestMetadata` entry.
+* Attribution tags must never cost a turn, so invalid and excess entries are
+* dropped with a warning instead of failing the request. Returns `undefined`
+* for an empty result so the field is omitted from the body entirely.
+*/
+function sanitizeRequestMetadata(raw) {
+	if (!isRecord(raw)) return void 0;
+	const out = {};
+	const dropped = [];
+	let kept = 0;
+	for (const [key, value] of Object.entries(raw)) {
+		if (typeof value !== "string" || key.length < 1 || key.length > REQUEST_METADATA_MAX_LENGTH || !REQUEST_METADATA_PATTERN.test(key) || value.length > REQUEST_METADATA_MAX_LENGTH || !REQUEST_METADATA_PATTERN.test(value) || kept >= REQUEST_METADATA_MAX_ENTRIES) {
+			dropped.push(key);
+			continue;
+		}
+		out[key] = value;
+		kept++;
+	}
+	if (dropped.length > 0) warn("Bedrock requestMetadata entries dropped", { keys: dropped });
+	return kept > 0 ? out : void 0;
+}
 const streamBedrock = (model, context, options) => {
 	const stream = new AssistantMessageEventStream();
 	(async () => {
@@ -299,14 +328,22 @@ const streamBedrock = (model, context, options) => {
 			const promptCachePolicy = resolvePromptCachePolicy(model, resolveCacheRetention(options.cacheRetention));
 			const convertedMessages = convertMessages(context, model, promptCachePolicy);
 			const toolPlan = planToolConfig(context.tools, options.toolChoice, convertedMessages);
-			const toolConfig = toolPlan.toolConfig;
+			let toolConfig = toolPlan.toolConfig;
 			const sentinelInjected = toolPlan.sentinelInjected;
 			let additionalModelRequestFields = buildAdditionalModelRequestFields(model, options);
+			const prefixMismatchBehavior = model.thinking?.prefixBinding ? options.anthropicPrefixMismatchBehavior ?? "drop_block" : void 0;
 			if (toolConfig?.toolChoice && additionalModelRequestFields) {
 				const tc = toolConfig.toolChoice;
-				if (tc.any || tc.tool) additionalModelRequestFields = void 0;
+				if (tc.any || tc.tool) {
+					if (prefixMismatchBehavior) toolConfig = {
+						...toolConfig,
+						toolChoice: { auto: {} }
+					};
+					else additionalModelRequestFields = void 0;
+				}
 			}
-			const commandInput = {
+			if (prefixMismatchBehavior) additionalModelRequestFields = applyBedrockThinkingBinding(additionalModelRequestFields, prefixMismatchBehavior);
+			let commandInput = {
 				messages: convertedMessages,
 				system: buildSystemPrompt(context.systemPrompt, promptCachePolicy),
 				inferenceConfig: {
@@ -315,9 +352,20 @@ const streamBedrock = (model, context, options) => {
 					topP: options.topP
 				},
 				toolConfig,
-				additionalModelRequestFields
+				guardrailConfig: buildGuardrailConfig(options),
+				additionalModelRequestFields,
+				requestMetadata: model.requestMetadata || options.requestMetadata ? {
+					...model.requestMetadata,
+					...options.requestMetadata
+				} : void 0,
+				...prefixMismatchBehavior ? { additionalModelResponseFieldPaths: ["/input_transformations"] } : {}
+			};
+			const replacementInput = await options?.onPayload?.(commandInput, model);
+			if (replacementInput !== void 0) commandInput = replacementInput;
+			commandInput = {
+				...commandInput,
+				requestMetadata: sanitizeRequestMetadata(commandInput.requestMetadata)
 			};
-			options?.onPayload?.(commandInput, model);
 			const host = `bedrock-runtime.${region}.amazonaws.com`;
 			const url = `https://${host}/model/${encodeURIComponent(model.id)}/converse-stream`;
 			const urlPath = `/model/${encodeURIComponent(model.id)}/converse-stream`;
@@ -332,11 +380,12 @@ const streamBedrock = (model, context, options) => {
 			const bodyText = JSON.stringify(commandInput);
 			const body = new TextEncoder().encode(bodyText);
 			const callerHeaders = {};
-			for (const [name, value] of Object.entries(options?.headers ?? {})) {
+			for (const source of [model.headers, options?.headers]) for (const [name, value] of Object.entries(source ?? {})) {
 				const field = name.toLowerCase();
 				if (SIGNER_OWNED_HEADERS.has(field) || BEDROCK_RESERVED_HEADERS.has(field)) continue;
 				callerHeaders[field] = value;
 			}
+			callerHeaders["user-agent"] ??= USER_AGENT;
 			const baseHeaders = {
 				...callerHeaders,
 				"content-type": "application/json",
@@ -436,8 +485,20 @@ const streamBedrock = (model, context, options) => {
 						break;
 					case "messageStop": {
 						const ev = payload;
+						const responseFields = isRecord(ev.additionalModelResponseFields) ? ev.additionalModelResponseFields : void 0;
+						const transformations = parseAnthropicInputTransformations(responseFields?.input_transformations);
+						if (transformations.length > 0) {
+							output.inputTransformations = transformations;
+							for (const transformation of transformations) {
+								if (transformation.reason !== "prefix_binding_mismatch") continue;
+								warn("bedrock: dropped thinking block after conversation prefix changed", {
+									model: model.id,
+									path: transformation.path
+								});
+							}
+						}
 						output.stopReason = sentinelInjected && ev.stopReason === "tool_use" ? "stop" : mapStopReason(ev.stopReason);
-						if (output.stopReason === "error") output.errorMessage = `Generation failed with stop reason: ${ev.stopReason ?? "unknown"}`;
+						if (output.stopReason === "error") output.errorMessage = ev.stopReason === "guardrail_intervened" ? `Response blocked by Amazon Bedrock guardrail (stop reason: ${ev.stopReason}).` : ev.stopReason === "content_filtered" ? `Response filtered by Amazon Bedrock content filters (stop reason: ${ev.stopReason}).` : `Generation failed with stop reason: ${ev.stopReason ?? "unknown"}`;
 						break;
 					}
 					case "metadata": handleMetadata(payload, model, output);
@@ -605,7 +666,7 @@ function handleMetadata(event, model, output) {
 		output.usage.cacheRead = event.usage.cacheReadInputTokens || 0;
 		output.usage.cacheWrite = event.usage.cacheWriteInputTokens || 0;
 		output.usage.totalTokens = event.usage.totalTokens || output.usage.input + output.usage.output;
-		calculateCost(model, output.usage);
+		calculateCost(model, output.usage, output.timestamp);
 	}
 }
 function handleContentBlockStop(event, blocks, output, stream) {
@@ -671,16 +732,6 @@ function takeCachePoint(policy) {
 		...policy.ttl ? { ttl: policy.ttl } : {}
 	} };
 }
-/**
-* Check if the model supports thinking signatures in reasoningContent.
-* Only Anthropic Claude models support the signature field.
-* Other models (Nova, Titan, Mistral, Llama, etc.) reject it with:
-* "This model doesn't support the reasoningContent.reasoningText.signature field"
-*/
-function supportsThinkingSignature(model) {
-	const id = model.id.toLowerCase();
-	return id.includes("anthropic.claude") || id.includes("anthropic/claude");
-}
 function buildSystemPrompt(systemPrompt, promptCachePolicy) {
 	const prompts = normalizeSystemPrompts(systemPrompt);
 	if (prompts.length === 0) return void 0;
@@ -740,12 +791,11 @@ function convertMessages(context, model, promptCachePolicy) {
 						} });
 						break;
 					case "thinking":
-						if (c.thinking.trim().length === 0) continue;
+						if (c.thinking.trim().length === 0 && !c.thinkingSignature) continue;
 						if (c.thinkingSignature) contentBlocks.push({ reasoningContent: { reasoningText: {
 							text: c.thinking.toWellFormed(),
 							signature: c.thinkingSignature
 						} } });
-						else if (!supportsThinkingSignature(model)) contentBlocks.push({ reasoningContent: { reasoningText: { text: c.thinking.toWellFormed() } } });
 						else contentBlocks.push({ text: renderDemotedThinking(model.id, c.thinking) });
 						break;
 					default: throw new ValidationError("Unknown assistant content type");
@@ -858,10 +908,35 @@ function mapStopReason(reason) {
 		default: return "error";
 	}
 }
+/**
+* Build the Converse `guardrailConfig` block when a guardrail identifier is set.
+* The version defaults to `"DRAFT"` (Bedrock's editable working draft) and the
+* trace is passed through untouched — leaving it undefined keeps Bedrock's own
+* default rather than forcing a value.
+*/
+function buildGuardrailConfig(options) {
+	if (!options.guardrailIdentifier) return void 0;
+	return {
+		guardrailIdentifier: options.guardrailIdentifier,
+		guardrailVersion: options.guardrailVersion ?? "DRAFT",
+		...options.guardrailTrace === void 0 ? {} : { trace: options.guardrailTrace }
+	};
+}
+function applyBedrockThinkingBinding(fields, behavior) {
+	const result = { ...fields };
+	const thinking = isRecord(result.thinking) ? { ...result.thinking } : { type: "adaptive" };
+	thinking.block_binding = { prefix_mismatch_behavior: behavior };
+	result.thinking = thinking;
+	const betas = Array.isArray(result.anthropic_beta) ? result.anthropic_beta.filter((beta) => typeof beta === "string") : [];
+	if (!betas.includes("thinking-binding-controls-2026-08-01")) betas.push(THINKING_BINDING_CONTROLS_BETA);
+	result.anthropic_beta = betas;
+	return result;
+}
 function buildAdditionalModelRequestFields(model, options) {
 	const reasoning = options.reasoning;
 	if (!reasoning || !model.reasoning) return void 0;
-	if (model.thinking?.mode === "anthropic-adaptive") {
+	const mode = model.thinking?.mode;
+	if (mode === "anthropic-adaptive") {
 		const effort = mapEffortToAnthropicAdaptiveEffort(model, reasoning);
 		const adaptive = { type: "adaptive" };
 		if (model.thinking?.supportsDisplay) adaptive.display = options.thinkingDisplay ?? "summarized";
@@ -870,6 +945,10 @@ function buildAdditionalModelRequestFields(model, options) {
 			output_config: { effort }
 		};
 	}
+	if (mode === "effort") {
+		const level = requireSupportedEffort(model, reasoning);
+		return { reasoning: { effort: model.thinking?.effortMap?.[level] ?? level } };
+	}
 	const level = requireSupportedEffort(model, reasoning);
 	const result = { thinking: {
 		type: "enabled",