cascade-ai 0.63.0 → 0.65.0

package/dist/index.js

@@ -1624,7 +1624,7 @@ var pricing_data_default = {
       ]
     },
     {
-      model: "veo-3.1-generate-001",
+      model: "veo-3.1-generate-preview",
       provider: "gemini",
       modality: "video",
       currency: "USD",
@@ -1862,7 +1862,7 @@ function reconcilePrice(model, live) {
 }
 
 // src/constants.ts
-var CASCADE_VERSION = "0.63.0";
+var CASCADE_VERSION = "0.65.0";
 var CASCADE_CONFIG_DIR = ".cascade";
 var CASCADE_MD_FILE = "CASCADE.md";
 var CASCADE_IGNORE_FILE = ".cascadeignore";
@@ -2269,6 +2269,9 @@ var DEFAULT_THEME = "cascade";
 var OLLAMA_BASE_URL = "http://localhost:11434";
 var LM_STUDIO_BASE_URL = "http://localhost:1234";
 var AZURE_BASE_URL_TEMPLATE = "https://{resource}.openai.azure.com";
+var GITHUB_MODELS_INFERENCE_URL = "https://models.github.ai/inference";
+var GITHUB_MODELS_CATALOG_URL = "https://models.github.ai/catalog/models";
+var GITHUB_MODELS_API_VERSION = "2026-03-10";
 var TOOL_NAMES = {
   SHELL: "shell",
   FILE_READ: "file_read",
@@ -2303,7 +2306,8 @@ var PROVIDER_DISPLAY_NAMES = {
   gemini: "Google Gemini",
   azure: "Azure OpenAI",
   "openai-compatible": "OpenAI-Compatible",
-  ollama: "Ollama (Local)"
+  ollama: "Ollama (Local)",
+  "github-models": "GitHub Models"
 };
 
 // src/utils/cost.ts
@@ -3280,7 +3284,7 @@ function preferIpv4Host(url) {
   return url;
 }
 var MAX_REDIRECTS = 5;
-async function nodeHttpFetch(input, init = {}, redirectCount = 0) {
+async function nodeHttpFetch(input, init = {}, redirectCount = 0, opts = {}) {
   const urlStr = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
   const u = new URL(preferIpv4Host(urlStr) ?? urlStr);
   const lib = u.protocol === "https:" ? https : http;
@@ -3311,9 +3315,13 @@ async function nodeHttpFetch(input, init = {}, redirectCount = 0) {
         if (status >= 300 && status < 400 && location && redirectCount < MAX_REDIRECTS) {
           res.resume();
           const nextUrl = new URL(location, u).href;
+          if (opts.allowedRedirectOrigin && new URL(nextUrl).origin !== opts.allowedRedirectOrigin) {
+            reject(new Error(`Refusing cross-origin redirect to ${new URL(nextUrl).origin}`));
+            return;
+          }
           const downgrade = status === 303 || (status === 301 || status === 302) && method !== "GET" && method !== "HEAD";
           const nextInit = downgrade ? { ...init, method: "GET", body: void 0 } : init;
-          resolve2(nodeHttpFetch(nextUrl, nextInit, redirectCount + 1));
+          resolve2(nodeHttpFetch(nextUrl, nextInit, redirectCount + 1, opts));
           return;
         }
         const encoding = (res.headers["content-encoding"] ?? "").toLowerCase();
@@ -3342,6 +3350,206 @@ async function nodeHttpFetch(input, init = {}, redirectCount = 0) {
   });
 }
 
+// src/providers/github-models.ts
+var GITHUB_MODELS_MAX_OUTPUT_TOKENS = 4e3;
+var GITHUB_MODELS_MAX_INPUT_TOKENS = 8e3;
+var DEFAULT_CONTEXT_WINDOW = 128e3;
+var GITHUB_MODELS_MAX_CATALOG_PAGES = 20;
+var GITHUB_MODELS_CATALOG_ORIGIN = new URL(GITHUB_MODELS_CATALOG_URL).origin;
+function stripModelOwnerPrefix(id) {
+  const slash = (id || "").indexOf("/");
+  return slash === -1 ? id : id.slice(slash + 1);
+}
+function pickString(o, keys) {
+  for (const k of keys) {
+    const v = o[k];
+    if (typeof v === "string" && v.length > 0) return v;
+  }
+  return void 0;
+}
+function pickNumber(o, keys) {
+  for (const k of keys) {
+    const v = k.includes(".") ? o[k.split(".")[0]]?.[k.split(".")[1]] : o[k];
+    if (typeof v === "number" && Number.isFinite(v) && v > 0) return v;
+  }
+  return void 0;
+}
+function looksVisionCapable(o) {
+  for (const k of ["supported_input_modalities", "input_modalities", "modalities", "capabilities"]) {
+    const v = o[k];
+    if (Array.isArray(v) && v.some((x) => typeof x === "string" && /image|vision/i.test(x))) return true;
+  }
+  return false;
+}
+function looksToolCapable(o) {
+  const params = o["supported_parameters"];
+  if (Array.isArray(params) && params.some((x) => typeof x === "string" && /^tools?$|function.?call/i.test(x))) {
+    return true;
+  }
+  for (const k of ["capabilities", "supported_output_modalities"]) {
+    const v = o[k];
+    if (Array.isArray(v) && v.some((x) => typeof x === "string" && /tool|function.?call/i.test(x))) return true;
+  }
+  const caps = o["capabilities"];
+  if (caps && typeof caps === "object" && !Array.isArray(caps)) {
+    const c = caps;
+    if (c["function_calling"] === true || c["tool_calling"] === true || c["tools"] === true) return true;
+  }
+  return false;
+}
+function parseNextLink(linkHeader) {
+  if (!linkHeader) return null;
+  for (const part of linkHeader.split(",")) {
+    const match = part.match(/<([^>]+)>\s*;\s*rel="next"/);
+    if (match) return match[1];
+  }
+  return null;
+}
+var GitHubModelsProvider = class extends OpenAIProvider {
+  constructor(config, model) {
+    super({ ...config, apiKey: config.apiKey ?? "" }, model);
+    this.useMaxCompletionTokens = isReasoningModel(stripModelOwnerPrefix(model.id));
+    this.client = new OpenAI({
+      apiKey: config.apiKey ?? "",
+      baseURL: GITHUB_MODELS_INFERENCE_URL,
+      defaultHeaders: { "X-GitHub-Api-Version": GITHUB_MODELS_API_VERSION, "User-Agent": "Cascade-AI" }
+    });
+  }
+  /**
+   * `OpenAIProvider.generateStream()` builds its request budget as
+   * `options.maxTokens ?? this.model.maxOutputTokens` — an explicit per-call
+   * `maxTokens` (T1Administrator's final compilation asks for 8,000, well
+   * above GitHub's real ~4K hard cap) wins outright and is sent unclamped.
+   * GitHub then rejects the request instead of answering, so a run routed to
+   * this provider for that step fails outright rather than getting a
+   * (perfectly serviceable, just shorter) completion. Clamp here, once, right
+   * before delegating to the inherited implementation, rather than teaching
+   * every caller GitHub's specific cap.
+   */
+  async generateStream(options, onChunk) {
+    const clamped = options.maxTokens !== void 0 && options.maxTokens > GITHUB_MODELS_MAX_OUTPUT_TOKENS ? { ...options, maxTokens: GITHUB_MODELS_MAX_OUTPUT_TOKENS } : options;
+    return super.generateStream(clamped, onChunk);
+  }
+  /**
+   * The catalog is a GitHub REST resource, not an OpenAI `/models` list, and
+   * wants GitHub's own header trio — the plain `Accept: application/json` the
+   * openai-compatible provider sends is not the same request.
+   */
+  catalogHeaders() {
+    return {
+      Accept: "application/vnd.github+json",
+      Authorization: `Bearer ${this.config.apiKey ?? ""}`,
+      "X-GitHub-Api-Version": GITHUB_MODELS_API_VERSION,
+      // GitHub's REST API rejects any request with no User-Agent — a plain 403
+      // regardless of how valid the PAT is. nodeHttpFetch is a thin wrapper
+      // over node:http/https, neither of which sets one the way a browser's
+      // fetch or a full HTTP client library would, so this has to be explicit.
+      "User-Agent": "Cascade-AI"
+    };
+  }
+  async listModels() {
+    const raw = [];
+    let url = GITHUB_MODELS_CATALOG_URL;
+    let pages = 0;
+    const visited = /* @__PURE__ */ new Set();
+    while (url && pages < GITHUB_MODELS_MAX_CATALOG_PAGES) {
+      if (visited.has(url)) break;
+      visited.add(url);
+      const res = await nodeHttpFetch(url, { headers: this.catalogHeaders() }, 0, {
+        allowedRedirectOrigin: GITHUB_MODELS_CATALOG_ORIGIN
+      });
+      if (!res.ok) throw new Error(`GitHub Models catalog ${url} returned HTTP ${res.status}`);
+      const body = await res.json();
+      const pageItems = Array.isArray(body) ? body : Array.isArray(body?.models) ? body.models : Array.isArray(body?.data) ? body.data : [];
+      raw.push(...pageItems);
+      const next = parseNextLink(res.headers.get("link"));
+      if (next) {
+        const resolved = new URL(next, url);
+        if (resolved.origin !== GITHUB_MODELS_CATALOG_ORIGIN) {
+          throw new Error(`Refusing cross-origin GitHub Models pagination URL: ${resolved.origin}`);
+        }
+        url = resolved.href;
+      } else {
+        url = null;
+      }
+      pages++;
+    }
+    const entries = raw.map((m) => {
+      if (typeof m === "string") {
+        return { id: m, name: m, contextWindow: DEFAULT_CONTEXT_WINDOW, vision: false, tools: false };
+      }
+      if (!m || typeof m !== "object") return void 0;
+      const o = m;
+      const id = pickString(o, ["id", "name", "model"]);
+      if (!id) return void 0;
+      return {
+        id,
+        name: pickString(o, ["friendly_name", "display_name", "name"]) ?? id,
+        contextWindow: pickNumber(o, [
+          "context_window",
+          "context_length",
+          "max_input_tokens",
+          "limits.max_input_tokens",
+          "limits.max_context_tokens"
+        ]) ?? DEFAULT_CONTEXT_WINDOW,
+        vision: looksVisionCapable(o),
+        tools: looksToolCapable(o)
+      };
+    }).filter((e) => e !== void 0);
+    if (entries.length === 0) return [];
+    const chat = entries.filter((e) => isChatModel(e.id));
+    return (chat.length ? chat : entries).map((e) => ({
+      id: e.id,
+      // full `owner/model` — what the API is addressed by
+      name: e.name,
+      provider: "github-models",
+      // GitHub's real per-request input cap, not the base model's larger one
+      // (see GITHUB_MODELS_MAX_INPUT_TOKENS above) — the same reasoning
+      // already applied to maxOutputTokens below, for the input side.
+      contextWindow: Math.min(e.contextWindow, GITHUB_MODELS_MAX_INPUT_TOKENS),
+      isVisionCapable: e.vision,
+      // A REAL $0, not a missing number — usage is bundled into the quota of
+      // the plan the PAT belongs to and is never billed per token, so
+      // `pricingUnknown: false` is the honest value (see the flag's contract in
+      // core/router/pricing.ts: 0 alone is ambiguous). Set here rather than in
+      // pricing-data.json because resolvePricing() matches exactly on
+      // provider|model|region with no wildcard: every catalog model would need
+      // a hand-curated row, and the next one GitHub adds would read as "cost
+      // unknown" — an inconsistent picture for a billing reality that is
+      // identical across the entire catalog.
+      //
+      // `isLocal` is the OTHER way to reach a real $0, and it is the wrong one:
+      // it means "runs on this machine" and carries consequences that are
+      // simply false for a hosted API — the shared concurrency-1
+      // LocalRequestQueue (serialising these calls behind actual Ollama GPU
+      // inference), the 300s local rather than 120s cloud inference timeout,
+      // and a literal "[local]" tag in `cascade models`.
+      inputCostPer1kTokens: 0,
+      outputCostPer1kTokens: 0,
+      pricingUnknown: false,
+      maxOutputTokens: GITHUB_MODELS_MAX_OUTPUT_TOKENS,
+      supportsStreaming: true,
+      // Not every catalog model supports function/tool calling — a hardcoded
+      // `true` sent `tools` to models that reject the parameter outright and
+      // never engaged t3-worker.ts's existing text-tool fallback (only an
+      // explicit `false` does). See looksToolCapable's own comment for why
+      // "not positively advertised" defaults to false rather than true here.
+      supportsToolUse: e.tools,
+      isLocal: false
+    }));
+  }
+  async isAvailable() {
+    try {
+      const res = await nodeHttpFetch(GITHUB_MODELS_CATALOG_URL, { headers: this.catalogHeaders() }, 0, {
+        allowedRedirectOrigin: GITHUB_MODELS_CATALOG_ORIGIN
+      });
+      return res.ok;
+    } catch {
+      return false;
+    }
+  }
+};
+
 // src/providers/ollama.ts
 var TOOL_CAPABLE_FAMILIES = [
   "llama3.1",
@@ -3758,16 +3966,23 @@ var ModelSelector = class {
         return model;
       }
     }
+    for (const model of this.availableModels.values()) {
+      if (this.availableProviders.has(model.provider) && model.isVisionCapable) return model;
+    }
     return null;
   }
   getNextFallback(currentModelId, tier) {
     const priority = this.getPriorityList(tier);
     const currentIdx = priority.indexOf(currentModelId);
-    if (currentIdx === -1) return null;
-    for (let i = currentIdx + 1; i < priority.length; i++) {
-      const key = priority[i];
-      const model = this.availableModels.get(key);
-      if (model && this.isUsable(model)) return model;
+    if (currentIdx !== -1) {
+      for (let i = currentIdx + 1; i < priority.length; i++) {
+        const key = priority[i];
+        const model = this.availableModels.get(key);
+        if (model && this.isUsable(model)) return model;
+      }
+    }
+    for (const [id, model] of this.availableModels) {
+      if (id !== currentModelId && this.isUsable(model)) return model;
     }
     return null;
   }
@@ -3843,7 +4058,7 @@ var ModelSelector = class {
     if (overrideModelId.includes(":")) {
       const parts = overrideModelId.split(":");
       const prefix = parts[0].toLowerCase();
-      const validProviders = ["anthropic", "openai", "gemini", "azure", "openai-compatible", "ollama"];
+      const validProviders = ["anthropic", "openai", "gemini", "azure", "openai-compatible", "ollama", "github-models"];
       if (validProviders.includes(prefix)) {
         providerStr = prefix;
         actualId = parts.slice(1).join(":");
@@ -3863,6 +4078,31 @@ var ModelSelector = class {
       else if (this.availableProviders.has("openai-compatible")) providerStr = "openai-compatible";
       else if (this.availableProviders.size === 1) providerStr = Array.from(this.availableProviders)[0];
     }
+    if (providerStr === "github-models" && this.availableProviders.has("github-models")) {
+      const dynamicModel = {
+        id: actualId,
+        name: actualId,
+        provider: "github-models",
+        contextWindow: GITHUB_MODELS_MAX_INPUT_TOKENS,
+        isVisionCapable: false,
+        inputCostPer1kTokens: 0,
+        outputCostPer1kTokens: 0,
+        pricingUnknown: false,
+        maxOutputTokens: GITHUB_MODELS_MAX_OUTPUT_TOKENS,
+        supportsStreaming: true,
+        // Unconfirmed (no live catalog entry to read a real capability from)
+        // must default to false, not left undefined: t3-worker.ts's text-tool
+        // fallback only engages on a strict `=== false`, so an undefined
+        // value here sends native `tools` to an unverified multi-vendor
+        // model and any that don't support function calling reject the
+        // request outright. Same default-to-false-when-unconfirmed policy
+        // listModels() already applies for a real catalog entry.
+        supportsToolUse: false,
+        isLocal: false
+      };
+      this.addDynamicModel(dynamicModel);
+      return dynamicModel;
+    }
     if (providerStr && this.availableProviders.has(providerStr)) {
       const dynamicModel = withResolvedPricing({
         id: actualId,
@@ -3955,7 +4195,20 @@ var DEFAULT_PROVIDER_TPM = {
   gemini: 6e4,
   azure: 3e4,
   "openai-compatible": 3e4,
-  ollama: Number.POSITIVE_INFINITY
+  ollama: Number.POSITIVE_INFINITY,
+  // An order of magnitude below the others, on purpose. GitHub Models is
+  // rate-limited by REQUESTS (Free ≈10 RPM, Pro ≈20, plus low daily caps), and
+  // this bucket meters TOKENS — there is no request-count limiter in this
+  // codebase, and building one is not in scope. The approximation works because
+  // the router reserves `model.maxOutputTokens + 512` per call, and the
+  // provider reports GitHub's real ~4K per-request cap rather than the
+  // underlying model's larger one — so every call withdraws a near-constant
+  // ~4.5K regardless of how short the reply actually turns out to be. At 8K/min
+  // that lands around 1–2 calls per minute of headroom: comfortably inside even
+  // the Free tier, with room for the daily cap to matter more than this does.
+  // Users on a higher tier can raise it with no code change through the generic
+  // `config.rateLimits.providerTpm['github-models']` override.
+  "github-models": 8e3
 };
 var TpmLimiter = class {
   buckets = /* @__PURE__ */ new Map();
@@ -4311,6 +4564,7 @@ var ModelProfiler = class {
       (m) => !alreadyProfiled.has(m.id) && !SKIP_PATTERN.test(m.id) && !SKIP_PATTERN.test(m.name)
     );
     if (toProfile.length === 0) return;
+    const probesHitGithubModels = this.router?.getModelForTier("T3")?.provider === "github-models";
     const openRouterModels = await fetchOpenRouterModels();
     const orByNormalizedId = /* @__PURE__ */ new Map();
     for (const m of openRouterModels) {
@@ -4325,7 +4579,7 @@ var ModelProfiler = class {
         if (orMatch?.description) {
           specializations = extractSpecializations(orMatch.description);
         }
-        if (specializations.length === 0 && this.router) {
+        if (specializations.length === 0 && this.router && !probesHitGithubModels) {
           specializations = await queryModelDirectly(this.router);
         }
         this.store.saveModelProfile(model.id, model.provider, specializations);
@@ -4545,6 +4799,7 @@ var LiveDataProvider = class {
    */
   applyLivePricing(models) {
     return models.map((m) => {
+      if (m.provider === "github-models") return m;
       const p = this.getLivePrice(m.baseModelId ?? m.id);
       if (!p) return m;
       const reconciled = reconcilePrice(m, p);
@@ -4583,6 +4838,7 @@ var LiveDataProvider = class {
    */
   applyLiveCapabilities(models) {
     return models.map((m) => {
+      if (m.provider === "github-models") return m;
       const c = this.getCapability(m.baseModelId ?? m.id);
       if (!c) return m;
       const next = { ...m };
@@ -4886,13 +5142,16 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
       for (const model of azureDeployments) this.selector.addDynamicModel(model);
       availableProviders.add("azure");
     }
+    if (availableProviders.has("github-models")) {
+      await this.discoverGitHubModelsCatalog(config);
+    }
     await this.validateCloudProviderModels(config);
     for (const tier of ["T1", "T2", "T3"]) {
       const override = tier === "T1" ? config.models.t1 : tier === "T2" ? config.models.t2 : config.models.t3;
       if (!override || override === "auto") continue;
       const model = this.selector.selectForTier(tier, override);
       if (!model) {
-        const knownProviders = ["anthropic", "openai", "gemini", "azure", "openai-compatible", "ollama"];
+        const knownProviders = ["anthropic", "openai", "gemini", "azure", "openai-compatible", "ollama", "github-models"];
         const hasProviderPrefix = override.includes(":") && knownProviders.some((p) => override.startsWith(p + ":"));
         if (hasProviderPrefix) {
           const provider = override.split(":")[0];
@@ -5047,7 +5306,7 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
    * models without a package upgrade. Mirrors discoverOllamaModels.
    */
   async discoverProviderModels() {
-    const cloud = ["anthropic", "openai", "gemini", "azure", "openai-compatible"];
+    const cloud = ["anthropic", "openai", "gemini", "azure", "openai-compatible", "github-models"];
     const tasks = cloud.map(async (type) => {
       if (!this.selector.isProviderAvailable(type)) return;
       const seed = this.getAnyModelForProvider(type);
@@ -5102,6 +5361,9 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
       this.ensureProvider(options.model, this.config.providers);
     }
     let model = requireVision ? this.selector.selectVisionModel() : options.model ?? this.tierModels.get(tier) ?? this.selector.selectForTier(tier) ?? void 0;
+    if (requireVision && model) {
+      this.ensureProvider(model, this.config.providers);
+    }
     if (options.forceLocal && model && !this.isPrivateModel(model)) {
       const localModel = this.selector.getAllAvailableModels().find((m) => this.isPrivateModel(m));
       if (!localModel) {
@@ -5115,7 +5377,8 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
     if (!model) throw new Error(`No model available for tier ${tier}`);
     const provider = this.getProvider(model);
     if (!provider) throw new Error(`No provider for model ${model.id}`);
-    const estimatedTokens = (options.maxTokens ?? model.maxOutputTokens ?? 1024) + 512;
+    const requestedTokens = options.maxTokens ?? model.maxOutputTokens ?? 1024;
+    const estimatedTokens = Math.min(requestedTokens, model.maxOutputTokens ?? requestedTokens) + 512;
     if (this.tpmLimiter) {
       await this.tpmLimiter.acquire(model.provider, estimatedTokens);
     }
@@ -5206,7 +5469,8 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
           });
           releaseLocalSlot?.();
           releaseLocalSlot = void 0;
-          return this.generate(tier, options, onChunk, requireVision);
+          const retryOpts = options.model && options.model.id === model.id ? { ...options, model: void 0 } : options;
+          return this.generate(tier, retryOpts, onChunk, requireVision);
         }
       }
       if (isModelNotFoundError(errMsg)) {
@@ -5557,6 +5821,26 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
       return false;
     }
   }
+  /**
+   * Registers GitHub Models' real catalog ids via addDynamicModel so init()'s
+   * tier-fill loop can pick one. Registration alone does not create a bound
+   * BaseProvider instance (see ensureProvider) — the tier-fill loop's own
+   * ensureProvider call does that for whichever model it actually selects,
+   * which is why this runs BEFORE that loop rather than only in the
+   * background discoverProviderModels() refresh.
+   */
+  async discoverGitHubModelsCatalog(config) {
+    const cfg = config.providers.find((p) => p.type === "github-models") ?? { type: "github-models" };
+    const seed = this.getAnyModelForProvider("github-models");
+    if (!seed) return;
+    try {
+      const provider = new GitHubModelsProvider(cfg, seed);
+      const models = await provider.listModels();
+      for (const m of models) this.selector.addDynamicModel(m);
+    } catch (err) {
+      console.warn("[router] GitHub Models catalog discovery failed:", err instanceof Error ? err.message : err);
+    }
+  }
   ensureProvider(model, configs) {
     const key = `${model.provider}:${model.id}`;
     if (this.providers.has(key)) return;
@@ -5581,6 +5865,8 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
         return new OllamaProvider(cfg, model);
       case "openai-compatible":
         return new OpenAICompatibleProvider(cfg, model);
+      case "github-models":
+        return new GitHubModelsProvider(cfg, model);
       default:
         throw new Error(`Unsupported provider type: ${String(cfg.type)}`);
     }
@@ -5588,7 +5874,7 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
   getAnyModelForProvider(type) {
     const fromCatalog = Object.values(MODELS).find((m) => m.provider === type);
     if (fromCatalog) return fromCatalog;
-    if (type === "openai-compatible" || type === "azure") {
+    if (type === "openai-compatible" || type === "azure" || type === "github-models") {
       return {
         id: type,
         name: type,
@@ -9272,9 +9558,17 @@ var CAPABILITIES = [
     // Long-running: submit returns an operation name, the video lands minutes
     // later, and the bytes come from a short-lived signed URL. generate.ts owns
     // that polling loop; the registry only records the shape via `api`.
+    //
+    // `veo-3.1-generate-001` (no "-preview") is VERTEX AI's id for this model,
+    // not the Gemini Developer API's — this file calls
+    // generativelanguage.googleapis.com (see generate.ts), which 404s on it:
+    // "models/veo-3.1-generate-001 is not found for API version v1beta". On the
+    // Gemini API specifically, Veo 3.1 is still preview-only, so the correct id
+    // there is `veo-3.1-generate-preview`.
+    // https://ai.google.dev/gemini-api/docs/veo
     modality: "video",
     provider: "gemini",
-    modelId: "veo-3.1-generate-001",
+    modelId: "veo-3.1-generate-preview",
     api: "gemini-predict-lro"
   }
 ];
@@ -12389,7 +12683,7 @@ var PermissionEscalator = class extends EventEmitter {
   }
 };
 var ProviderConfigSchema = z.object({
-  type: z.enum(["anthropic", "openai", "gemini", "azure", "openai-compatible", "ollama"]),
+  type: z.enum(["anthropic", "openai", "gemini", "azure", "openai-compatible", "ollama", "github-models"]),
   label: z.string().optional(),
   apiKey: z.string().optional(),
   baseUrl: z.string().url().optional(),
@@ -12569,6 +12863,18 @@ var CascadeConfigSchema = z.object({
   budget: BudgetConfigSchema.default({}),
   theme: z.string().default("cascade"),
   workspace: WorkspaceConfigSchema.default({}),
+  /**
+   * Per-provider tokens-per-minute overrides for the router's TpmLimiter (see
+   * DEFAULT_PROVIDER_TPM in core/router/tpm-limiter.ts). Documented as a raw
+   * config field for a while before this — since CascadeConfigSchema strips
+   * unknown keys, a config file setting it was silently discarded and the
+   * override never reached TpmLimiter's constructor. Optional/permissive on
+   * provider name (not a ProviderType enum) so a config still validates
+   * against a slightly newer/older provider list than this schema knows.
+   */
+  rateLimits: z.object({
+    providerTpm: z.record(z.string(), z.number().positive()).optional()
+  }).optional(),
   /**
    * Cascade Auto: when true, the TaskAnalyzer selects the optimal model for each
    * tier based on task type and complexity, overriding the static priority lists.
@@ -17603,7 +17909,14 @@ var ConfigManager = class {
       anthropic: "ANTHROPIC_API_KEY",
       openai: "OPENAI_API_KEY",
       gemini: "GOOGLE_API_KEY",
-      azure: "AZURE_OPENAI_KEY"
+      azure: "AZURE_OPENAI_KEY",
+      // Deliberately NOT `GITHUB_TOKEN`: that one is injected automatically by
+      // GitHub Actions and is commonly exported in developer shells for `gh`
+      // and git auth, and it will essentially never carry the fine-grained
+      // `models: read` scope this provider needs. Adopting it would wire up a
+      // provider that 403s on its first real call — a confusing failure for
+      // something that is meant to be explicit opt-in BYOK.
+      "github-models": "GITHUB_MODELS_TOKEN"
     };
     const envKey = envMap[provider];
     if (envKey && process.env[envKey]) return process.env[envKey];
@@ -17632,7 +17945,10 @@ var ConfigManager = class {
       { env: "ANTHROPIC_API_KEY", type: "anthropic" },
       { env: "OPENAI_API_KEY", type: "openai" },
       { env: "GOOGLE_API_KEY", type: "gemini" },
-      { env: "AZURE_OPENAI_KEY", type: "azure" }
+      { env: "AZURE_OPENAI_KEY", type: "azure" },
+      // See getApiKey() above for why this is GITHUB_MODELS_TOKEN and never
+      // the ambient GITHUB_TOKEN.
+      { env: "GITHUB_MODELS_TOKEN", type: "github-models" }
     ];
     for (const { env, type } of envProviders) {
       const key = process.env[env];
@@ -20301,6 +20617,6 @@ function applySyncBundle(bundle, config) {
   return next;
 }
 
-export { AZURE_BASE_MODELS, AZURE_BASE_URL_TEMPLATE, AuditLogger, CASCADE_AUDIT_FILE, CASCADE_CONFIG_DIR, CASCADE_CONFIG_FILE, CASCADE_DASHBOARD_SECRET_FILE, CASCADE_DB_FILE, CASCADE_IGNORE_FILE, CASCADE_KEYSTORE_FILE, CASCADE_MD_FILE, CASCADE_VERSION, CHARS_PER_TOKEN, COMPLEXITY_T2_COUNT, Cascade, CascadeCancelledError, CascadeIgnore, CascadeRouter, CascadeToolError, CloudClient, CodeSearchTool, ConfigManager, CurrentPageTool, DEFAULT_API_PORT, DEFAULT_APPROVAL_REQUIRED, DEFAULT_AUTO_SUMMARIZE_AT, DEFAULT_CLOUD_URL, DEFAULT_CONTEXT_LIMIT, DEFAULT_DASHBOARD_PORT, DEFAULT_MAX_SESSION_MESSAGES, DEFAULT_RETENTION_DAYS, DEFAULT_THEME, DashboardServer, FileMcpOAuthStore, GLOBAL_CONFIG_DIR, GLOBAL_CREDENTIALS_FILE, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_RUNTIME_DB_FILE, GraphRetriever, GraphSearchTool, HooksRunner, Keystore, LLMReranker, LM_STUDIO_BASE_URL, MAX_PAGE_TEXT_CHARS, MCP_TOOL_PREFIX, MODELS, McpClient, McpOAuthProvider, MemoryStore, OLLAMA_BASE_URL, OpenAICompatibleEmbedder, PROVIDER_DISPLAY_NAMES, Retriever, SqliteVectorStore, T1Administrator, T1_MODEL_PRIORITY, T2Manager, T2_MODEL_PRIORITY, T3Worker, T3_MODEL_PRIORITY, THEME_NAMES, TOOL_NAMES, TaskScheduler, Telemetry, ToolRegistry, VISION_MODEL_PRIORITY, WorkspaceIndex, applySyncBundle, azureModelForDeployment, beginMcpOAuth, buildManifest, buildSessionTranscript, cagCharBudget, chatCompleterFromProviders, chunkCode, chunkText2 as chunkText, completeMcpOAuth, connectMcpWithLoopbackOAuth, createCascade, decryptJSON as decryptSyncBlob, diffManifest, disambiguateMcpServerNames, discoverMcpAuthServer, discoverMcpTools, distillSessionFacts, embedderFromProviders, encryptJSON as encryptSyncBlob, fileOAuthProvider, gatherSyncBundle, hashContent, heuristicCodeChunker, inferAzureBaseModel, isMcpToolName, mcpServerPrefix, mcpToolName, nodeHttpFetch, parseRankOrder, planRetrieval, preferIpv4Host, reciprocalRankFusion, refreshMcpToken, removeMcpServerDenials, runCascade, sessionWorthRemembering, streamCascade, uniqueMcpServerName };
+export { AZURE_BASE_MODELS, AZURE_BASE_URL_TEMPLATE, AuditLogger, CASCADE_AUDIT_FILE, CASCADE_CONFIG_DIR, CASCADE_CONFIG_FILE, CASCADE_DASHBOARD_SECRET_FILE, CASCADE_DB_FILE, CASCADE_IGNORE_FILE, CASCADE_KEYSTORE_FILE, CASCADE_MD_FILE, CASCADE_VERSION, CHARS_PER_TOKEN, COMPLEXITY_T2_COUNT, Cascade, CascadeCancelledError, CascadeIgnore, CascadeRouter, CascadeToolError, CloudClient, CodeSearchTool, ConfigManager, CurrentPageTool, DEFAULT_API_PORT, DEFAULT_APPROVAL_REQUIRED, DEFAULT_AUTO_SUMMARIZE_AT, DEFAULT_CLOUD_URL, DEFAULT_CONTEXT_LIMIT, DEFAULT_DASHBOARD_PORT, DEFAULT_MAX_SESSION_MESSAGES, DEFAULT_RETENTION_DAYS, DEFAULT_THEME, DashboardServer, FileMcpOAuthStore, GITHUB_MODELS_API_VERSION, GITHUB_MODELS_CATALOG_URL, GITHUB_MODELS_INFERENCE_URL, GLOBAL_CONFIG_DIR, GLOBAL_CREDENTIALS_FILE, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_RUNTIME_DB_FILE, GraphRetriever, GraphSearchTool, HooksRunner, Keystore, LLMReranker, LM_STUDIO_BASE_URL, MAX_PAGE_TEXT_CHARS, MCP_TOOL_PREFIX, MODELS, McpClient, McpOAuthProvider, MemoryStore, OLLAMA_BASE_URL, OpenAICompatibleEmbedder, PROVIDER_DISPLAY_NAMES, Retriever, SqliteVectorStore, T1Administrator, T1_MODEL_PRIORITY, T2Manager, T2_MODEL_PRIORITY, T3Worker, T3_MODEL_PRIORITY, THEME_NAMES, TOOL_NAMES, TaskScheduler, Telemetry, ToolRegistry, VISION_MODEL_PRIORITY, WorkspaceIndex, applySyncBundle, azureModelForDeployment, beginMcpOAuth, buildManifest, buildSessionTranscript, cagCharBudget, chatCompleterFromProviders, chunkCode, chunkText2 as chunkText, completeMcpOAuth, connectMcpWithLoopbackOAuth, createCascade, decryptJSON as decryptSyncBlob, diffManifest, disambiguateMcpServerNames, discoverMcpAuthServer, discoverMcpTools, distillSessionFacts, embedderFromProviders, encryptJSON as encryptSyncBlob, fileOAuthProvider, gatherSyncBundle, hashContent, heuristicCodeChunker, inferAzureBaseModel, isMcpToolName, mcpServerPrefix, mcpToolName, nodeHttpFetch, parseRankOrder, planRetrieval, preferIpv4Host, reciprocalRankFusion, refreshMcpToken, removeMcpServerDenials, runCascade, sessionWorthRemembering, streamCascade, uniqueMcpServerName };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map