cascade-ai 0.64.0 → 0.65.0

package/dist/cli.js

@@ -1753,11 +1753,11 @@ var init_pricing = __esm({
 });
 
 // src/constants.ts
-var CASCADE_VERSION, CASCADE_CONFIG_FILE, CASCADE_DB_FILE, CASCADE_DASHBOARD_SECRET_FILE, GLOBAL_CONFIG_DIR, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_CREDENTIALS_FILE, GLOBAL_RUNTIME_DB_FILE, DEFAULT_DASHBOARD_PORT, DEFAULT_CONTEXT_LIMIT, DEFAULT_AUTO_SUMMARIZE_AT, MODELS, T1_MODEL_PRIORITY, T2_MODEL_PRIORITY, T3_MODEL_PRIORITY, VISION_MODEL_PRIORITY, COMPLEXITY_T2_COUNT, THEME_NAMES, DEFAULT_THEME, OLLAMA_BASE_URL, LM_STUDIO_BASE_URL, AZURE_BASE_URL_TEMPLATE, TOOL_NAMES, DEFAULT_APPROVAL_REQUIRED;
+var CASCADE_VERSION, CASCADE_CONFIG_FILE, CASCADE_DB_FILE, CASCADE_DASHBOARD_SECRET_FILE, GLOBAL_CONFIG_DIR, GLOBAL_DB_FILE, GLOBAL_KEYSTORE_FILE, GLOBAL_CREDENTIALS_FILE, GLOBAL_RUNTIME_DB_FILE, DEFAULT_DASHBOARD_PORT, DEFAULT_CONTEXT_LIMIT, DEFAULT_AUTO_SUMMARIZE_AT, MODELS, T1_MODEL_PRIORITY, T2_MODEL_PRIORITY, T3_MODEL_PRIORITY, VISION_MODEL_PRIORITY, COMPLEXITY_T2_COUNT, THEME_NAMES, DEFAULT_THEME, OLLAMA_BASE_URL, LM_STUDIO_BASE_URL, AZURE_BASE_URL_TEMPLATE, GITHUB_MODELS_INFERENCE_URL, GITHUB_MODELS_CATALOG_URL, GITHUB_MODELS_API_VERSION, TOOL_NAMES, DEFAULT_APPROVAL_REQUIRED;
 var init_constants = __esm({
   "src/constants.ts"() {
     init_pricing();
-    CASCADE_VERSION = "0.64.0";
+    CASCADE_VERSION = "0.65.0";
     CASCADE_CONFIG_FILE = ".cascade/config.json";
     CASCADE_DB_FILE = ".cascade/memory.db";
     CASCADE_DASHBOARD_SECRET_FILE = ".cascade/dashboard-secret";
@@ -2156,6 +2156,9 @@ var init_constants = __esm({
     OLLAMA_BASE_URL = "http://localhost:11434";
     LM_STUDIO_BASE_URL = "http://localhost:1234";
     AZURE_BASE_URL_TEMPLATE = "https://{resource}.openai.azure.com";
+    GITHUB_MODELS_INFERENCE_URL = "https://models.github.ai/inference";
+    GITHUB_MODELS_CATALOG_URL = "https://models.github.ai/catalog/models";
+    GITHUB_MODELS_API_VERSION = "2026-03-10";
     TOOL_NAMES = {
       SHELL: "shell",
       FILE_READ: "file_read",
@@ -3237,7 +3240,7 @@ var init_gemini = __esm({
 function preferIpv4Host(url) {
   return url;
 }
-async function nodeHttpFetch(input, init = {}, redirectCount = 0) {
+async function nodeHttpFetch(input, init = {}, redirectCount = 0, opts = {}) {
   const urlStr = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
   const u = new URL(preferIpv4Host(urlStr) ?? urlStr);
   const lib = u.protocol === "https:" ? https : http;
@@ -3268,9 +3271,13 @@ async function nodeHttpFetch(input, init = {}, redirectCount = 0) {
         if (status >= 300 && status < 400 && location && redirectCount < MAX_REDIRECTS) {
           res.resume();
           const nextUrl = new URL(location, u).href;
+          if (opts.allowedRedirectOrigin && new URL(nextUrl).origin !== opts.allowedRedirectOrigin) {
+            reject(new Error(`Refusing cross-origin redirect to ${new URL(nextUrl).origin}`));
+            return;
+          }
           const downgrade = status === 303 || (status === 301 || status === 302) && method !== "GET" && method !== "HEAD";
           const nextInit = downgrade ? { ...init, method: "GET", body: void 0 } : init;
-          resolve2(nodeHttpFetch(nextUrl, nextInit, redirectCount + 1));
+          resolve2(nodeHttpFetch(nextUrl, nextInit, redirectCount + 1, opts));
           return;
         }
         const encoding = (res.headers["content-encoding"] ?? "").toLowerCase();
@@ -3309,6 +3316,222 @@ var init_net = __esm({
   }
 });
 
+// src/providers/github-models.ts
+var github_models_exports = {};
+__export(github_models_exports, {
+  GITHUB_MODELS_MAX_INPUT_TOKENS: () => GITHUB_MODELS_MAX_INPUT_TOKENS,
+  GITHUB_MODELS_MAX_OUTPUT_TOKENS: () => GITHUB_MODELS_MAX_OUTPUT_TOKENS,
+  GitHubModelsProvider: () => GitHubModelsProvider,
+  stripModelOwnerPrefix: () => stripModelOwnerPrefix
+});
+function stripModelOwnerPrefix(id) {
+  const slash = (id || "").indexOf("/");
+  return slash === -1 ? id : id.slice(slash + 1);
+}
+function pickString(o, keys) {
+  for (const k of keys) {
+    const v = o[k];
+    if (typeof v === "string" && v.length > 0) return v;
+  }
+  return void 0;
+}
+function pickNumber(o, keys) {
+  for (const k of keys) {
+    const v = k.includes(".") ? o[k.split(".")[0]]?.[k.split(".")[1]] : o[k];
+    if (typeof v === "number" && Number.isFinite(v) && v > 0) return v;
+  }
+  return void 0;
+}
+function looksVisionCapable(o) {
+  for (const k of ["supported_input_modalities", "input_modalities", "modalities", "capabilities"]) {
+    const v = o[k];
+    if (Array.isArray(v) && v.some((x) => typeof x === "string" && /image|vision/i.test(x))) return true;
+  }
+  return false;
+}
+function looksToolCapable(o) {
+  const params = o["supported_parameters"];
+  if (Array.isArray(params) && params.some((x) => typeof x === "string" && /^tools?$|function.?call/i.test(x))) {
+    return true;
+  }
+  for (const k of ["capabilities", "supported_output_modalities"]) {
+    const v = o[k];
+    if (Array.isArray(v) && v.some((x) => typeof x === "string" && /tool|function.?call/i.test(x))) return true;
+  }
+  const caps = o["capabilities"];
+  if (caps && typeof caps === "object" && !Array.isArray(caps)) {
+    const c = caps;
+    if (c["function_calling"] === true || c["tool_calling"] === true || c["tools"] === true) return true;
+  }
+  return false;
+}
+function parseNextLink(linkHeader) {
+  if (!linkHeader) return null;
+  for (const part of linkHeader.split(",")) {
+    const match = part.match(/<([^>]+)>\s*;\s*rel="next"/);
+    if (match) return match[1];
+  }
+  return null;
+}
+var GITHUB_MODELS_MAX_OUTPUT_TOKENS, GITHUB_MODELS_MAX_INPUT_TOKENS, DEFAULT_CONTEXT_WINDOW, GITHUB_MODELS_MAX_CATALOG_PAGES, GITHUB_MODELS_CATALOG_ORIGIN, GitHubModelsProvider;
+var init_github_models = __esm({
+  "src/providers/github-models.ts"() {
+    init_constants();
+    init_openai();
+    init_model_filter();
+    init_net();
+    GITHUB_MODELS_MAX_OUTPUT_TOKENS = 4e3;
+    GITHUB_MODELS_MAX_INPUT_TOKENS = 8e3;
+    DEFAULT_CONTEXT_WINDOW = 128e3;
+    GITHUB_MODELS_MAX_CATALOG_PAGES = 20;
+    GITHUB_MODELS_CATALOG_ORIGIN = new URL(GITHUB_MODELS_CATALOG_URL).origin;
+    GitHubModelsProvider = class extends OpenAIProvider {
+      constructor(config, model) {
+        super({ ...config, apiKey: config.apiKey ?? "" }, model);
+        this.useMaxCompletionTokens = isReasoningModel(stripModelOwnerPrefix(model.id));
+        this.client = new OpenAI({
+          apiKey: config.apiKey ?? "",
+          baseURL: GITHUB_MODELS_INFERENCE_URL,
+          defaultHeaders: { "X-GitHub-Api-Version": GITHUB_MODELS_API_VERSION, "User-Agent": "Cascade-AI" }
+        });
+      }
+      /**
+       * `OpenAIProvider.generateStream()` builds its request budget as
+       * `options.maxTokens ?? this.model.maxOutputTokens` — an explicit per-call
+       * `maxTokens` (T1Administrator's final compilation asks for 8,000, well
+       * above GitHub's real ~4K hard cap) wins outright and is sent unclamped.
+       * GitHub then rejects the request instead of answering, so a run routed to
+       * this provider for that step fails outright rather than getting a
+       * (perfectly serviceable, just shorter) completion. Clamp here, once, right
+       * before delegating to the inherited implementation, rather than teaching
+       * every caller GitHub's specific cap.
+       */
+      async generateStream(options, onChunk) {
+        const clamped = options.maxTokens !== void 0 && options.maxTokens > GITHUB_MODELS_MAX_OUTPUT_TOKENS ? { ...options, maxTokens: GITHUB_MODELS_MAX_OUTPUT_TOKENS } : options;
+        return super.generateStream(clamped, onChunk);
+      }
+      /**
+       * The catalog is a GitHub REST resource, not an OpenAI `/models` list, and
+       * wants GitHub's own header trio — the plain `Accept: application/json` the
+       * openai-compatible provider sends is not the same request.
+       */
+      catalogHeaders() {
+        return {
+          Accept: "application/vnd.github+json",
+          Authorization: `Bearer ${this.config.apiKey ?? ""}`,
+          "X-GitHub-Api-Version": GITHUB_MODELS_API_VERSION,
+          // GitHub's REST API rejects any request with no User-Agent — a plain 403
+          // regardless of how valid the PAT is. nodeHttpFetch is a thin wrapper
+          // over node:http/https, neither of which sets one the way a browser's
+          // fetch or a full HTTP client library would, so this has to be explicit.
+          "User-Agent": "Cascade-AI"
+        };
+      }
+      async listModels() {
+        const raw = [];
+        let url = GITHUB_MODELS_CATALOG_URL;
+        let pages = 0;
+        const visited = /* @__PURE__ */ new Set();
+        while (url && pages < GITHUB_MODELS_MAX_CATALOG_PAGES) {
+          if (visited.has(url)) break;
+          visited.add(url);
+          const res = await nodeHttpFetch(url, { headers: this.catalogHeaders() }, 0, {
+            allowedRedirectOrigin: GITHUB_MODELS_CATALOG_ORIGIN
+          });
+          if (!res.ok) throw new Error(`GitHub Models catalog ${url} returned HTTP ${res.status}`);
+          const body = await res.json();
+          const pageItems = Array.isArray(body) ? body : Array.isArray(body?.models) ? body.models : Array.isArray(body?.data) ? body.data : [];
+          raw.push(...pageItems);
+          const next = parseNextLink(res.headers.get("link"));
+          if (next) {
+            const resolved = new URL(next, url);
+            if (resolved.origin !== GITHUB_MODELS_CATALOG_ORIGIN) {
+              throw new Error(`Refusing cross-origin GitHub Models pagination URL: ${resolved.origin}`);
+            }
+            url = resolved.href;
+          } else {
+            url = null;
+          }
+          pages++;
+        }
+        const entries = raw.map((m) => {
+          if (typeof m === "string") {
+            return { id: m, name: m, contextWindow: DEFAULT_CONTEXT_WINDOW, vision: false, tools: false };
+          }
+          if (!m || typeof m !== "object") return void 0;
+          const o = m;
+          const id = pickString(o, ["id", "name", "model"]);
+          if (!id) return void 0;
+          return {
+            id,
+            name: pickString(o, ["friendly_name", "display_name", "name"]) ?? id,
+            contextWindow: pickNumber(o, [
+              "context_window",
+              "context_length",
+              "max_input_tokens",
+              "limits.max_input_tokens",
+              "limits.max_context_tokens"
+            ]) ?? DEFAULT_CONTEXT_WINDOW,
+            vision: looksVisionCapable(o),
+            tools: looksToolCapable(o)
+          };
+        }).filter((e) => e !== void 0);
+        if (entries.length === 0) return [];
+        const chat = entries.filter((e) => isChatModel(e.id));
+        return (chat.length ? chat : entries).map((e) => ({
+          id: e.id,
+          // full `owner/model` — what the API is addressed by
+          name: e.name,
+          provider: "github-models",
+          // GitHub's real per-request input cap, not the base model's larger one
+          // (see GITHUB_MODELS_MAX_INPUT_TOKENS above) — the same reasoning
+          // already applied to maxOutputTokens below, for the input side.
+          contextWindow: Math.min(e.contextWindow, GITHUB_MODELS_MAX_INPUT_TOKENS),
+          isVisionCapable: e.vision,
+          // A REAL $0, not a missing number — usage is bundled into the quota of
+          // the plan the PAT belongs to and is never billed per token, so
+          // `pricingUnknown: false` is the honest value (see the flag's contract in
+          // core/router/pricing.ts: 0 alone is ambiguous). Set here rather than in
+          // pricing-data.json because resolvePricing() matches exactly on
+          // provider|model|region with no wildcard: every catalog model would need
+          // a hand-curated row, and the next one GitHub adds would read as "cost
+          // unknown" — an inconsistent picture for a billing reality that is
+          // identical across the entire catalog.
+          //
+          // `isLocal` is the OTHER way to reach a real $0, and it is the wrong one:
+          // it means "runs on this machine" and carries consequences that are
+          // simply false for a hosted API — the shared concurrency-1
+          // LocalRequestQueue (serialising these calls behind actual Ollama GPU
+          // inference), the 300s local rather than 120s cloud inference timeout,
+          // and a literal "[local]" tag in `cascade models`.
+          inputCostPer1kTokens: 0,
+          outputCostPer1kTokens: 0,
+          pricingUnknown: false,
+          maxOutputTokens: GITHUB_MODELS_MAX_OUTPUT_TOKENS,
+          supportsStreaming: true,
+          // Not every catalog model supports function/tool calling — a hardcoded
+          // `true` sent `tools` to models that reject the parameter outright and
+          // never engaged t3-worker.ts's existing text-tool fallback (only an
+          // explicit `false` does). See looksToolCapable's own comment for why
+          // "not positively advertised" defaults to false rather than true here.
+          supportsToolUse: e.tools,
+          isLocal: false
+        }));
+      }
+      async isAvailable() {
+        try {
+          const res = await nodeHttpFetch(GITHUB_MODELS_CATALOG_URL, { headers: this.catalogHeaders() }, 0, {
+            allowedRedirectOrigin: GITHUB_MODELS_CATALOG_ORIGIN
+          });
+          return res.ok;
+        } catch {
+          return false;
+        }
+      }
+    };
+  }
+});
+
 // src/providers/ollama.ts
 var ollama_exports = {};
 __export(ollama_exports, {
@@ -4943,7 +5166,7 @@ Original error: ${err.message}`
   }
 };
 var ProviderConfigSchema = z.object({
-  type: z.enum(["anthropic", "openai", "gemini", "azure", "openai-compatible", "ollama"]),
+  type: z.enum(["anthropic", "openai", "gemini", "azure", "openai-compatible", "ollama", "github-models"]),
   label: z.string().optional(),
   apiKey: z.string().optional(),
   baseUrl: z.string().url().optional(),
@@ -5123,6 +5346,18 @@ var CascadeConfigSchema = z.object({
   budget: BudgetConfigSchema.default({}),
   theme: z.string().default("cascade"),
   workspace: WorkspaceConfigSchema.default({}),
+  /**
+   * Per-provider tokens-per-minute overrides for the router's TpmLimiter (see
+   * DEFAULT_PROVIDER_TPM in core/router/tpm-limiter.ts). Documented as a raw
+   * config field for a while before this — since CascadeConfigSchema strips
+   * unknown keys, a config file setting it was silently discarded and the
+   * override never reached TpmLimiter's constructor. Optional/permissive on
+   * provider name (not a ProviderType enum) so a config still validates
+   * against a slightly newer/older provider list than this schema knows.
+   */
+  rateLimits: z.object({
+    providerTpm: z.record(z.string(), z.number().positive()).optional()
+  }).optional(),
   /**
    * Cascade Auto: when true, the TaskAnalyzer selects the optimal model for each
    * tier based on task type and complexity, overriding the static priority lists.
@@ -5654,7 +5889,14 @@ var ConfigManager = class {
       anthropic: "ANTHROPIC_API_KEY",
       openai: "OPENAI_API_KEY",
       gemini: "GOOGLE_API_KEY",
-      azure: "AZURE_OPENAI_KEY"
+      azure: "AZURE_OPENAI_KEY",
+      // Deliberately NOT `GITHUB_TOKEN`: that one is injected automatically by
+      // GitHub Actions and is commonly exported in developer shells for `gh`
+      // and git auth, and it will essentially never carry the fine-grained
+      // `models: read` scope this provider needs. Adopting it would wire up a
+      // provider that 403s on its first real call — a confusing failure for
+      // something that is meant to be explicit opt-in BYOK.
+      "github-models": "GITHUB_MODELS_TOKEN"
     };
     const envKey = envMap[provider];
     if (envKey && process.env[envKey]) return process.env[envKey];
@@ -5683,7 +5925,10 @@ var ConfigManager = class {
       { env: "ANTHROPIC_API_KEY", type: "anthropic" },
       { env: "OPENAI_API_KEY", type: "openai" },
       { env: "GOOGLE_API_KEY", type: "gemini" },
-      { env: "AZURE_OPENAI_KEY", type: "azure" }
+      { env: "AZURE_OPENAI_KEY", type: "azure" },
+      // See getApiKey() above for why this is GITHUB_MODELS_TOKEN and never
+      // the ambient GITHUB_TOKEN.
+      { env: "GITHUB_MODELS_TOKEN", type: "github-models" }
     ];
     for (const { env, type } of envProviders) {
       const key = process.env[env];
@@ -6065,6 +6310,7 @@ init_constants();
 init_anthropic();
 init_azure();
 init_gemini();
+init_github_models();
 init_ollama();
 init_openai_compatible();
 init_openai();
@@ -6072,6 +6318,7 @@ init_openai();
 // src/core/router/selector.ts
 init_constants();
 init_pricing();
+init_github_models();
 function normalizeModelId(id) {
   return id.replace(/^models\//, "").toLowerCase();
 }
@@ -6181,16 +6428,23 @@ var ModelSelector = class {
         return model;
       }
     }
+    for (const model of this.availableModels.values()) {
+      if (this.availableProviders.has(model.provider) && model.isVisionCapable) return model;
+    }
     return null;
   }
   getNextFallback(currentModelId, tier) {
     const priority = this.getPriorityList(tier);
     const currentIdx = priority.indexOf(currentModelId);
-    if (currentIdx === -1) return null;
-    for (let i = currentIdx + 1; i < priority.length; i++) {
-      const key = priority[i];
-      const model = this.availableModels.get(key);
-      if (model && this.isUsable(model)) return model;
+    if (currentIdx !== -1) {
+      for (let i = currentIdx + 1; i < priority.length; i++) {
+        const key = priority[i];
+        const model = this.availableModels.get(key);
+        if (model && this.isUsable(model)) return model;
+      }
+    }
+    for (const [id, model] of this.availableModels) {
+      if (id !== currentModelId && this.isUsable(model)) return model;
     }
     return null;
   }
@@ -6266,7 +6520,7 @@ var ModelSelector = class {
     if (overrideModelId.includes(":")) {
       const parts = overrideModelId.split(":");
       const prefix = parts[0].toLowerCase();
-      const validProviders = ["anthropic", "openai", "gemini", "azure", "openai-compatible", "ollama"];
+      const validProviders = ["anthropic", "openai", "gemini", "azure", "openai-compatible", "ollama", "github-models"];
       if (validProviders.includes(prefix)) {
         providerStr = prefix;
         actualId = parts.slice(1).join(":");
@@ -6286,6 +6540,31 @@ var ModelSelector = class {
       else if (this.availableProviders.has("openai-compatible")) providerStr = "openai-compatible";
       else if (this.availableProviders.size === 1) providerStr = Array.from(this.availableProviders)[0];
     }
+    if (providerStr === "github-models" && this.availableProviders.has("github-models")) {
+      const dynamicModel = {
+        id: actualId,
+        name: actualId,
+        provider: "github-models",
+        contextWindow: GITHUB_MODELS_MAX_INPUT_TOKENS,
+        isVisionCapable: false,
+        inputCostPer1kTokens: 0,
+        outputCostPer1kTokens: 0,
+        pricingUnknown: false,
+        maxOutputTokens: GITHUB_MODELS_MAX_OUTPUT_TOKENS,
+        supportsStreaming: true,
+        // Unconfirmed (no live catalog entry to read a real capability from)
+        // must default to false, not left undefined: t3-worker.ts's text-tool
+        // fallback only engages on a strict `=== false`, so an undefined
+        // value here sends native `tools` to an unverified multi-vendor
+        // model and any that don't support function calling reject the
+        // request outright. Same default-to-false-when-unconfirmed policy
+        // listModels() already applies for a real catalog entry.
+        supportsToolUse: false,
+        isLocal: false
+      };
+      this.addDynamicModel(dynamicModel);
+      return dynamicModel;
+    }
     if (providerStr && this.availableProviders.has(providerStr)) {
       const dynamicModel = withResolvedPricing({
         id: actualId,
@@ -6378,7 +6657,20 @@ var DEFAULT_PROVIDER_TPM = {
   gemini: 6e4,
   azure: 3e4,
   "openai-compatible": 3e4,
-  ollama: Number.POSITIVE_INFINITY
+  ollama: Number.POSITIVE_INFINITY,
+  // An order of magnitude below the others, on purpose. GitHub Models is
+  // rate-limited by REQUESTS (Free ≈10 RPM, Pro ≈20, plus low daily caps), and
+  // this bucket meters TOKENS — there is no request-count limiter in this
+  // codebase, and building one is not in scope. The approximation works because
+  // the router reserves `model.maxOutputTokens + 512` per call, and the
+  // provider reports GitHub's real ~4K per-request cap rather than the
+  // underlying model's larger one — so every call withdraws a near-constant
+  // ~4.5K regardless of how short the reply actually turns out to be. At 8K/min
+  // that lands around 1–2 calls per minute of headroom: comfortably inside even
+  // the Free tier, with room for the daily cap to matter more than this does.
+  // Users on a higher tier can raise it with no code change through the generic
+  // `config.rateLimits.providerTpm['github-models']` override.
+  "github-models": 8e3
 };
 var TpmLimiter = class {
   buckets = /* @__PURE__ */ new Map();
@@ -6725,6 +7017,7 @@ var ModelProfiler = class {
       (m) => !alreadyProfiled.has(m.id) && !SKIP_PATTERN.test(m.id) && !SKIP_PATTERN.test(m.name)
     );
     if (toProfile.length === 0) return;
+    const probesHitGithubModels = this.router?.getModelForTier("T3")?.provider === "github-models";
     const openRouterModels = await fetchOpenRouterModels();
     const orByNormalizedId = /* @__PURE__ */ new Map();
     for (const m of openRouterModels) {
@@ -6739,7 +7032,7 @@ var ModelProfiler = class {
         if (orMatch?.description) {
           specializations = extractSpecializations(orMatch.description);
         }
-        if (specializations.length === 0 && this.router) {
+        if (specializations.length === 0 && this.router && !probesHitGithubModels) {
           specializations = await queryModelDirectly(this.router);
         }
         this.store.saveModelProfile(model.id, model.provider, specializations);
@@ -6964,6 +7257,7 @@ var LiveDataProvider = class {
    */
   applyLivePricing(models) {
     return models.map((m) => {
+      if (m.provider === "github-models") return m;
       const p = this.getLivePrice(m.baseModelId ?? m.id);
       if (!p) return m;
       const reconciled = reconcilePrice(m, p);
@@ -7002,6 +7296,7 @@ var LiveDataProvider = class {
    */
   applyLiveCapabilities(models) {
     return models.map((m) => {
+      if (m.provider === "github-models") return m;
       const c = this.getCapability(m.baseModelId ?? m.id);
       if (!c) return m;
       const next = { ...m };
@@ -7305,13 +7600,16 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
       for (const model of azureDeployments) this.selector.addDynamicModel(model);
       availableProviders.add("azure");
     }
+    if (availableProviders.has("github-models")) {
+      await this.discoverGitHubModelsCatalog(config);
+    }
     await this.validateCloudProviderModels(config);
     for (const tier of ["T1", "T2", "T3"]) {
       const override = tier === "T1" ? config.models.t1 : tier === "T2" ? config.models.t2 : config.models.t3;
       if (!override || override === "auto") continue;
       const model = this.selector.selectForTier(tier, override);
       if (!model) {
-        const knownProviders = ["anthropic", "openai", "gemini", "azure", "openai-compatible", "ollama"];
+        const knownProviders = ["anthropic", "openai", "gemini", "azure", "openai-compatible", "ollama", "github-models"];
         const hasProviderPrefix = override.includes(":") && knownProviders.some((p) => override.startsWith(p + ":"));
         if (hasProviderPrefix) {
           const provider = override.split(":")[0];
@@ -7466,7 +7764,7 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
    * models without a package upgrade. Mirrors discoverOllamaModels.
    */
   async discoverProviderModels() {
-    const cloud = ["anthropic", "openai", "gemini", "azure", "openai-compatible"];
+    const cloud = ["anthropic", "openai", "gemini", "azure", "openai-compatible", "github-models"];
     const tasks = cloud.map(async (type) => {
       if (!this.selector.isProviderAvailable(type)) return;
       const seed = this.getAnyModelForProvider(type);
@@ -7521,6 +7819,9 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
       this.ensureProvider(options.model, this.config.providers);
     }
     let model = requireVision ? this.selector.selectVisionModel() : options.model ?? this.tierModels.get(tier) ?? this.selector.selectForTier(tier) ?? void 0;
+    if (requireVision && model) {
+      this.ensureProvider(model, this.config.providers);
+    }
     if (options.forceLocal && model && !this.isPrivateModel(model)) {
       const localModel = this.selector.getAllAvailableModels().find((m) => this.isPrivateModel(m));
       if (!localModel) {
@@ -7534,7 +7835,8 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
     if (!model) throw new Error(`No model available for tier ${tier}`);
     const provider = this.getProvider(model);
     if (!provider) throw new Error(`No provider for model ${model.id}`);
-    const estimatedTokens = (options.maxTokens ?? model.maxOutputTokens ?? 1024) + 512;
+    const requestedTokens = options.maxTokens ?? model.maxOutputTokens ?? 1024;
+    const estimatedTokens = Math.min(requestedTokens, model.maxOutputTokens ?? requestedTokens) + 512;
     if (this.tpmLimiter) {
       await this.tpmLimiter.acquire(model.provider, estimatedTokens);
     }
@@ -7625,7 +7927,8 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
           });
           releaseLocalSlot?.();
           releaseLocalSlot = void 0;
-          return this.generate(tier, options, onChunk, requireVision);
+          const retryOpts = options.model && options.model.id === model.id ? { ...options, model: void 0 } : options;
+          return this.generate(tier, retryOpts, onChunk, requireVision);
         }
       }
       if (isModelNotFoundError(errMsg)) {
@@ -7976,6 +8279,26 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
       return false;
     }
   }
+  /**
+   * Registers GitHub Models' real catalog ids via addDynamicModel so init()'s
+   * tier-fill loop can pick one. Registration alone does not create a bound
+   * BaseProvider instance (see ensureProvider) — the tier-fill loop's own
+   * ensureProvider call does that for whichever model it actually selects,
+   * which is why this runs BEFORE that loop rather than only in the
+   * background discoverProviderModels() refresh.
+   */
+  async discoverGitHubModelsCatalog(config) {
+    const cfg = config.providers.find((p) => p.type === "github-models") ?? { type: "github-models" };
+    const seed = this.getAnyModelForProvider("github-models");
+    if (!seed) return;
+    try {
+      const provider = new GitHubModelsProvider(cfg, seed);
+      const models = await provider.listModels();
+      for (const m of models) this.selector.addDynamicModel(m);
+    } catch (err) {
+      console.warn("[router] GitHub Models catalog discovery failed:", err instanceof Error ? err.message : err);
+    }
+  }
   ensureProvider(model, configs) {
     const key = `${model.provider}:${model.id}`;
     if (this.providers.has(key)) return;
@@ -8000,6 +8323,8 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
         return new OllamaProvider(cfg, model);
       case "openai-compatible":
         return new OpenAICompatibleProvider(cfg, model);
+      case "github-models":
+        return new GitHubModelsProvider(cfg, model);
       default:
         throw new Error(`Unsupported provider type: ${String(cfg.type)}`);
     }
@@ -8007,7 +8332,7 @@ var CascadeRouter = class _CascadeRouter extends EventEmitter {
   getAnyModelForProvider(type) {
     const fromCatalog = Object.values(MODELS).find((m) => m.provider === type);
     if (fromCatalog) return fromCatalog;
-    if (type === "openai-compatible" || type === "azure") {
+    if (type === "openai-compatible" || type === "azure" || type === "github-models") {
       return {
         id: type,
         name: type,
@@ -20097,7 +20422,10 @@ async function refreshModelCache(store, providers) {
       else if (provider.type === "anthropic") instance = new AnthropicProvider(provider, dummyModel);
       else if (provider.type === "ollama") instance = new OllamaProvider(provider, dummyModel);
       else if (provider.type === "openai-compatible") instance = new OpenAICompatibleProvider(provider, dummyModel);
-      else if (provider.type === "azure") {
+      else if (provider.type === "github-models") {
+        const { GitHubModelsProvider: GitHubModelsProvider2 } = await Promise.resolve().then(() => (init_github_models(), github_models_exports));
+        instance = new GitHubModelsProvider2(provider, dummyModel);
+      } else if (provider.type === "azure") {
         const { AzureOpenAIProvider: AzureOpenAIProvider2 } = await Promise.resolve().then(() => (init_azure(), azure_exports));
         instance = new AzureOpenAIProvider2(provider, dummyModel);
       }
@@ -21204,7 +21532,7 @@ async function validateConfiguredModels(config) {
 function inferProviderFromModelId(id, providers) {
   if (id.includes(":")) {
     const prefix = id.split(":")[0].toLowerCase();
-    const validProviders = ["anthropic", "openai", "gemini", "azure", "openai-compatible", "ollama"];
+    const validProviders = ["anthropic", "openai", "gemini", "azure", "openai-compatible", "ollama", "github-models"];
     if (validProviders.includes(prefix)) {
       return prefix;
     }
@@ -21501,9 +21829,10 @@ var PROVIDER_LABELS = {
   gemini: "Google Gemini",
   azure: "Azure OpenAI",
   ollama: "Ollama (local)",
-  "openai-compatible": "OpenAI-Compatible"
+  "openai-compatible": "OpenAI-Compatible",
+  "github-models": "GitHub Models"
 };
-var providerOrder = ["anthropic", "openai", "gemini", "azure", "ollama", "openai-compatible"];
+var providerOrder = ["anthropic", "openai", "gemini", "azure", "ollama", "openai-compatible", "github-models"];
 function buildInitialEntries(types) {
   return [...types].map((type) => ({
     id: randomUUID(),
@@ -21675,6 +22004,13 @@ function SetupWizard({ workspacePath, onComplete }) {
             const fetched = await p.listModels();
             fetched.forEach((m) => models.push({ id: m.id, name: m.name, providerLabel: entry.label }));
             dispatchRef.current({ type: "SET_FETCH_LOG", line: `  \u2714 ${entry.label} \u2014 ${fetched.length} models` });
+          } else if (type === "github-models") {
+            const { GitHubModelsProvider: GitHubModelsProvider2 } = await Promise.resolve().then(() => (init_github_models(), github_models_exports));
+            const dummyModel = { id: "dummy", name: "dummy", provider: type, contextWindow: 0, isVisionCapable: false, inputCostPer1kTokens: 0, outputCostPer1kTokens: 0, maxOutputTokens: 0, supportsStreaming: false, isLocal: false };
+            const p = new GitHubModelsProvider2({ type, apiKey }, dummyModel);
+            const fetched = await p.listModels();
+            fetched.forEach((m) => models.push({ id: `${type}:${m.id}`, name: m.name, providerLabel: entry.label }));
+            dispatchRef.current({ type: "SET_FETCH_LOG", line: `  \u2714 ${entry.label} \u2014 ${fetched.length} models` });
           } else if (type === "gemini") {
             const { GeminiProvider: GeminiProvider2 } = await Promise.resolve().then(() => (init_gemini(), gemini_exports));
             const dummyModel = { id: "dummy", name: "dummy", provider: type, contextWindow: 0, isVisionCapable: false, inputCostPer1kTokens: 0, outputCostPer1kTokens: 0, maxOutputTokens: 0, supportsStreaming: false, isLocal: false };
@@ -21853,7 +22189,8 @@ function SetupWizard({ workspacePath, onComplete }) {
           /* @__PURE__ */ jsx(Text, { color: focused ? theme.colors.primary : selected ? theme.colors.foreground : theme.colors.muted, children: PROVIDER_LABELS[p] }),
           p === "azure" && /* @__PURE__ */ jsx(Text, { color: theme.colors.muted, dimColor: true, children: "  \u2014 multiple deployments supported" }),
           p === "openai-compatible" && /* @__PURE__ */ jsx(Text, { color: theme.colors.muted, dimColor: true, children: "  \u2014 Groq, Together, custom" }),
-          p === "ollama" && /* @__PURE__ */ jsx(Text, { color: theme.colors.muted, dimColor: true, children: "  \u2014 no API key needed" })
+          p === "ollama" && /* @__PURE__ */ jsx(Text, { color: theme.colors.muted, dimColor: true, children: "  \u2014 no API key needed" }),
+          p === "github-models" && /* @__PURE__ */ jsx(Text, { color: theme.colors.muted, dimColor: true, children: "  \u2014 GitHub PAT with `models: read`" })
         ] }, p);
       }) }),
       /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsx(Text, { color: theme.colors.muted, dimColor: true, children: "space select  \xB7  a all  \xB7  i invert  \xB7  enter continue" }) }),
@@ -22260,7 +22597,8 @@ async function doctorCommand() {
     { type: "anthropic", name: "Anthropic" },
     { type: "openai", name: "OpenAI" },
     { type: "gemini", name: "Google Gemini" },
-    { type: "azure", name: "Azure OpenAI" }
+    { type: "azure", name: "Azure OpenAI" },
+    { type: "github-models", name: "GitHub Models" }
   ];
   for (const { type, name } of providers) {
     const key = cm.getApiKey(type);