indusagi 0.13.10 → 0.13.12

package/dist/types/facade/ml/models.generated.d.ts

@@ -4637,6 +4637,87 @@ export declare const MODELS: {
             contextWindow: number;
             maxTokens: number;
         };
+        readonly "gpt-6-astra": {
+            id: string;
+            name: string;
+            api: "openai-responses";
+            provider: string;
+            baseUrl: string;
+            reasoning: true;
+            reasoningEfforts: ("low" | "medium" | "high" | "xhigh" | "max")[];
+            input: ("text" | "image")[];
+            cost: {
+                input: number;
+                output: number;
+                cacheRead: number;
+                cacheWrite: number;
+            };
+            longContextPricing: {
+                threshold: number;
+                multipliers: {
+                    input: number;
+                    output: number;
+                    cacheRead: number;
+                    cacheWrite: number;
+                };
+            };
+            contextWindow: number;
+            maxTokens: number;
+        };
+        readonly "gpt-6-sol": {
+            id: string;
+            name: string;
+            api: "openai-responses";
+            provider: string;
+            baseUrl: string;
+            reasoning: true;
+            reasoningEfforts: "high"[];
+            input: ("text" | "image")[];
+            cost: {
+                input: number;
+                output: number;
+                cacheRead: number;
+                cacheWrite: number;
+            };
+            longContextPricing: {
+                threshold: number;
+                multipliers: {
+                    input: number;
+                    output: number;
+                    cacheRead: number;
+                    cacheWrite: number;
+                };
+            };
+            contextWindow: number;
+            maxTokens: number;
+        };
+        readonly "gpt-6-luna": {
+            id: string;
+            name: string;
+            api: "openai-responses";
+            provider: string;
+            baseUrl: string;
+            reasoning: true;
+            reasoningEfforts: ("low" | "medium" | "high" | "xhigh" | "max")[];
+            input: ("text" | "image")[];
+            cost: {
+                input: number;
+                output: number;
+                cacheRead: number;
+                cacheWrite: number;
+            };
+            longContextPricing: {
+                threshold: number;
+                multipliers: {
+                    input: number;
+                    output: number;
+                    cacheRead: number;
+                    cacheWrite: number;
+                };
+            };
+            contextWindow: number;
+            maxTokens: number;
+        };
         readonly "gpt-5.6-sol": {
             id: string;
             name: string;
@@ -5098,6 +5179,87 @@ export declare const MODELS: {
             contextWindow: number;
             maxTokens: number;
         };
+        readonly "gpt-6-astra": {
+            id: string;
+            name: string;
+            api: "openai-codex-responses";
+            provider: string;
+            baseUrl: string;
+            reasoning: true;
+            reasoningEfforts: ("low" | "medium" | "high" | "xhigh" | "max")[];
+            input: ("text" | "image")[];
+            cost: {
+                input: number;
+                output: number;
+                cacheRead: number;
+                cacheWrite: number;
+            };
+            longContextPricing: {
+                threshold: number;
+                multipliers: {
+                    input: number;
+                    output: number;
+                    cacheRead: number;
+                    cacheWrite: number;
+                };
+            };
+            contextWindow: number;
+            maxTokens: number;
+        };
+        readonly "gpt-6-sol": {
+            id: string;
+            name: string;
+            api: "openai-codex-responses";
+            provider: string;
+            baseUrl: string;
+            reasoning: true;
+            reasoningEfforts: "high"[];
+            input: ("text" | "image")[];
+            cost: {
+                input: number;
+                output: number;
+                cacheRead: number;
+                cacheWrite: number;
+            };
+            longContextPricing: {
+                threshold: number;
+                multipliers: {
+                    input: number;
+                    output: number;
+                    cacheRead: number;
+                    cacheWrite: number;
+                };
+            };
+            contextWindow: number;
+            maxTokens: number;
+        };
+        readonly "gpt-6-luna": {
+            id: string;
+            name: string;
+            api: "openai-codex-responses";
+            provider: string;
+            baseUrl: string;
+            reasoning: true;
+            reasoningEfforts: ("low" | "medium" | "high" | "xhigh" | "max")[];
+            input: ("text" | "image")[];
+            cost: {
+                input: number;
+                output: number;
+                cacheRead: number;
+                cacheWrite: number;
+            };
+            longContextPricing: {
+                threshold: number;
+                multipliers: {
+                    input: number;
+                    output: number;
+                    cacheRead: number;
+                    cacheWrite: number;
+                };
+            };
+            contextWindow: number;
+            maxTokens: number;
+        };
     };
     readonly opencode: {
         readonly "big-pickle": {

package/dist/types/facade/ml/types.d.ts

@@ -4,13 +4,14 @@ export type KnownApi = "mock-ai" | "openai-completions" | "openai-responses" | "
 export type Api = KnownApi | (string & {});
 export type KnownProvider = "mock" | "amazon-bedrock" | "anthropic" | "google" | "google-vertex" | "openai" | "azure-openai-responses" | "openai-codex" | "github-copilot" | "xai" | "groq" | "cerebras" | "openrouter" | "vercel-ai-gateway" | "zai" | "mistral" | "minimax" | "minimax-cn" | "opencode" | "kimi" | "kimi-coding" | "sarvam" | "krutrim" | "nvidia";
 export type Provider = KnownProvider | string;
-export type ThinkingLevel = "minimal" | "low" | "medium" | "high" | "xhigh";
+export type ThinkingLevel = "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
 /** Per-level token allowances for reasoning, used only by token-budget providers. */
 export interface ThinkingBudgets {
     minimal?: number;
     low?: number;
     medium?: number;
     high?: number;
+    max?: number;
 }
 export interface StreamOptions {
     temperature?: number;
@@ -228,6 +229,8 @@ export interface Model<TApi extends Api> {
     provider: Provider;
     baseUrl: string;
     reasoning: boolean;
+    /** Explicit reasoning efforts accepted by this model; omitted when provider defaults apply. */
+    reasoningEfforts?: readonly Exclude<ThinkingLevel, "minimal">[];
     input: ("text" | "image")[];
     cost: {
         input: number;
@@ -235,6 +238,16 @@ export interface Model<TApi extends Api> {
         cacheRead: number;
         cacheWrite: number;
     };
+    /** Optional pricing tier applied by providers after an input-token threshold. */
+    longContextPricing?: {
+        threshold: number;
+        multipliers: {
+            input: number;
+            output: number;
+            cacheRead: number;
+            cacheWrite: number;
+        };
+    };
     contextWindow: number;
     maxTokens: number;
     headers?: Record<string, string>;

package/dist/types/llmgateway/connectors/openai-responses.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/llmgateway/contract/index.d.ts

@@ -3,11 +3,11 @@
  *
  * Every downstream gateway module imports its vocabulary from this barrel.
  */
-export type { ProviderId, ApiKind, Modality, CostSheet, ModelCard, } from "./model-card";
+export type { ProviderId, ApiKind, Modality, CostSheet, LongContextPricing, ModelCard, } from "./model-card";
 export type { JsonSchema, TextBlock, ThinkingBlock, ToolCallBlock, ToolResultBlock, ImageBlock, CommandBlock, Block, UserTurn, AssistantTurn, ToolTurn, Turn, ToolDescriptor, Conversation, } from "./conversation";
 export type { Usage, StopReason, Reply } from "./reply";
 export type { TextEmission, ThinkingEmission, ToolCallStartEmission, ToolCallDeltaEmission, UsageEmission, StopEmission, DoneEmission, ErrorEmission, Emission, Channel, } from "./emission";
-export type { ThinkingLevel, ToolChoice, StreamOptions, } from "./options";
+export type { ThinkingLevel, ReasoningEffort, ToolChoice, StreamOptions, } from "./options";
 export type { GatewayErrorKind, GatewayErrorExtra, } from "./errors";
 export { GatewayError, gatewayError } from "./errors";
 export type { Connector, CredentialResolver } from "./connector";

package/dist/types/llmgateway/contract/model-card.d.ts

@@ -5,6 +5,7 @@
  * behavior; connectors read it to shape their wire requests, and the pricing
  * helpers read it to turn token counts into money.
  */
+import type { ReasoningEffort } from "./options";
 /**
  * The upstream organization that owns a model. This is the *vendor* identity,
  * independent of which HTTP dialect we speak to reach it (see {@link ApiKind}).
@@ -25,6 +26,16 @@ export interface CostSheet {
     readonly cacheReadPerMTok?: number;
     readonly cacheWritePerMTok?: number;
 }
+/** Optional higher-price tier triggered by a long input context. */
+export interface LongContextPricing {
+    readonly threshold: number;
+    readonly multipliers: {
+        readonly input: number;
+        readonly output: number;
+        readonly cacheRead: number;
+        readonly cacheWrite: number;
+    };
+}
 /**
  * Static descriptor for one model. Identified by `id` within a `provider`.
  */
@@ -38,5 +49,8 @@ export interface ModelCard {
     readonly maxOutputTokens: number;
     readonly modalities: readonly Modality[];
     readonly reasoning: boolean;
+    /** Explicit wire efforts for models whose accepted set differs from provider defaults. */
+    readonly reasoningEfforts?: readonly ReasoningEffort[];
+    readonly longContextPricing?: LongContextPricing;
     readonly cost: CostSheet;
 }

package/dist/types/llmgateway/contract/options.d.ts

@@ -9,7 +9,9 @@
  * How much reasoning budget to grant a reasoning-capable model.
  * `off` disables thinking entirely; the remaining levels scale the budget up.
  */
-export type ThinkingLevel = "off" | "low" | "medium" | "high" | "max";
+export type ThinkingLevel = "off" | "low" | "medium" | "high" | "xhigh" | "max";
+/** Reasoning efforts that can be sent on the wire (excluding disabled reasoning). */
+export type ReasoningEffort = Exclude<ThinkingLevel, "off">;
 /** Constrains how the model may use the declared tools on this turn. */
 export type ToolChoice = "auto" | "required" | "none";
 /** Options for a single streaming or one-shot invocation. */

package/dist/types/react-host/jsx-dev-runtime.d.ts

@@ -0,0 +1,3 @@
+import type * as ReactJsxDevRuntimeTypes from "react/jsx-dev-runtime";
+export declare const Fragment: typeof ReactJsxDevRuntimeTypes.Fragment;
+export declare const jsxDEV: typeof ReactJsxDevRuntimeTypes.jsxDEV;

package/dist/types/react-host/loader.d.ts

@@ -1,3 +1,4 @@
 export declare function loadHostReact(): Promise<typeof import("react")>;
 export declare function loadHostJsxRuntime(): Promise<typeof import("react/jsx-runtime")>;
+export declare function loadHostJsxDevRuntime(): Promise<typeof import("react/jsx-dev-runtime")>;
 export declare function loadHostInk(): Promise<typeof import("ink")>;

package/dist/types/security/private-state.d.ts

@@ -0,0 +1,3 @@
+export declare function ensurePrivateDirectorySync(path: string): void;
+export declare function readPrivateFileSync(path: string): string | null;
+export declare function atomicWritePrivateFileSync(path: string, content: string): void;

package/dist/zoho.js

@@ -840,8 +840,96 @@ function platformOpenCommand(url) {
 }
 
 // src/facade/mcp-core/oauth/token-store.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
+
+// src/security/private-state.ts
+import {
+  chmodSync,
+  closeSync,
+  constants,
+  fchmodSync,
+  fstatSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "node:fs";
+import { randomUUID } from "node:crypto";
+import { dirname } from "node:path";
+var NO_FOLLOW = constants.O_NOFOLLOW ?? 0;
+var isPosix = () => process.platform !== "win32";
+function assertOwned(uid, path) {
+  if (!isPosix() || process.getuid === void 0) return;
+  if (uid !== process.getuid()) throw new Error(`Refusing sensitive path not owned by the current user: ${path}`);
+}
+function ensurePrivateDirectorySync(path) {
+  try {
+    const current = lstatSync(path);
+    if (current.isSymbolicLink() || !current.isDirectory()) throw new Error(`Refusing non-directory sensitive state path: ${path}`);
+    assertOwned(current.uid, path);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    mkdirSync(path, { recursive: true, mode: 448 });
+  }
+  if (isPosix()) chmodSync(path, 448);
+}
+function validateExistingFile(path) {
+  try {
+    const current = lstatSync(path);
+    if (current.isSymbolicLink() || !current.isFile()) throw new Error(`Refusing non-regular sensitive file: ${path}`);
+    assertOwned(current.uid, path);
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+}
+function readPrivateFileSync(path) {
+  ensurePrivateDirectorySync(dirname(path));
+  validateExistingFile(path);
+  let fd;
+  try {
+    fd = openSync(path, constants.O_RDONLY | NO_FOLLOW);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  try {
+    const current = fstatSync(fd);
+    if (!current.isFile()) throw new Error(`Refusing non-regular sensitive file: ${path}`);
+    assertOwned(current.uid, path);
+    if (isPosix()) fchmodSync(fd, 384);
+    return readFileSync(fd, "utf8");
+  } finally {
+    closeSync(fd);
+  }
+}
+function atomicWritePrivateFileSync(path, content) {
+  ensurePrivateDirectorySync(dirname(path));
+  validateExistingFile(path);
+  const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
+  let fd;
+  try {
+    fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | NO_FOLLOW, 384);
+    writeFileSync(fd, content, "utf8");
+    if (isPosix()) fchmodSync(fd, 384);
+    closeSync(fd);
+    fd = void 0;
+    renameSync(temporary, path);
+    if (isPosix()) chmodSync(path, 384);
+  } catch (error) {
+    if (fd !== void 0) closeSync(fd);
+    try {
+      rmSync(temporary, { force: true });
+    } catch {
+    }
+    throw error;
+  }
+}
+
+// src/facade/mcp-core/oauth/token-store.ts
 function defaultCredentialsDir() {
   const xdg = process.env.XDG_CONFIG_HOME;
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
@@ -858,10 +946,11 @@ function credentialsPath(credentialsDir, id) {
 }
 function readMcpOAuthState(credentialsDir, id) {
   const path = credentialsPath(credentialsDir, id);
-  if (!existsSync(path)) return void 0;
   let raw;
   try {
-    raw = readFileSync(path, "utf8");
+    const stored = readPrivateFileSync(path);
+    if (stored === null) return void 0;
+    raw = stored;
   } catch (e) {
     return void 0;
   }
@@ -876,15 +965,8 @@ function readMcpOAuthState(credentialsDir, id) {
 }
 function writeMcpOAuthState(credentialsDir, state) {
   const path = credentialsPath(credentialsDir, state.id);
-  mkdirSync(dirname(path), { recursive: true });
-  const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
   const json = JSON.stringify({ ...state, updatedAt: Date.now() }, null, 2);
-  writeFileSync(tmp, json, { mode: 384 });
-  renameSync(tmp, path);
-  try {
-    chmodSync(path, 384);
-  } catch {
-  }
+  atomicWritePrivateFileSync(path, json);
 }
 function clearMcpOAuthState(credentialsDir, id) {
   const path = credentialsPath(credentialsDir, id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "indusagi",
-  "version": "0.13.10",
+  "version": "0.13.12",
   "description": "Indusagi — a terminal-first AI coding agent framework. Clean-room implementation.",
   "author": "Varun Israni",
   "license": "AGPL-3.0",
@@ -138,7 +138,7 @@
     "@types/react": "^18.3.30",
     "esbuild": "^0.28.0",
     "typescript": "^5.7.2",
-    "vitest": "^2.1.8"
+    "vitest": "^4.1.11"
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.100.1",
@@ -162,5 +162,10 @@
     "strip-ansi": "^7.2.0",
     "ulid": "^3.0.2",
     "zod": "^4.4.3"
+  },
+  "overrides": {
+    "fast-uri": "3.1.6",
+    "hono": "4.13.5",
+    "qs": "6.16.0"
   }
 }