runbios-mcp 0.2.14-dev.245 → 0.2.14-dev.247

package/README.md

@@ -43,18 +43,26 @@ For interactive JWT authentication, omit `RUNBIOS_API_KEY` and set
 `RUNBIOS_ACCESS_TOKEN`. The server never guesses credential type from a prefix:
 API keys use `X-API-Key`, while access tokens use `Authorization: Bearer`.
 
-Local `chat_with_inference` accepts `RUNBIOS_INFERENCE_KEY` for a dedicated
-endpoint, or a workspace platform key (`RUNBIOS_API_KEY`) whose scopes allow
-serverless or dedicated invocation through the unified `/v1` gateway. Credentials
-are never tool arguments or model-visible results. Set
-`RUNBIOS_INFERENCE_BASE_URL=https://api-dev.runbios.ai` explicitly for dev.
-The tool validates function schemas and matching tool response messages,
-propagates MCP cancellation, and makes one OpenAI-compatible request; with
-`stream=true` it consumes the SSE stream and returns the aggregated completion.
-It never retries a dispatched inference POST automatically.
-`RUNBIOS_INFERENCE_TIMEOUT_MS` defaults to `900000` (15 minutes). Its
-idempotency header is propagated, but replay/dedup is not claimed without an
-explicit acknowledgement from the endpoint.
+The inference tools use `RUNBIOS_INFERENCE_KEY` for a dedicated deployment, or
+a workspace `RUNBIOS_API_KEY` whose scopes allow serverless or dedicated
+invocation through the unified `/v1` gateway;
+no serving credential is accepted as a tool argument or returned in
+model-visible text. `chat_with_inference` and `message_with_inference` work on
+models that serve the respective OpenAI-chat or Anthropic-Messages dialect.
+`complete_with_inference`, `embed_with_inference`, and
+`rerank_with_inference` require a dedicated deployment that advertises the
+matching task: the serverless pool has **no** completions/embeddings/rerank
+routes. Choose by the server's declared model task, not a guess from the name.
+
+Set `RUNBIOS_INFERENCE_BASE_URL=https://api-dev.runbios.ai` explicitly in dev.
+The chat tool validates function schemas and matching tool responses. Chat
+streaming assembles deltas; completions and Messages streaming preserve ordered
+SSE events in one MCP result (up to 2 MB/4096 events; use an SDK for longer
+streams). MCP cancellation propagates to HTTP, an error or response echoing the
+configured key is suppressed, and a dispatched inference POST is never retried
+automatically. `RUNBIOS_INFERENCE_TIMEOUT_MS` defaults to `900000` (15 minutes).
+Caller-provided idempotency headers are forwarded without promising server-side
+replay/deduplication.
 
 ## Workspace serverless observability
 
@@ -285,6 +293,16 @@ tokens are intentionally excluded from MCP tool inputs and no integration is
 needed for models; Hugging Face integrations remain for dataset imports via
 `import_huggingface_dataset`.
 
+`list_inference_models` is a different read: it uses `/v1/models` and the
+connection's selected inference credential to list the serverless pool and
+workspace deployments it can actually invoke. `get_inference_model` retrieves
+one exact id through the same scope and workspace boundary, including
+`author/name` model ids. A partially readable list names
+`usf_unreachable_sources`; never infer an unreadable source has no models.
+The registry's `list_models` / `search_models` tools remain the source for
+trainable/deployable base models, not the invocable roster. Neither new tool
+accepts a credential argument or emits credential fields in its result.
+
 `create_training_job` and `resume_training_job` accept an optional
 `idempotency_key`. Reuse the same value after a timeout so the API replays the
 original acknowledgement instead of creating another job, wallet hold, queue
@@ -393,6 +411,10 @@ deployed, not a roadmap item:
   to the model. `upload_dataset` remains unavailable on hosted MCP because the
   hosted process cannot read a file from the client's machine; use the console
   for local uploads.
+- `complete_with_inference`, `embed_with_inference`, `rerank_with_inference`
+  and `message_with_inference` are withheld from hosted `tools/list` until
+  OAuth-bound routes for those tasks are implemented and tested; stdio may
+  use the configured inference credential now.
 
 Any documentation still describing the hosted connector as "planned" is stale.
 

package/dist/api-client.d.ts

@@ -60,8 +60,8 @@ export interface BiosClientOptions {
     /** Authorization header value for inference calls (may be empty). */
     inferenceAuthHeader?: string;
     /**
-     * Fallback Authorization header for /v1/chat/completions when no dedicated
-     * deployment key (inferenceAuthHeader) is set. A workspace platform key with
+     * Fallback Authorization header for serverless /v1/chat/completions and
+     * /v1/messages when no dedicated deployment key is set. A platform key with
      * serverless scope authenticates model-ID-routed serverless catalog calls;
      * the unified /v1 gateway routes by the request's `model`. Dedicated
      * deployment keys still take precedence when present.
@@ -72,6 +72,7 @@ export interface BiosClientOptions {
     /** User-Agent header; defaults to "bios-mcp/<VERSION>". */
     userAgent?: string;
 }
+type InferenceVerbPath = "/v1/chat/completions" | "/v1/completions" | "/v1/embeddings" | "/v1/rerank" | "/v1/messages";
 type ServerlessReadPath = "/api/serverless/limits" | "/api/serverless/usage/overview" | "/api/serverless/usage/by-model" | "/api/serverless/usage/requests" | "/api/serverless/usage/timeseries" | "/api/serverless/usage/daily" | "/api/serverless/usage/savings";
 type ServerlessReadShape = "limits" | "overview" | "rows" | "timeseries" | "daily" | "savings";
 /**
@@ -119,6 +120,9 @@ export declare class BiosClient {
      * The caller never chooses an account and no credential value is exposed.
      */
     resolvedWorkspaceId(): Promise<string>;
+    private inferenceModelRead;
+    inferenceModels(): Promise<unknown>;
+    inferenceModel(modelId: string): Promise<unknown>;
     serverlessRead(path: ServerlessReadPath, shape: ServerlessReadShape, params?: Record<string, string | undefined>): Promise<unknown>;
     /**
      * Tri-state probe against the public model registry (model-service):
@@ -130,13 +134,16 @@ export declare class BiosClient {
     modelRegistryStatus(modelId: string): Promise<"hosted" | "not_hosted" | "unknown">;
     api<T = unknown>(path: string, opts?: ApiOpts): Promise<T>;
     /**
-     * Select the Authorization header for /v1/chat/completions. A dedicated
-     * deployment key (inferenceAuthHeader) wins when present; otherwise a
+     * Select the Authorization header for the unified /v1 inference verbs. A
+     * dedicated deployment key (inferenceAuthHeader) wins when present; otherwise a
      * serverless-scoped platform key (serverlessAuthHeader) or a hosted OAuth
      * grant authenticates model-ID-routed calls on the unified endpoint.
      */
     private resolveInferenceAuth;
-    inferenceApi(body: Record<string, unknown>, idempotencyKey?: string, requestId?: string, callerSignal?: AbortSignal): Promise<unknown>;
+    private configuredInferenceKeys;
+    private redactInferenceError;
+    private containsInferenceCredential;
+    inferenceApi(body: Record<string, unknown>, idempotencyKey?: string, requestId?: string, callerSignal?: AbortSignal, path?: InferenceVerbPath, anthropicVersion?: string): Promise<unknown>;
     /**
      * POST a streaming /v1/chat/completions request, consume the SSE, and
      * aggregate the deltas into ONE OpenAI-shaped completion. Content and
@@ -148,6 +155,7 @@ export declare class BiosClient {
      * assembled message.
      */
     streamInferenceApi(body: Record<string, unknown>, idempotencyKey?: string, requestId?: string, callerSignal?: AbortSignal): Promise<unknown>;
+    private streamTaskInferenceApi;
 }
 /**
  * Parse the OpenAI chat-completion SSE from `stream` and fold its deltas into a
@@ -156,5 +164,9 @@ export declare class BiosClient {
  * finish_reason, role, id, model, and the final usage row are captured.
  */
 export declare function aggregateChatStream(stream: ReadableStream<Uint8Array>): Promise<Record<string, unknown>>;
+export declare function collectInferenceEvents(stream: ReadableStream<Uint8Array>, containsCredential?: (content: string) => boolean, termination?: "openai" | "anthropic"): Promise<{
+    object: string;
+    events: Array<Record<string, unknown>>;
+}>;
 export {};
 //# sourceMappingURL=api-client.d.ts.map

package/dist/api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,gCAAgC,6BAA6B,CAAC;AAE3E;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,yGAKtB,CAAC;AAeX,uDAAuD;AACvD,wBAAgB,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAIzD;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAaT;AAID,MAAM,WAAW,OAAO;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IAIf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,KAAK,kBAAkB,GAAG,wBAAwB,GAAG,gCAAgC,GAAG,gCAAgC,GAAG,gCAAgC,GAAG,kCAAkC,GAAG,6BAA6B,GAAG,+BAA+B,CAAC;AACnQ,KAAK,mBAAmB,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAkM/F;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAajF;AAgHD,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyB;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAO7B,OAAO,CAAC,uBAAuB,CAAC,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,IAAI,EAAE,iBAAiB;IAYnC;;;;;;OAMG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAYtC,cAAc,CAClB,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,mBAAmB,EAC1B,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAM,GAC9C,OAAO,CAAC,OAAO,CAAC;IAwEnB;;;;;;OAMG;IACG,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAC;IA0BlF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,OAAY,GAAG,OAAO,CAAC,CAAC,CAAC;IAiIpE;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAYtB,YAAY,CAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,cAAc,CAAC,EAAE,MAAM,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,WAAW,GACzB,OAAO,CAAC,OAAO,CAAC;IAiEnB;;;;;;;;;OASG;IACG,kBAAkB,CACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,cAAc,CAAC,EAAE,MAAM,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,WAAW,GACzB,OAAO,CAAC,OAAO,CAAC;CAyCpB;AAUD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA6F9G"}
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,gCAAgC,6BAA6B,CAAC;AAE3E;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,yGAKtB,CAAC;AAeX,uDAAuD;AACvD,wBAAgB,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAIzD;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAaT;AAID,MAAM,WAAW,OAAO;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IAIf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,KAAK,iBAAiB,GAAG,sBAAsB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,YAAY,GAAG,cAAc,CAAC;AACvH,KAAK,kBAAkB,GAAG,wBAAwB,GAAG,gCAAgC,GAAG,gCAAgC,GAAG,gCAAgC,GAAG,kCAAkC,GAAG,6BAA6B,GAAG,+BAA+B,CAAC;AACnQ,KAAK,mBAAmB,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAkM/F;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAajF;AAgHD,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyB;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAO7B,OAAO,CAAC,uBAAuB,CAAC,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,IAAI,EAAE,iBAAiB;IAYnC;;;;;;OAMG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;YAY9B,kBAAkB;IAsD1B,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAWnC,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWjD,cAAc,CAClB,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,mBAAmB,EAC1B,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAM,GAC9C,OAAO,CAAC,OAAO,CAAC;IAwEnB;;;;;;OAMG;IACG,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAC;IA0BlF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,OAAY,GAAG,OAAO,CAAC,CAAC,CAAC;IAiIpE;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,uBAAuB;IAM/B,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,2BAA2B;IAI7B,YAAY,CAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,cAAc,CAAC,EAAE,MAAM,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,WAAW,EAC1B,IAAI,GAAE,iBAA0C,EAChD,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,OAAO,CAAC;IAsEnB;;;;;;;;;OASG;IACG,kBAAkB,CACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,cAAc,CAAC,EAAE,MAAM,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,WAAW,GACzB,OAAO,CAAC,OAAO,CAAC;YAiDL,sBAAsB;CAoDrC;AAUD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAmG9G;AAgBD,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,EAClC,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,EACjD,WAAW,GAAE,QAAQ,GAAG,WAAsB,GAC7C,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC,CA6DrE"}

package/dist/api-client.js

@@ -450,6 +450,87 @@ export class BiosClient {
         this.introspectedWorkspaceId = id.trim();
         return this.introspectedWorkspaceId;
     }
+    async inferenceModelRead(path) {
+        const platformKey = this.authHeaders["X-API-Key"];
+        const auth = this.inferenceAuthHeader || this.serverlessAuthHeader || this.authHeaders.Authorization
+            || (platformKey ? `Bearer ${platformKey}` : "");
+        const headers = { "User-Agent": this.userAgent, Accept: "application/json" };
+        if (auth)
+            headers.Authorization = auth;
+        if (this.workspaceId)
+            headers["X-Workspace-ID"] = this.workspaceId;
+        if (this.orgId)
+            headers["X-Org-ID"] = this.orgId;
+        let response;
+        try {
+            response = await fetch(`${this.inferenceBaseUrl}${path}`, { method: "GET", headers });
+        }
+        catch {
+            throw new Error(JSON.stringify({
+                code: "MODELS_UNAVAILABLE", message: "Inference model discovery could not reach the API.",
+                instruction: "Retry shortly; do not treat this as an empty model roster.",
+            }));
+        }
+        const text = await response.text();
+        if (response.ok) {
+            for (const raw of [this.inferenceAuthHeader, this.serverlessAuthHeader, this.authHeaders.Authorization, platformKey]) {
+                const credential = raw?.replace(/^Bearer\s+/i, "").trim();
+                if (credential && credential.length >= 12 && text.includes(credential)) {
+                    throw new Error(JSON.stringify({
+                        code: "MODEL_RESPONSE_SUPPRESSED",
+                        message: "The model catalog response contained authentication material and was withheld.",
+                        instruction: "Contact support; do not quote or reuse this response.",
+                    }));
+                }
+            }
+        }
+        if (!response.ok) {
+            let code = `HTTP_${response.status}`;
+            try {
+                const parsed = JSON.parse(text);
+                const candidate = parsed.error?.code ?? parsed.code;
+                if (typeof candidate === "string" && /^[A-Za-z_][A-Za-z0-9_-]{0,63}$/.test(candidate))
+                    code = candidate;
+            }
+            catch { }
+            throw new Error(JSON.stringify({
+                code, status: response.status, message: "Inference model discovery failed.",
+                instruction: response.status === 404 && path.startsWith("/v1/models/")
+                    ? "Call list_inference_models for ids this credential can invoke in its bound workspace; do not guess another workspace's id."
+                    : statusGuidance(response.status),
+            }));
+        }
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            throw new Error(JSON.stringify({
+                code: "INVALID_MODELS_RESPONSE", message: "Inference model discovery returned invalid JSON.",
+                instruction: "Retry shortly; do not treat this as an empty model roster.",
+            }));
+        }
+    }
+    async inferenceModels() {
+        const response = await this.inferenceModelRead("/v1/models");
+        const roster = response && typeof response === "object" ? response : null;
+        const rows = roster?.data;
+        if (roster?.object !== "list" || !Array.isArray(rows) ||
+            !rows.every(row => row && typeof row.id === "string" && row.id.trim())) {
+            throw new Error(JSON.stringify({ code: "INVALID_MODELS_RESPONSE", message: "The inference model roster had no usable data array.", instruction: "Retry shortly; an unavailable source is not an empty roster." }));
+        }
+        return response;
+    }
+    async inferenceModel(modelId) {
+        const id = typeof modelId === "string" ? modelId.trim() : "";
+        if (!id)
+            throw new Error("A model id is required; list_inference_models gives the ids this credential can invoke.");
+        const response = await this.inferenceModelRead(`/v1/models/${encodeURIComponent(id)}`);
+        if (!response || typeof response !== "object" || response.object !== "model" ||
+            typeof response.id !== "string") {
+            throw new Error(JSON.stringify({ code: "INVALID_MODEL_RESPONSE", message: "Inference model retrieval returned no model id.", instruction: "Retry or list the models this credential can invoke." }));
+        }
+        return response;
+    }
     async serverlessRead(path, shape, params = {}) {
         const credentials = [this.authHeaders["X-API-Key"], this.authHeaders.Authorization, this.inferenceAuthHeader, this.serverlessAuthHeader]
             .map(raw => raw?.replace(/^Bearer\s+/i, "").trim() ?? "")
@@ -688,8 +769,8 @@ export class BiosClient {
         return (parsed ?? {});
     }
     /**
-     * Select the Authorization header for /v1/chat/completions. A dedicated
-     * deployment key (inferenceAuthHeader) wins when present; otherwise a
+     * Select the Authorization header for the unified /v1 inference verbs. A
+     * dedicated deployment key (inferenceAuthHeader) wins when present; otherwise a
      * serverless-scoped platform key (serverlessAuthHeader) or a hosted OAuth
      * grant authenticates model-ID-routed calls on the unified endpoint.
      */
@@ -697,16 +778,28 @@ export class BiosClient {
         const oauth = this.authHeaders.Authorization?.startsWith("Bearer mcp_at_") ? this.authHeaders.Authorization : "";
         const auth = this.inferenceAuthHeader || this.serverlessAuthHeader || oauth;
         if (!auth) {
-            throw new Error("chat_with_inference requires a key: set RUNBIOS_INFERENCE_KEY for a dedicated deployment, "
-                + "or provide a workspace platform key (RUNBIOS_API_KEY with serverless scope) to call catalog models by id");
+            throw new Error("An inference credential is required: set RUNBIOS_INFERENCE_KEY for a dedicated deployment, "
+                + "or provide a workspace platform key (RUNBIOS_API_KEY with serverless scope) to call compatible catalog models by id");
         }
         return auth;
     }
-    async inferenceApi(body, idempotencyKey, requestId, callerSignal) {
-        // Route streaming requests through the SSE aggregator so reasoning +
-        // content deltas surface exactly as produced, collapsed to one result.
+    configuredInferenceKeys() {
+        return [this.inferenceAuthHeader, this.serverlessAuthHeader, this.authHeaders.Authorization, this.authHeaders["X-API-Key"]]
+            .map(raw => raw?.replace(/^Bearer\s+/i, "").trim() ?? "")
+            .filter(key => key.length >= 12);
+    }
+    redactInferenceError(message) {
+        return this.configuredInferenceKeys().reduce((text, key) => text.replaceAll(key, "[redacted]"), redactBuildIdentity(message));
+    }
+    containsInferenceCredential(content) {
+        return this.configuredInferenceKeys().some(key => content.includes(key));
+    }
+    async inferenceApi(body, idempotencyKey, requestId, callerSignal, path = "/v1/chat/completions", anthropicVersion) {
+        // Aggregate chat deltas; preserve other task-specific SSE events intact.
         if (body.stream === true) {
-            return this.streamInferenceApi(body, idempotencyKey, requestId, callerSignal);
+            return path === "/v1/chat/completions"
+                ? this.streamInferenceApi(body, idempotencyKey, requestId, callerSignal)
+                : this.streamTaskInferenceApi(path, body, idempotencyKey, requestId, callerSignal, anthropicVersion);
         }
         const headers = {
             Authorization: this.resolveInferenceAuth(),
@@ -717,6 +810,8 @@ export class BiosClient {
         };
         if (idempotencyKey)
             headers["Idempotency-Key"] = idempotencyKey;
+        if (path === "/v1/messages")
+            headers["Anthropic-Version"] = anthropicVersion || "2023-06-01";
         // Inference POSTs are intentionally dispatched once. An MCP caller that
         // retries can reuse idempotency_key; this client never replays implicitly.
         const controller = new AbortController();
@@ -729,7 +824,7 @@ export class BiosClient {
         let response;
         let text;
         try {
-            response = await fetch(`${this.inferenceBaseUrl}/v1/chat/completions`, {
+            response = await fetch(`${this.inferenceBaseUrl}${path}`, {
                 method: "POST",
                 headers,
                 body: JSON.stringify(body),
@@ -746,14 +841,17 @@ export class BiosClient {
             // MCP client sees them as the tool error.
             try {
                 const parsed = JSON.parse(text);
-                throw new Error(redactBuildIdentity(parsed?.error?.message || parsed?.message || `Inference API error ${response.status}`));
+                throw new Error(this.redactInferenceError(parsed?.error?.message || parsed?.message || `Inference API error ${response.status}`));
             }
             catch (error) {
                 if (error instanceof SyntaxError)
-                    throw new Error(redactBuildIdentity(text || `Inference API error ${response.status}`));
+                    throw new Error(this.redactInferenceError(text || `Inference API error ${response.status}`));
                 throw error;
             }
         }
+        if (this.containsInferenceCredential(text)) {
+            throw new Error("Inference result contained authentication material and was withheld.");
+        }
         let parsed;
         try {
             parsed = JSON.parse(text);
@@ -806,17 +904,76 @@ export class BiosClient {
                 const text = await response.text().catch(() => "");
                 try {
                     const parsed = JSON.parse(text);
-                    throw new Error(redactBuildIdentity(parsed?.error?.message || parsed?.message || `Inference API error ${response.status}`));
+                    throw new Error(this.redactInferenceError(parsed?.error?.message || parsed?.message || `Inference API error ${response.status}`));
                 }
                 catch (error) {
                     if (error instanceof SyntaxError)
-                        throw new Error(redactBuildIdentity(text || `Inference API error ${response.status}`));
+                        throw new Error(this.redactInferenceError(text || `Inference API error ${response.status}`));
                     throw error;
                 }
             }
             if (!response.body)
                 throw new Error("Inference stream returned no body");
-            return await aggregateChatStream(response.body);
+            const result = await aggregateChatStream(response.body);
+            if (this.containsInferenceCredential(JSON.stringify(result))) {
+                throw new Error("Inference result contained authentication material and was withheld.");
+            }
+            return result;
+        }
+        catch (error) {
+            if (error instanceof Error)
+                throw new Error(this.redactInferenceError(error.message));
+            throw error;
+        }
+        finally {
+            clearTimeout(timeout);
+            callerSignal?.removeEventListener("abort", relayAbort);
+        }
+    }
+    async streamTaskInferenceApi(path, body, idempotencyKey, requestId, callerSignal, anthropicVersion) {
+        const headers = {
+            Authorization: this.resolveInferenceAuth(),
+            Accept: "text/event-stream",
+            "Content-Type": "application/json",
+            "X-Request-ID": requestId || randomUUID(),
+            "User-Agent": this.userAgent,
+        };
+        if (idempotencyKey)
+            headers["Idempotency-Key"] = idempotencyKey;
+        if (path === "/v1/messages")
+            headers["Anthropic-Version"] = anthropicVersion || "2023-06-01";
+        const controller = new AbortController();
+        const relayAbort = () => controller.abort(callerSignal?.reason);
+        if (callerSignal?.aborted)
+            relayAbort();
+        else
+            callerSignal?.addEventListener("abort", relayAbort, { once: true });
+        const timeout = setTimeout(() => controller.abort(new Error(`Inference timed out after ${this.inferenceTimeoutMs}ms`)), this.inferenceTimeoutMs);
+        try {
+            const response = await fetch(`${this.inferenceBaseUrl}${path}`, {
+                method: "POST", headers, body: JSON.stringify(body), signal: controller.signal,
+            });
+            if (!response.ok) {
+                const text = await response.text().catch(() => "");
+                let message = text || `Inference API error ${response.status}`;
+                try {
+                    const parsed = JSON.parse(text);
+                    message = parsed?.error?.message || parsed?.message || message;
+                }
+                catch { }
+                throw new Error(this.redactInferenceError(message));
+            }
+            if (!response.headers.get("content-type")?.toLowerCase().includes("text/event-stream")) {
+                throw new Error("Inference endpoint did not return an event stream");
+            }
+            if (!response.body)
+                throw new Error("Inference stream returned no body");
+            return await collectInferenceEvents(response.body, data => this.containsInferenceCredential(data), path === "/v1/messages" ? "anthropic" : "openai");
+        }
+        catch (error) {
+            if (error instanceof Error)
+                throw new Error(this.redactInferenceError(error.message));
+            throw error;
         }
         finally {
             clearTimeout(timeout);
@@ -842,10 +999,15 @@ export async function aggregateChatStream(stream) {
     let model;
     let created;
     let usage;
+    let completed = false;
     const toolCalls = [];
     const consume = (payload) => {
         const data = payload.trim();
-        if (!data || data === "[DONE]")
+        if (data === "[DONE]") {
+            completed = true;
+            return;
+        }
+        if (!data)
             return;
         let event;
         try {
@@ -897,7 +1059,7 @@ export async function aggregateChatStream(stream) {
         }
     };
     try {
-        for (;;) {
+        while (!completed) {
             const { done, value } = await reader.read();
             if (done)
                 break;
@@ -909,16 +1071,22 @@ export async function aggregateChatStream(stream) {
                 const frame = buffer.slice(0, match.index);
                 buffer = buffer.slice(match.index + match[0].length);
                 emitFrame(frame, consume);
+                if (completed)
+                    break;
             }
         }
-        buffer += decoder.decode();
-        if (buffer.trim())
-            emitFrame(buffer, consume);
+        if (!completed) {
+            buffer += decoder.decode();
+            if (buffer.trim())
+                emitFrame(buffer, consume);
+        }
     }
     finally {
         await reader.cancel().catch(() => undefined);
         reader.releaseLock();
     }
+    if (!completed)
+        throw new Error("Inference stream ended before completion marker [DONE]; no finished result was returned.");
     const message = { role, content: content || null };
     if (reasoning)
         message.reasoning_content = reasoning;
@@ -959,4 +1127,83 @@ function emitFrame(frame, consume) {
     if (data.length > 0)
         consume(data.join("\n"));
 }
+export async function collectInferenceEvents(stream, containsCredential, termination = "openai") {
+    const reader = stream.getReader();
+    const decoder = new TextDecoder();
+    const events = [];
+    let buffer = "";
+    let size = 0;
+    let completed = false;
+    const consume = (payload) => {
+        const data = payload.trim();
+        if (data === "[DONE]") {
+            if (termination === "anthropic")
+                throw new Error("Anthropic stream ended without message_stop");
+            completed = true;
+            return;
+        }
+        if (!data)
+            return;
+        if (containsCredential?.(data))
+            throw new Error("Inference result contained authentication material and was withheld.");
+        if (size + data.length > 2_000_000 || events.length >= 4096) {
+            throw new Error("Inference stream exceeded the MCP result limit; reduce max_tokens and retry explicitly.");
+        }
+        let event;
+        try {
+            event = JSON.parse(data);
+        }
+        catch {
+            throw new Error("Inference stream returned invalid JSON");
+        }
+        if (!event || typeof event !== "object" || Array.isArray(event)) {
+            throw new Error("Inference stream returned an invalid event");
+        }
+        const record = event;
+        if (record.error) {
+            const err = record.error;
+            const candidate = err && typeof err === "object" ? err.code : undefined;
+            const code = typeof candidate === "string" && /^[A-Za-z_][A-Za-z0-9_-]{0,63}$/.test(candidate) ? candidate : "stream_error";
+            throw new Error(`Inference stream failed (${code}); no completed result was returned.`);
+        }
+        events.push(record);
+        size += data.length;
+        if (termination === "anthropic" && record.type === "message_stop")
+            completed = true;
+    };
+    try {
+        while (!completed) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            buffer += decoder.decode(value, { stream: true });
+            if (buffer.length > 2_000_000)
+                throw new Error("Inference stream exceeded the MCP result limit; reduce max_tokens.");
+            for (;;) {
+                const match = /\r\n\r\n|\n\n|\r\r/.exec(buffer);
+                if (!match || match.index === undefined)
+                    break;
+                const frame = buffer.slice(0, match.index);
+                buffer = buffer.slice(match.index + match[0].length);
+                emitFrame(frame, consume);
+                if (completed)
+                    break;
+            }
+        }
+        if (!completed) {
+            buffer += decoder.decode();
+            if (buffer.trim())
+                emitFrame(buffer, consume);
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+        reader.releaseLock();
+    }
+    if (events.length === 0)
+        throw new Error("Inference stream finished without a result");
+    if (!completed)
+        throw new Error("Inference stream ended before completion; no finished result was returned.");
+    return { object: "inference.event_stream", events };
+}
 //# sourceMappingURL=api-client.js.map