Add Alibaba Cloud Model Studio Token Plan subscription service as two
built-in API-key providers: qwen-token-plan (international, Singapore)
and qwen-token-plan-cn (China, Beijing).
Each provider exposes 15 text-generation models (Qwen, DeepSeek, GLM,
Kimi, MiniMax) via the OpenAI-compatible endpoint with DashScope
enable_thinking support. Model metadata is sourced from models.dev;
qwen3.8-max-preview is hardcoded until models.dev includes it.
Also fixes kimi-coding test references (k2p7 -> kimi-for-coding) after
models.dev catalog update picked up by generate-models.
Closes#6850
- Use verification_uri_complete from the xAI device-code response so the
login link opens with the user code prefilled (https-validated)
- Add OAuthAuth.loginLabel and show "Sign in with SuperGrok or X Premium"
in the xAI auth-type selector (threaded through lazyOAuth)
- Remove grok-3, grok-3-fast, grok-4.20 variants and grok-code-fast-1
from the built-in xAI catalog and default to grok-4.5
Co-authored-by: Jaaneek <Jaaneek@users.noreply.github.com>
Move provider auth and OAuth flows onto pi-ai Models, compose models.json and extension overlays through ModelRuntime, and retain ModelRegistry as an extension compatibility facade.
Cloudflare Workers AI / AI Gateway resolved provider config from the
credential only, never consulting ambient env for a field the credential
omitted. The coding-agent /login flow stores just the API key, so
CLOUDFLARE_ACCOUNT_ID lives only in the environment; the key-only credential
short-circuited the env lookup, the account id stayed unresolved, and requests
hit the literal {CLOUDFLARE_ACCOUNT_ID} base URL -> 404.
resolveValue now merges per field: prefer the credential value, fall back to
ctx.env(name).
closes#6021
Signed-off-by: Mark Phelps <209477+markphelps@users.noreply.github.com>
Co-authored-by: Mario Zechner <badlogicgames@gmail.com>
Do not treat Pi’s internal ambient-auth marker as a Bedrock bearer token. This preserves SigV4 signing for AWS profiles, IAM credentials, and roles while retaining bearer authentication for real Bedrock API keys.\n\nFixes #6531
This adds cache-friendly dynamic tool loading anchored to tool results. Purely additive active-tool changes are recorded with `addedToolNames`, allowing supported Anthropic and OpenAI Responses models to load tool definitions at the point they become available instead of placing them in the cached prompt prefix.
It retains safe fallback behavior for unsupported models and non-additive changes but it will wipe caches.
Use the new provider-specific Xiaomi Token Plan catalogs from models.dev instead of cloning the API-billing Xiaomi catalog into every token-plan region. This removes API-billing-only models such as mimo-v2-omni from xiaomi-token-plan-{cn,ams,sgp}.
OpenAI Completions and Responses providers unconditionally replaced empty
tool result text with "(see attached image)", even when the result had no
image content. This caused the model to hallucinate image attachments for
commands that produce no output (e.g. curl -s with SSL errors, grep with
no matches, true/false).
Now matches the Google provider behavior: "(see attached image)" is only
used when images are actually present; empty results get "(no tool output)".
Co-authored-by: tzwm <tzwm@users.noreply.github.com>
Co-authored-by: Mario Zechner <badlogicgames@gmail.com>
The Message types require content to always be present, but untyped JS
extension tools, hand-built histories, and old or hand-edited session
files can violate that contract, crashing rendering, compaction, and
provider request conversion with 'content is not iterable'.
Normalize null/missing content to an empty array at the ingestion
boundaries instead of guarding every consumer:
- transformMessages (choke point before every provider request)
- createToolResultMessage in the agent loop
- session entry loading (message and custom_message entries)
- extension custom messages (sendCustomMessage, before_agent_start)
- message_end extension replacements
fixes#6259, fixes#6276
GitHub's device flow documents slow_down as a rate limit: a poll that
arrives inside the throttle window is answered with slow_down instead of
the token, and the response's interval field reports the new required
minimum ("adds 5 seconds to the last interval"). A client that only
tracks its own +5s increment can stay behind the server's ratcheting
requirement when its timers fire early - common with WSL/VM clock drift
(microsoft/WSL#10006) - so every subsequent poll keeps hitting the rate
limit and login appears to hang forever even after the browser reports
the device as authorized.
Adopt the server-provided interval when a slow_down poll result carries
one, falling back to the RFC 8628 section 3.5 +5s increment otherwise.
GitHub Copilot passes the interval field through.
This restores part of the #1994 mitigations that were lost in the #4788
device-code refactor.
refs #6187
QuintinShaw