feat(friendli): add reasoning params support

.changeset/fix-anthropic-custom-model-id-fallback.md

@@ -0,0 +1,11 @@
+---
+"zoo-code": patch
+---
+
+Fix Anthropic provider silently replacing a custom/unrecognized `apiModelId` with the hardcoded default model.
+
+`AnthropicHandler.getModel()` coerced any `apiModelId` not present in the static `anthropicModels` table down to `anthropicDefaultModelId` ("claude-sonnet-4-5"), and that coerced id was what actually got sent as `model` in the API request -- silently ignoring a user-configured custom model name (e.g. a custom Anthropic-compatible deployment or proxy). This produced confusing "model does not exist" errors for the default model instead of the model the user actually selected (#418).
+
+The same fallback also affected capability lookups used to build the `thinking` request parameter: an unrecognized id fell back to the default model's info, which can be from an older model generation with a different API contract, causing the request to use the legacy `thinking: {type: "enabled", budget_tokens}` shape and get rejected with a 400 by models that require `{type: "adaptive"}`.
+
+The model id sent to the API now always honors a user-configured `apiModelId`. For unrecognized values, capabilities are best-effort guessed by matching known model-family substrings (mirroring the existing `BedrockHandler.guessModelInfoFromId` heuristic) instead of defaulting to `anthropicDefaultModelId`'s info.

.changeset/fix-litellm-model-desync.md

@@ -0,0 +1,28 @@
+---
+"zoo-code": patch
+---
+
+Fix LiteLLM provider cache key collision, credential priority, and model-selection fallback to non-existent default.
+
+Two bugs are addressed:
+
+1. **Cache key collision**: All URL-scoped providers (LiteLLM, Ollama, LM Studio, Poe, DeepSeek,
+   Requesty) previously shared one cache entry keyed only on the provider name. Switching between
+   profiles backed by different servers silently served the wrong model list and the stale list
+   persisted across VS Code restarts via the disk cache. Fixed with a compound cache key:
+   URL-scoped providers use `provider:baseUrl`; key-scoped providers (LiteLLM, Poe, Requesty)
+   additionally include a short, irreversible discriminator derived from the API key
+   (`provider:baseUrl:<discriminator>`) so that two different API keys on the same server never share
+   a cache entry (relevant when the server enforces per-key model allowlists). Both the discriminator
+   and the on-disk filename digest are derived via truncated PBKDF2 so neither can be reversed to
+   identify the API key written to the cache filename. The `RouterProvider.getModel()` cold-start
+   fallback is also corrected to pass the full options so it resolves the same compound key.
+
+2. **Silent fallback to hardcoded default**: When the LiteLLM model list was empty (due to the
+   collision above, a failed sync, or a transient error), `useSelectedModel` reset the configured
+   model ID to `claude-3-7-sonnet-20250219` -- a model that typically does not exist on user
+   LiteLLM servers. Four sub-fixes: preserve the configured model ID when the list is empty;
+   invalidate the React Query router-models cache after a successful "Sync Models" click; pass the
+   current LiteLLM credentials in the debounced `requestRouterModels` message; and correct the
+   credential priority in `webviewMessageHandler.ts` so that message values (current unsaved field
+   state) take precedence over stale saved config, matching the pattern already used for DeepSeek.

.github/workflows/cli-release.yml

@@ -13,6 +13,11 @@ on:
         type: boolean
         default: false
 
+# Least privilege: the release job escalates to contents: write via its own
+# job-level permissions block.
+permissions:
+  contents: read
+
 jobs:
   # Build CLI for each platform.
   build:

.github/workflows/code-qa.yml

@@ -9,7 +9,56 @@ on:
     merge_group:
         types: [checks_requested]
 
+# Least privilege: every job below escalates only where it needs to.
+permissions:
+    contents: read
+
 jobs:
+    dependency-review:
+        runs-on: ubuntu-latest
+        # Only meaningful for PRs — validates the dependency diff of the pull
+        # request against GitHub's advisory database before merge.
+        if: github.event_name == 'pull_request'
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              with:
+                  # This job never pushes — don't persist the GITHUB_TOKEN.
+                  persist-credentials: false
+            - name: Dependency review
+              uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+
+    invisible-chars:
+        runs-on: ubuntu-latest
+        # Reject invisible / homoglyph Unicode that GitHub's diff UI renders
+        # invisibly and most editors hide. These compile fine, which is the
+        # risk: identifier-splitting, string-literal injection, and the
+        # "Trojan Source" bidi-override attack (U+202A-U+202E). Scanning raw
+        # bytes catches them in strings, identifiers, and comments alike.
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              with:
+                  # This job never pushes — don't persist the GITHUB_TOKEN.
+                  persist-credentials: false
+            - name: Reject invisible / homoglyph Unicode
+              run: |
+                  # zero-width (U+200B-200F), word joiner (U+2060), BOM (U+FEFF),
+                  # bidi overrides (U+202A-202E), soft hyphen (U+00AD).
+                  # Covers source, release-adjacent executable scripts
+                  # (*.sh / *.cjs / *.cts / *.mts), and the executable shell
+                  # blocks inside GitHub workflow/action YAML.
+                  if grep -rnP '[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}\x{FEFF}\x{00AD}]' \
+                      --include='*.ts' --include='*.tsx' --include='*.js' --include='*.mjs' \
+                      --include='*.cjs' --include='*.cts' --include='*.mts' --include='*.sh' \
+                      --include='*.yml' --include='*.yaml' \
+                      --exclude-dir=node_modules --exclude-dir=dist --exclude-dir=out \
+                      --exclude-dir=coverage --exclude-dir=.turbo --exclude-dir=.vinxi \
+                      src webview-ui packages apps .github; then
+                      echo "::error::Found invisible or homoglyph Unicode characters (zero-width / bidi-override / BOM / soft hyphen)"
+                      exit 1
+                  fi
+
     check-translations:
         runs-on: ubuntu-latest
         steps:

.github/workflows/codeql.yml

@@ -7,6 +7,11 @@ on:
   schedule:
     - cron: '24 19 * * 3'
 
+# Least privilege: the analyze job escalates to security-events: write via its
+# own job-level permissions block.
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -47,7 +52,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3
+      uses: github/codeql-action/init@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -75,6 +80,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3
+      uses: github/codeql-action/analyze@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/e2e.yml

@@ -7,6 +7,9 @@ on:
     merge_group:
         types: [checks_requested]
 
+permissions:
+    contents: read
+
 jobs:
     e2e-mock:
         runs-on: ubuntu-latest