fix(cf): preserve thought_signature and fix token budget for Gemini thinking models

- Add `cf` provider (Cloudflare AI Gateway) to SupportedProviders and initialize
  AsyncOpenAI client pointed at CF_GATEWAY_BASE_URL
- Route OpenAI embeddings through CF Gateway when LLM_OPENAI_BASE_URL is set
- Convert tools to OpenAI format for `cf` provider (was missing from provider list)
- Extract thought_signature from OpenAI-compat tool call responses and re-include
  it when formatting assistant messages for multi-turn replay — fixes 400
  INVALID_ARGUMENT from Gemini thinking models via CF Gateway
- Preserve thought_signature in _format_assistant_tool_message else branch
- Increase DERIVER_MAX_INPUT_TOKENS upper bound (23000 → 200000) to allow
  higher limits via config

Author: offendingcommit

src/config.py

@@ -208,11 +208,19 @@ class LLMSettings(HonchoSettings):
     GEMINI_API_KEY: str | None = None
     GROQ_API_KEY: str | None = None
     OPENAI_COMPATIBLE_BASE_URL: str | None = None
+    OPENAI_BASE_URL: str | None = None  # Route OpenAI calls through a proxy/gateway
 
     # Separate vLLM endpoint (for local models)
     VLLM_API_KEY: str | None = None
     VLLM_BASE_URL: str | None = None
 
+    # Cloudflare AI Gateway (OpenAI-compatible universal endpoint)
+    # CF_GATEWAY_API_KEY = provider API key (e.g. Gemini key for google-ai-studio/ models)
+    # CF_GATEWAY_AUTH_TOKEN = cfut_ gateway token → sent in cf-aig-authorization header
+    CF_GATEWAY_API_KEY: str | None = None
+    CF_GATEWAY_BASE_URL: str | None = None
+    CF_GATEWAY_AUTH_TOKEN: str | None = None
+
     EMBEDDING_PROVIDER: Literal["openai", "gemini", "openrouter"] = "openai"
     EMBEDDING_MODEL: str | None = None
 
@@ -261,7 +269,7 @@ class DeriverSettings(BackupLLMSettingsMixin, HonchoSettings):
 
     LOG_OBSERVATIONS: bool = False
 
-    MAX_INPUT_TOKENS: Annotated[int, Field(default=23000, gt=0, le=23000)] = 23000
+    MAX_INPUT_TOKENS: Annotated[int, Field(default=23000, gt=0, le=200_000)] = 23000
 
     # Maximum number of observations to return in working representation
     # This is applied to both explicit and deductive observations

src/embedding_client.py

@@ -2,7 +2,7 @@
 import logging
 import threading
 from collections import defaultdict
-from typing import NamedTuple
+from typing import Any, NamedTuple
 
 import tiktoken
 from google import genai
@@ -60,7 +60,14 @@ def __init__(self, api_key: str | None = None, provider: str | None = None):
                 api_key = settings.LLM.OPENAI_API_KEY
             if not api_key:
                 raise ValueError("OpenAI API key is required")
-            self.client = AsyncOpenAI(api_key=api_key)
+            _emb_kwargs: dict[str, Any] = {"api_key": api_key}
+            if settings.LLM.OPENAI_BASE_URL:
+                _emb_kwargs["base_url"] = settings.LLM.OPENAI_BASE_URL
+                if settings.LLM.CF_GATEWAY_AUTH_TOKEN:
+                    _emb_kwargs["default_headers"] = {
+                        "cf-aig-authorization": f"Bearer {settings.LLM.CF_GATEWAY_AUTH_TOKEN}"
+                    }
+            self.client = AsyncOpenAI(**_emb_kwargs)
             self.model = "text-embedding-3-small"
             self.max_embedding_tokens = settings.MAX_EMBEDDING_TOKENS
             self.max_batch_size = 2048  # OpenAI batch limit

src/utils/clients.py

@@ -258,17 +258,36 @@ def _get_effective_temperature(temperature: float | None) -> float | None:
     CLIENTS["anthropic"] = anthropic
 
 if settings.LLM.OPENAI_API_KEY:
-    openai_client = AsyncOpenAI(
-        api_key=settings.LLM.OPENAI_API_KEY,
-    )
-    CLIENTS["openai"] = openai_client
+    _openai_kwargs: dict[str, Any] = {"api_key": settings.LLM.OPENAI_API_KEY}
+    if settings.LLM.OPENAI_BASE_URL:
+        _openai_kwargs["base_url"] = settings.LLM.OPENAI_BASE_URL
+        if settings.LLM.CF_GATEWAY_AUTH_TOKEN:
+            _openai_kwargs["default_headers"] = {
+                "cf-aig-authorization": f"Bearer {settings.LLM.CF_GATEWAY_AUTH_TOKEN}"
+            }
+    CLIENTS["openai"] = AsyncOpenAI(**_openai_kwargs)
 
 if settings.LLM.OPENAI_COMPATIBLE_API_KEY and settings.LLM.OPENAI_COMPATIBLE_BASE_URL:
     CLIENTS["custom"] = AsyncOpenAI(
         api_key=settings.LLM.OPENAI_COMPATIBLE_API_KEY,
         base_url=settings.LLM.OPENAI_COMPATIBLE_BASE_URL,
     )
 
+# Cloudflare AI Gateway (OpenAI-compatible universal endpoint)
+# CF_GATEWAY_API_KEY = provider key passed in Authorization (e.g. Gemini key for google-ai-studio/)
+# CF_GATEWAY_AUTH_TOKEN = cfut_ gateway token passed in cf-aig-authorization (optional, for gateway auth)
+if settings.LLM.CF_GATEWAY_API_KEY and settings.LLM.CF_GATEWAY_BASE_URL:
+    _cf_extra_headers: dict[str, str] = {}
+    if settings.LLM.CF_GATEWAY_AUTH_TOKEN:
+        _cf_extra_headers["cf-aig-authorization"] = (
+            f"Bearer {settings.LLM.CF_GATEWAY_AUTH_TOKEN}"
+        )
+    CLIENTS["cf"] = AsyncOpenAI(
+        api_key=settings.LLM.CF_GATEWAY_API_KEY,
+        base_url=settings.LLM.CF_GATEWAY_BASE_URL,
+        default_headers=_cf_extra_headers,
+    )
+
 # vLLM uses separate settings for local model serving
 if settings.LLM.VLLM_API_KEY and settings.LLM.VLLM_BASE_URL:
     CLIENTS["vllm"] = AsyncOpenAI(
@@ -334,9 +353,9 @@ def convert_tools_for_provider(
     if provider == "anthropic":
         # Anthropic format: input_schema
         return tools
-    elif provider in ("openai", "custom", "vllm"):
+    elif provider in ("openai", "custom", "vllm", "cf"):
         # OpenAI format: parameters instead of input_schema
-        # custom and vllm use AsyncOpenAI client so need OpenAI format
+        # custom, vllm, and cf use AsyncOpenAI client so need OpenAI format
         return [
             {
                 "type": "function",
@@ -1103,16 +1122,20 @@ def _format_assistant_tool_message(
         # OpenAI format - must include tool_calls in the assistant message
         openai_tool_calls: list[Any] = []
         for tool_call in tool_calls:
-            openai_tool_calls.append(
-                {
-                    "id": tool_call["id"],
-                    "type": "function",
-                    "function": {
-                        "name": tool_call["name"],
-                        "arguments": json.dumps(tool_call["input"]),
-                    },
-                }
-            )
+            oa_call: dict[str, Any] = {
+                "id": tool_call["id"],
+                "type": "function",
+                "function": {
+                    "name": tool_call["name"],
+                    "arguments": json.dumps(tool_call["input"]),
+                },
+            }
+            # Preserve thought_signature for Gemini thinking models via CF Gateway.
+            # Required for multi-turn tool use — Gemini rejects requests where a
+            # function call in the history is missing its thought_signature.
+            if "thought_signature" in tool_call:
+                oa_call["thought_signature"] = tool_call["thought_signature"]
+            openai_tool_calls.append(oa_call)
         msg: dict[str, Any] = {
             "role": "assistant",
             "content": content if isinstance(content, str) else None,
@@ -2046,15 +2069,23 @@ async def honcho_llm_call_inner(
                 tool_calls_list: list[dict[str, Any]] = []
                 if response.choices[0].message.tool_calls:  # pyright: ignore
                     for tool_call in response.choices[0].message.tool_calls:  # pyright: ignore
-                        tool_calls_list.append(
-                            {
-                                "id": tool_call.id,  # pyright: ignore
-                                "name": tool_call.function.name,  # pyright: ignore
-                                "input": json.loads(tool_call.function.arguments)  # pyright: ignore
-                                if tool_call.function.arguments  # pyright: ignore
-                                else {},
-                            }
+                        call_data: dict[str, Any] = {
+                            "id": tool_call.id,  # pyright: ignore
+                            "name": tool_call.function.name,  # pyright: ignore
+                            "input": json.loads(tool_call.function.arguments)  # pyright: ignore
+                            if tool_call.function.arguments  # pyright: ignore
+                            else {},
+                        }
+                        # Preserve thought_signature for Gemini thinking models via CF
+                        # Gateway — required for multi-turn tool use replay.
+                        thought_sig = getattr(tool_call, "thought_signature", None) or (  # pyright: ignore
+                            tool_call.model_extra.get("thought_signature")  # pyright: ignore
+                            if getattr(tool_call, "model_extra", None)  # pyright: ignore
+                            else None
                         )
+                        if thought_sig:
+                            call_data["thought_signature"] = thought_sig
+                        tool_calls_list.append(call_data)
 
                 cache_creation, cache_read = extract_openai_cache_tokens(usage)
                 return HonchoLLMCallResponse(

src/utils/types.py

@@ -34,7 +34,7 @@ async def post_commit(self) -> None:
             await self.on_commit()
 
 
-SupportedProviders = Literal["anthropic", "openai", "google", "groq", "custom", "vllm"]
+SupportedProviders = Literal["anthropic", "openai", "google", "groq", "custom", "vllm", "cf"]
 TaskType = Literal[
     "webhook", "summary", "representation", "dream", "deletion", "reconciler"
 ]