chore(deps): bump github.com/masterkeysrd/loom from 0.0.5 to 0.0.6

[dependabot]

Bumps github.com/masterkeysrd/loom from 0.0.5 to 0.0.6.

Release notes

Sourced from github.com/masterkeysrd/loom's releases.

v0.0.6

Loom v0.0.6 Release Notes 🚀

Release v0.0.6 introduces the Google Antigravity Provider, new core capability interfaces (llm.QuotaProvider), automated server-side token counting (llm.TokenCounter), extensive new model profiles across Anthropic, OpenAI, and Google GenAI, automated Dependabot and CodeQL security analysis, and updated dependencies.

---

🌟 Highlights

1. Google Antigravity Provider (llm/antigravity)

Connect Loom agents directly to Google's internal Cloud Code / Antigravity LLM backend:

• Authentication: Zero-setup interactive OAuth 2.0 PKCE browser login with local callback loopback and automatic background token refresh persisted to ~/.config/loom/antigravity_token.json. Also supports ANTIGRAVITY_TOKEN and GOOGLE_ACCESS_TOKEN environment variables and static tokens.
• Dynamic Model Catalog: Zero hardcoded models — dynamically queries /v1internal:fetchAvailableModels at runtime, supporting both compact canonical views and raw backend endpoints.
• Reasoning & Thinking Effort: Native support for reasoning budgets and thinking effort levels (low, medium, high) automatically mapped to tiered gateway endpoints.
• Streaming & SSE: High-throughput SSE streaming with generous buffer limits (up to 10MB) for complex multimodal responses and thinking blocks.
• Strict Schema Proto Sanitization: Converts standard JSON Schema into Google's strict Schema proto format, stripping disallowed proto fields ($schema, $defs) and normalizing multi-type arrays.
• Thought Signature Preservation: Round-trips Gemini thought signatures across function calls and responses to maintain tool calling reasoning chains without HTTP 400 errors.

2. Core Capability Interface: llm.QuotaProvider

Introduced a standardized interface in the llm package for inspecting model rate-limits, capacity fractions, and replenishment windows:

• QuotaProvider interface with GetQuota(ctx, model) and ListQuotas(ctx).
• QuotaInfo struct with percentage computation and RFC 3339 reset time parsing.
• Decoupled quota caching (default 30s TTL) with bypass options for real-time rate limit monitoring.

3. Server-Side Token Counting (llm.TokenCounter)

The Antigravity provider now implements Loom's llm.TokenCounter interface:

• Computes exact message token counts using Google's /v1internal:countTokens endpoint for multi-turn chats, system instructions, and tool calls.
• Gracefully falls back to llm.ApproximateTokenCounter if the server is offline or unreachable.
• Enriches streaming chunks with detailed token metrics including Tokens.Reasoning and Tokens.CacheRead.

4. Updated Model Profiles (Autogen)

Comprehensive updates to static provider catalogs:

• OpenAI: Added GPT-6 Astra (gpt-6-astra) with extended reasoning effort options (low, medium, high, xhigh, max) and tiered pricing. Updated pricing and temperature settings.
• Anthropic: Added Claude Fable 5.1 (claude-fable-5-1) and Claude Opus 5 (claude-opus-5), with updated model profiles.
• Google GenAI: Added Gemini 3.8 Flash, Lyria 3, Veo 3.1, and refreshed model profiles.

5. Automated Security & CI Workflows

• Dependabot (.github/dependabot.yml): Automated weekly dependency checks grouped by ecosystem for Go modules (gomod), GitHub Actions (github-actions), and Loom Studio UI (npm).
• CodeQL Analysis (.github/workflows/codeql.yml): Automated static security analysis across Go and JavaScript/TypeScript.
• Embedded Asset Build Compatibility: Added internal/studio/ui/dist/.gitkeep ensuring clean //go:embed compilation out-of-the-box on fresh checkouts and CI environments.
• Actions Upgrades: Updated GitHub Actions to actions/checkout@v7, actions/setup-go@v7, actions/setup-node@v7, and actions/setup-python@v7.

---

📦 What's Changed

Features & Enhancements

• feat(llm/antigravity): Add Google Antigravity provider and QuotaProvider interface (f890fb8)
• feat(llm): Add QuotaProvider and QuotaInfo interfaces to core llm package
• feat(llm/antigravity): Implement llm.TokenCounter with /v1internal:countTokens and graceful fallback

... (truncated)

Commits

• 75cbcd8 chore(ci): bump the actions group with 4 updates (#13)
• 757ea40 chore(deps): bump deps
• 1338669 ci: add dependabot and codeql workflows
• c990be6 chore(openai): update profiles (autogen)
• f890fb8 feat(llm/antigravity): add Google Antigravity provider and QuotaProvider inte...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)