@biffo/cli 0.266.1 → 0.267.0

package/dist/index.js

@@ -2863,6 +2863,24 @@ function assertTargetFidelity(options) {
       findings.push({ path: entry.path, reason: "content-differs", source });
     }
   }
+  for (const migration of options.migrations ?? []) {
+    const path = `${MIGRATIONS_VERSIONS_DIR}/${migration.file}`;
+    checked++;
+    if (!blobs.has(path)) {
+      findings.push({ path, reason: "absent-from-tag", source: "migration" });
+      continue;
+    }
+    let tagText;
+    try {
+      tagText = git(["-C", options.templateRepo, "show", `${tag}:${path}`]);
+    } catch {
+      findings.push({ path, reason: "content-differs", source: "migration" });
+      continue;
+    }
+    if (migrationBodyHash(tagText) !== migrationBodyHash(migration.content)) {
+      findings.push({ path, reason: "content-differs", source: "migration" });
+    }
+  }
   return { checked, findings, unverifiable: null };
 }
 function fidelityFailure(report, toVersion) {
@@ -3456,8 +3474,14 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
   });
   const orphanRatchet = checkOrphanRatchet(plan.orphaned.length, readOrphanBaseline(options.cwd));
   const newSeams = findNewUndeclaredSeams(baseDir, theirsDir, options.cwd);
+  const migrations = planMigrationCarry({
+    templateDir: theirsDir,
+    instanceDir: options.cwd,
+    declined: readDeclinedMigrations(options.cwd)
+  });
   const fidelity = assertTargetFidelity({
     entries: plan.entries,
+    migrations: migrations.entries,
     templateRepo,
     toVersion,
     theirsDir,
@@ -3482,11 +3506,6 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
       `${String(plan.orphaned.length)} unsanctioned instance file(s) under a template-owned path (baseline ${String(orphanRatchet.baseline)}) \u2014 see the list above (#1026). Move new instance-written files under a sanctioned carve-out (services/api/tests/instance/, modules/**/instance/) or otherwise reduce the count, then re-run.`
     );
   }
-  const migrations = planMigrationCarry({
-    templateDir: theirsDir,
-    instanceDir: options.cwd,
-    declined: readDeclinedMigrations(options.cwd)
-  });
   const coreVersionCleanup = planCoreVersionCleanup(options.cwd);
   if (plan.changes.length === 0 && migrations.entries.length === 0) {
     log.success("Nothing to upgrade \u2014 the instance already matches the target for all core files.");
@@ -10218,8 +10237,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa8("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync32, existsSync: existsSync42 } = await import("fs");
-      if (existsSync42(messageFile)) commitMessage = readFileSync32(messageFile, "utf8");
+      const { readFileSync: readFileSync32, existsSync: existsSync43 } = await import("fs");
+      if (existsSync43(messageFile)) commitMessage = readFileSync32(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -10709,13 +10728,420 @@ async function runPluginTerraformCheck() {
 }
 
 // src/scripts/check-plugin-tool-supply.ts
-import { existsSync as existsSync39 } from "fs";
+import { existsSync as existsSync40 } from "fs";
 import { join as join43 } from "path";
 import { execa as execa12 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { readFileSync as readFileSync30, readdirSync as readdirSync18, statSync as statSync10 } from "fs";
+import { existsSync as existsSync39, readFileSync as readFileSync30, readdirSync as readdirSync18, statSync as statSync10 } from "fs";
 import { join as join42 } from "path";
+
+// src/lib/openrouter-model-snapshot.ts
+var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
+var OPENROUTER_MODEL_IDS = [
+  "ai21/jamba-large-1.7",
+  "aion-labs/aion-2.0",
+  "aion-labs/aion-3.0",
+  "aion-labs/aion-3.0-mini",
+  "aion-labs/aion-rp-llama-3.1-8b",
+  "allenai/olmo-3-32b-think",
+  "amazon/nova-2-lite-v1",
+  "amazon/nova-lite-v1",
+  "amazon/nova-micro-v1",
+  "amazon/nova-premier-v1",
+  "amazon/nova-pro-v1",
+  "anthracite-org/magnum-v4-72b",
+  "anthropic/claude-3-haiku",
+  "anthropic/claude-fable-5",
+  "anthropic/claude-fable-5:batch",
+  "anthropic/claude-haiku-4.5",
+  "anthropic/claude-haiku-4.5:batch",
+  "anthropic/claude-opus-4",
+  "anthropic/claude-opus-4.1",
+  "anthropic/claude-opus-4.1:batch",
+  "anthropic/claude-opus-4.5",
+  "anthropic/claude-opus-4.5:batch",
+  "anthropic/claude-opus-4.6",
+  "anthropic/claude-opus-4.6:batch",
+  "anthropic/claude-opus-4.7",
+  "anthropic/claude-opus-4.7-fast",
+  "anthropic/claude-opus-4.7:batch",
+  "anthropic/claude-opus-4.8",
+  "anthropic/claude-opus-4.8-fast",
+  "anthropic/claude-opus-4.8:batch",
+  "anthropic/claude-opus-5",
+  "anthropic/claude-opus-5-fast",
+  "anthropic/claude-opus-5:batch",
+  "anthropic/claude-sonnet-4",
+  "anthropic/claude-sonnet-4.5",
+  "anthropic/claude-sonnet-4.5:batch",
+  "anthropic/claude-sonnet-4.6",
+  "anthropic/claude-sonnet-4.6:batch",
+  "anthropic/claude-sonnet-5",
+  "anthropic/claude-sonnet-5:batch",
+  "arcee-ai/trinity-large-thinking",
+  "arcee-ai/virtuoso-large",
+  "baidu/ernie-4.5-vl-424b-a47b",
+  "bytedance-seed/seed-1.6",
+  "bytedance-seed/seed-1.6-flash",
+  "bytedance-seed/seed-2.0-lite",
+  "bytedance-seed/seed-2.0-mini",
+  "bytedance/ui-tars-1.5-7b",
+  "cognitivecomputations/dolphin-mistral-24b-venice-edition",
+  "cohere/command-a",
+  "cohere/command-r-08-2024",
+  "cohere/command-r-plus-08-2024",
+  "cohere/command-r7b-12-2024",
+  "cohere/north-mini-code:free",
+  "deepcogito/cogito-v2.1-671b",
+  "deepseek/deepseek-chat",
+  "deepseek/deepseek-chat-v3-0324",
+  "deepseek/deepseek-chat-v3.1",
+  "deepseek/deepseek-r1",
+  "deepseek/deepseek-r1-0528",
+  "deepseek/deepseek-r1-distill-llama-70b",
+  "deepseek/deepseek-v3.1-terminus",
+  "deepseek/deepseek-v3.2",
+  "deepseek/deepseek-v3.2-exp",
+  "deepseek/deepseek-v4-flash",
+  "deepseek/deepseek-v4-flash-0731",
+  "deepseek/deepseek-v4-pro",
+  "google/gemini-2.5-flash",
+  "google/gemini-2.5-flash-image",
+  "google/gemini-2.5-flash-lite",
+  "google/gemini-2.5-flash-lite:batch",
+  "google/gemini-2.5-flash:batch",
+  "google/gemini-2.5-pro",
+  "google/gemini-2.5-pro-preview",
+  "google/gemini-2.5-pro-preview-05-06",
+  "google/gemini-2.5-pro:batch",
+  "google/gemini-3-flash-preview",
+  "google/gemini-3-flash-preview:batch",
+  "google/gemini-3-pro-image",
+  "google/gemini-3-pro-image-preview",
+  "google/gemini-3.1-flash-image",
+  "google/gemini-3.1-flash-image-preview",
+  "google/gemini-3.1-flash-lite",
+  "google/gemini-3.1-flash-lite-image",
+  "google/gemini-3.1-flash-lite-preview",
+  "google/gemini-3.1-flash-lite:batch",
+  "google/gemini-3.1-pro-preview",
+  "google/gemini-3.1-pro-preview-customtools",
+  "google/gemini-3.1-pro-preview:batch",
+  "google/gemini-3.5-flash",
+  "google/gemini-3.5-flash-lite",
+  "google/gemini-3.5-flash-lite:batch",
+  "google/gemini-3.5-flash:batch",
+  "google/gemini-3.6-flash",
+  "google/gemini-3.6-flash:batch",
+  "google/gemma-2-27b-it",
+  "google/gemma-3-12b-it",
+  "google/gemma-3-27b-it",
+  "google/gemma-3-4b-it",
+  "google/gemma-3n-e4b-it",
+  "google/gemma-4-26b-a4b-it",
+  "google/gemma-4-26b-a4b-it:free",
+  "google/gemma-4-31b-it",
+  "google/gemma-4-31b-it:free",
+  "google/lyria-3-clip-preview",
+  "google/lyria-3-pro-preview",
+  "gryphe/mythomax-l2-13b",
+  "ibm-granite/granite-4.0-h-micro",
+  "ibm-granite/granite-4.1-8b",
+  "inception/mercury-2",
+  "inclusionai/ling-2.6-1t",
+  "inclusionai/ling-2.6-flash",
+  "inclusionai/ling-3.0-flash",
+  "inclusionai/ling-3.0-tiny:free",
+  "inclusionai/ring-2.6-1t",
+  "kwaipilot/kat-coder-air-v2.5",
+  "kwaipilot/kat-coder-pro-v2",
+  "kwaipilot/kat-coder-pro-v2.5",
+  "mancer/weaver",
+  "meituan/longcat-2.0",
+  "meta-llama/llama-3.1-70b-instruct",
+  "meta-llama/llama-3.1-8b-instruct",
+  "meta-llama/llama-3.2-1b-instruct",
+  "meta-llama/llama-3.2-3b-instruct",
+  "meta-llama/llama-3.3-70b-instruct",
+  "meta-llama/llama-4-maverick",
+  "meta-llama/llama-4-scout",
+  "meta-llama/llama-guard-4-12b",
+  "meta/muse-spark-1.1",
+  "meta/muse-spark-1.2",
+  "microsoft/phi-4",
+  "microsoft/wizardlm-2-8x22b",
+  "minimax/minimax-01",
+  "minimax/minimax-m1",
+  "minimax/minimax-m2",
+  "minimax/minimax-m2-her",
+  "minimax/minimax-m2.1",
+  "minimax/minimax-m2.5",
+  "minimax/minimax-m2.7",
+  "minimax/minimax-m3",
+  "minimax/minimax-m3:batch",
+  "mistralai/codestral-2508",
+  "mistralai/ministral-14b-2512",
+  "mistralai/ministral-3b-2512",
+  "mistralai/ministral-8b-2512",
+  "mistralai/mistral-large",
+  "mistralai/mistral-large-2407",
+  "mistralai/mistral-large-2512",
+  "mistralai/mistral-medium-3",
+  "mistralai/mistral-medium-3-5",
+  "mistralai/mistral-medium-3.1",
+  "mistralai/mistral-nemo",
+  "mistralai/mistral-saba",
+  "mistralai/mistral-small-24b-instruct-2501",
+  "mistralai/mistral-small-2603",
+  "mistralai/mistral-small-3.1-24b-instruct",
+  "mistralai/mistral-small-3.2-24b-instruct",
+  "mistralai/mixtral-8x22b-instruct",
+  "mistralai/voxtral-small-24b-2507",
+  "moonshotai/kimi-k2",
+  "moonshotai/kimi-k2-0905",
+  "moonshotai/kimi-k2-thinking",
+  "moonshotai/kimi-k2.5",
+  "moonshotai/kimi-k2.6",
+  "moonshotai/kimi-k2.7-code",
+  "moonshotai/kimi-k2.7-code:batch",
+  "moonshotai/kimi-k3",
+  "morph/morph-v3-fast",
+  "morph/morph-v3-large",
+  "nex-agi/nex-n2-mini",
+  "nex-agi/nex-n2-pro",
+  "nousresearch/hermes-3-llama-3.1-405b",
+  "nousresearch/hermes-3-llama-3.1-70b",
+  "nousresearch/hermes-4-405b",
+  "nousresearch/hermes-4-70b",
+  "nvidia/nemotron-3-nano-30b-a3b",
+  "nvidia/nemotron-3-nano-30b-a3b:free",
+  "nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free",
+  "nvidia/nemotron-3-super-120b-a12b",
+  "nvidia/nemotron-3-super-120b-a12b:free",
+  "nvidia/nemotron-3-ultra-550b-a55b",
+  "nvidia/nemotron-3-ultra-550b-a55b:batch",
+  "nvidia/nemotron-3-ultra-550b-a55b:free",
+  "nvidia/nemotron-3.5-content-safety:free",
+  "nvidia/nemotron-nano-12b-v2-vl:free",
+  "nvidia/nemotron-nano-9b-v2:free",
+  "openai/gpt-3.5-turbo",
+  "openai/gpt-3.5-turbo-0613",
+  "openai/gpt-3.5-turbo-16k",
+  "openai/gpt-3.5-turbo-instruct",
+  "openai/gpt-3.5-turbo:batch",
+  "openai/gpt-4",
+  "openai/gpt-4-turbo",
+  "openai/gpt-4-turbo-preview",
+  "openai/gpt-4-turbo:batch",
+  "openai/gpt-4.1",
+  "openai/gpt-4.1-mini",
+  "openai/gpt-4.1-mini:batch",
+  "openai/gpt-4.1-nano",
+  "openai/gpt-4.1-nano:batch",
+  "openai/gpt-4.1:batch",
+  "openai/gpt-4o",
+  "openai/gpt-4o-2024-05-13",
+  "openai/gpt-4o-2024-08-06",
+  "openai/gpt-4o-2024-11-20",
+  "openai/gpt-4o-mini",
+  "openai/gpt-4o-mini-2024-07-18",
+  "openai/gpt-4o-mini:batch",
+  "openai/gpt-4o:batch",
+  "openai/gpt-5",
+  "openai/gpt-5-codex:batch",
+  "openai/gpt-5-image",
+  "openai/gpt-5-image-mini",
+  "openai/gpt-5-mini",
+  "openai/gpt-5-mini:batch",
+  "openai/gpt-5-nano",
+  "openai/gpt-5-nano:batch",
+  "openai/gpt-5-pro",
+  "openai/gpt-5-pro:batch",
+  "openai/gpt-5.1",
+  "openai/gpt-5.1-codex",
+  "openai/gpt-5.1-codex-max",
+  "openai/gpt-5.1-codex-mini",
+  "openai/gpt-5.1:batch",
+  "openai/gpt-5.2",
+  "openai/gpt-5.2-chat",
+  "openai/gpt-5.2-codex",
+  "openai/gpt-5.2-pro",
+  "openai/gpt-5.2-pro:batch",
+  "openai/gpt-5.2:batch",
+  "openai/gpt-5.3-chat",
+  "openai/gpt-5.3-codex",
+  "openai/gpt-5.4",
+  "openai/gpt-5.4-image-2",
+  "openai/gpt-5.4-mini",
+  "openai/gpt-5.4-mini:batch",
+  "openai/gpt-5.4-nano",
+  "openai/gpt-5.4-nano:batch",
+  "openai/gpt-5.4-pro",
+  "openai/gpt-5.4-pro:batch",
+  "openai/gpt-5.4:batch",
+  "openai/gpt-5.5",
+  "openai/gpt-5.5-pro",
+  "openai/gpt-5.5-pro:batch",
+  "openai/gpt-5.5:batch",
+  "openai/gpt-5.6-luna",
+  "openai/gpt-5.6-luna-pro",
+  "openai/gpt-5.6-luna-pro:batch",
+  "openai/gpt-5.6-luna:batch",
+  "openai/gpt-5.6-sol",
+  "openai/gpt-5.6-sol-pro",
+  "openai/gpt-5.6-sol-pro:batch",
+  "openai/gpt-5.6-sol:batch",
+  "openai/gpt-5.6-terra",
+  "openai/gpt-5.6-terra-pro",
+  "openai/gpt-5.6-terra-pro:batch",
+  "openai/gpt-5.6-terra:batch",
+  "openai/gpt-5:batch",
+  "openai/gpt-audio",
+  "openai/gpt-audio-mini",
+  "openai/gpt-chat-latest",
+  "openai/gpt-oss-120b",
+  "openai/gpt-oss-20b",
+  "openai/gpt-oss-20b:free",
+  "openai/gpt-oss-safeguard-20b",
+  "openai/o1",
+  "openai/o1-pro",
+  "openai/o1-pro:batch",
+  "openai/o1:batch",
+  "openai/o3",
+  "openai/o3-mini",
+  "openai/o3-mini-high",
+  "openai/o3-mini-high:batch",
+  "openai/o3-mini:batch",
+  "openai/o3-pro",
+  "openai/o3-pro:batch",
+  "openai/o3:batch",
+  "openai/o4-mini",
+  "openai/o4-mini-high",
+  "openai/o4-mini-high:batch",
+  "openai/o4-mini:batch",
+  "openrouter/auto",
+  "openrouter/auto-beta",
+  "openrouter/bodybuilder",
+  "openrouter/free",
+  "openrouter/fusion",
+  "openrouter/pareto-code",
+  "perceptron/perceptron-mk1",
+  "perplexity/sonar",
+  "perplexity/sonar-deep-research",
+  "perplexity/sonar-pro",
+  "perplexity/sonar-pro-search",
+  "perplexity/sonar-reasoning-pro",
+  "poolside/laguna-s-2.1",
+  "poolside/laguna-s-2.1:free",
+  "poolside/laguna-xs-2.1",
+  "poolside/laguna-xs-2.1:free",
+  "qwen/qwen-2.5-72b-instruct",
+  "qwen/qwen-2.5-7b-instruct",
+  "qwen/qwen-2.5-coder-32b-instruct",
+  "qwen/qwen-plus",
+  "qwen/qwen-plus-2025-07-28",
+  "qwen/qwen-plus-2025-07-28:thinking",
+  "qwen/qwen2.5-vl-72b-instruct",
+  "qwen/qwen3-14b",
+  "qwen/qwen3-235b-a22b",
+  "qwen/qwen3-235b-a22b-2507",
+  "qwen/qwen3-235b-a22b-thinking-2507",
+  "qwen/qwen3-30b-a3b",
+  "qwen/qwen3-30b-a3b-instruct-2507",
+  "qwen/qwen3-30b-a3b-thinking-2507",
+  "qwen/qwen3-32b",
+  "qwen/qwen3-8b",
+  "qwen/qwen3-coder",
+  "qwen/qwen3-coder-30b-a3b-instruct",
+  "qwen/qwen3-coder-flash",
+  "qwen/qwen3-coder-next",
+  "qwen/qwen3-coder-plus",
+  "qwen/qwen3-max",
+  "qwen/qwen3-max-thinking",
+  "qwen/qwen3-next-80b-a3b-instruct",
+  "qwen/qwen3-next-80b-a3b-thinking",
+  "qwen/qwen3-vl-235b-a22b-instruct",
+  "qwen/qwen3-vl-235b-a22b-thinking",
+  "qwen/qwen3-vl-30b-a3b-instruct",
+  "qwen/qwen3-vl-30b-a3b-thinking",
+  "qwen/qwen3-vl-32b-instruct",
+  "qwen/qwen3-vl-8b-instruct",
+  "qwen/qwen3-vl-8b-thinking",
+  "qwen/qwen3.5-122b-a10b",
+  "qwen/qwen3.5-27b",
+  "qwen/qwen3.5-35b-a3b",
+  "qwen/qwen3.5-397b-a17b",
+  "qwen/qwen3.5-9b",
+  "qwen/qwen3.5-flash-02-23",
+  "qwen/qwen3.5-plus-02-15",
+  "qwen/qwen3.5-plus-20260420",
+  "qwen/qwen3.6-27b",
+  "qwen/qwen3.6-35b-a3b",
+  "qwen/qwen3.6-flash",
+  "qwen/qwen3.6-max-preview",
+  "qwen/qwen3.6-plus",
+  "qwen/qwen3.7-flash",
+  "qwen/qwen3.7-max",
+  "qwen/qwen3.7-plus",
+  "qwen/qwen3.8-max",
+  "rekaai/reka-edge",
+  "rekaai/reka-flash-3",
+  "relace/relace-apply-3",
+  "relace/relace-search",
+  "sakana/fugu-ultra",
+  "sao10k/l3-lunaris-8b",
+  "sao10k/l3.1-euryale-70b",
+  "sao10k/l3.3-euryale-70b",
+  "stepfun/step-3.5-flash",
+  "stepfun/step-3.7-flash",
+  "tencent/hunyuan-a13b-instruct",
+  "tencent/hy3",
+  "tencent/hy3-preview",
+  "thedrummer/cydonia-24b-v4.1",
+  "thedrummer/rocinante-12b",
+  "thedrummer/skyfall-36b-v2",
+  "thedrummer/unslopnemo-12b",
+  "thinkingmachines/inkling",
+  "thinkingmachines/inkling-small",
+  "thinkingmachines/inkling:batch",
+  "undi95/remm-slerp-l2-13b",
+  "upstage/solar-pro-3",
+  "writer/palmyra-x5",
+  "x-ai/grok-4.20",
+  "x-ai/grok-4.20-multi-agent",
+  "x-ai/grok-4.3",
+  "x-ai/grok-4.5",
+  "x-ai/grok-build-0.1",
+  "xiaomi/mimo-v2.5",
+  "xiaomi/mimo-v2.5-pro",
+  "z-ai/glm-4.5",
+  "z-ai/glm-4.5-air",
+  "z-ai/glm-4.5v",
+  "z-ai/glm-4.6",
+  "z-ai/glm-4.6v",
+  "z-ai/glm-4.7",
+  "z-ai/glm-4.7-flash",
+  "z-ai/glm-5",
+  "z-ai/glm-5-turbo",
+  "z-ai/glm-5.1",
+  "z-ai/glm-5.2",
+  "z-ai/glm-5.2:batch",
+  "z-ai/glm-5v-turbo",
+  "~anthropic/claude-fable-latest",
+  "~anthropic/claude-haiku-latest",
+  "~anthropic/claude-opus-latest",
+  "~anthropic/claude-sonnet-latest",
+  "~deepseek/deepseek-v4-flash-latest",
+  "~google/gemini-flash-latest",
+  "~google/gemini-pro-latest",
+  "~moonshotai/kimi-latest",
+  "~openai/gpt-latest",
+  "~openai/gpt-mini-latest",
+  "~x-ai/grok-latest"
+];
+
+// src/lib/plugin-tool-supply-audit.ts
 function listDirs(root) {
   let entries;
   try {
@@ -10968,6 +11394,148 @@ function extractTerraformEnvKeys(tfText) {
   }
   return { keys: [...keys].sort(), rawMarkerCount, resolvedBlockCount };
 }
+var SETTINGS_STR_FIELD = /^[ \t]*([A-Za-z_][A-Za-z0-9_]*)\s*:\s*str\s*=\s*"([^"]*)"/gm;
+function extractSettingsModelFields(text) {
+  const out = [];
+  SETTINGS_STR_FIELD.lastIndex = 0;
+  let m;
+  while ((m = SETTINGS_STR_FIELD.exec(text)) !== null) {
+    const [field, value] = [m[1], m[2]];
+    if (field.toLowerCase().includes("model") && value.includes("/")) {
+      out.push({ field, value });
+    }
+  }
+  return out;
+}
+var MODEL_FIELD_NAME_MARKER = /"name"\s*:\s*"model"/g;
+var FIELD_DEFAULT = /"default"\s*:\s*"([^"]*)"/;
+var FIELD_OPTIONS_START = /"options"\s*:\s*\[/;
+var OPTION_VALUE = /"value"\s*:\s*"([^"]*)"/g;
+function extractCuratedModelFields(text) {
+  const fields = [];
+  let rawFieldCount = 0;
+  MODEL_FIELD_NAME_MARKER.lastIndex = 0;
+  let m;
+  while ((m = MODEL_FIELD_NAME_MARKER.exec(text)) !== null) {
+    rawFieldCount += 1;
+    const start = m.index + m[0].length;
+    const nextNameIdx = text.indexOf('"name"', start);
+    const windowEnd = nextNameIdx === -1 ? text.length : nextNameIdx;
+    const window = text.slice(start, windowEnd);
+    const defaultMatch = FIELD_DEFAULT.exec(window);
+    const defaultValue = defaultMatch ? defaultMatch[1] : null;
+    const optionsMatch = FIELD_OPTIONS_START.exec(window);
+    const optionValues = [];
+    if (optionsMatch) {
+      const openIdx = start + optionsMatch.index + optionsMatch[0].length - 1;
+      const closeIdx = balancedSpanFrom(text, openIdx, "[", "]");
+      if (closeIdx !== null) {
+        const inner = text.slice(openIdx, closeIdx + 1);
+        OPTION_VALUE.lastIndex = 0;
+        let om;
+        while ((om = OPTION_VALUE.exec(inner)) !== null) {
+          optionValues.push(om[1]);
+        }
+      }
+    }
+    fields.push({ defaultValue, optionValues });
+  }
+  return { rawFieldCount, fields };
+}
+var MODEL_SNAPSHOT_MAX_AGE_DAYS = 45;
+function isSnapshotStale(fetchedAt, now) {
+  const fetchedMs = new Date(fetchedAt).getTime();
+  if (Number.isNaN(fetchedMs)) return true;
+  const ageMs = now.getTime() - fetchedMs;
+  return ageMs > MODEL_SNAPSHOT_MAX_AGE_DAYS * 24 * 60 * 60 * 1e3;
+}
+function normalizeModelId(id) {
+  return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
+}
+var CONFIG_PY_PATH = join42("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join42(
+  "services",
+  "api",
+  "src",
+  "api",
+  "schemas",
+  "orchestration.py"
+);
+function auditDeclaredModelIds(repoRoot, options = {}) {
+  const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
+  const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const configPath = join42(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join42(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configMissing = !existsSync39(configPath);
+  const orchestrationSchemaMissing = !existsSync39(orchestrationPath);
+  const knownSet = new Set(knownModelIds);
+  const snapshotEmpty = knownModelIds.length === 0;
+  const snapshotStale = isSnapshotStale(snapshotFetchedAt, now);
+  const findings = [];
+  const record = (source, rawValue) => {
+    const normalized = normalizeModelId(rawValue);
+    const ok2 = knownSet.has(normalized);
+    findings.push({
+      source,
+      modelId: rawValue,
+      normalizedModelId: normalized,
+      status: ok2 ? "ok" : "unknown-model",
+      detail: ok2 ? `"${rawValue}" is in the OpenRouter snapshot (${knownModelIds.length} id(s), fetched ${snapshotFetchedAt})` : `"${rawValue}" (normalized "${normalized}") is NOT in the OpenRouter snapshot (${knownModelIds.length} id(s), fetched ${snapshotFetchedAt}) \u2014 either the slug is wrong or the snapshot needs a refresh`
+    });
+  };
+  let settingsBlind = false;
+  if (!configMissing) {
+    const settingsFields = extractSettingsModelFields(readFileSync30(configPath, "utf8"));
+    if (settingsFields.length === 0) settingsBlind = true;
+    for (const { field, value } of settingsFields) record(`${CONFIG_PY_PATH}#${field}`, value);
+  }
+  let curatedFieldsBlind = false;
+  if (!orchestrationSchemaMissing) {
+    const curated = extractCuratedModelFields(readFileSync30(orchestrationPath, "utf8"));
+    if (curated.rawFieldCount > 0 && curated.fields.every((f) => f.defaultValue === null && f.optionValues.length === 0)) {
+      curatedFieldsBlind = true;
+    }
+    curated.fields.forEach((field, i) => {
+      if (field.defaultValue !== null) {
+        record(`${ORCHESTRATION_SCHEMA_PATH}#model[${i}].default`, field.defaultValue);
+      }
+      field.optionValues.forEach((v, j) => {
+        record(`${ORCHESTRATION_SCHEMA_PATH}#model[${i}].options[${j}]`, v);
+      });
+    });
+  }
+  const badFindings = findings.filter((f) => f.status !== "ok");
+  const ok = !configMissing && !orchestrationSchemaMissing && !settingsBlind && !curatedFieldsBlind && !snapshotEmpty && !snapshotStale && badFindings.length === 0;
+  const summaryParts = [
+    `${findings.length} declared model id(s) checked against ${knownModelIds.length} known OpenRouter id(s) (snapshot fetched ${snapshotFetchedAt})`,
+    `${badFindings.length} not ok`
+  ];
+  if (configMissing) summaryParts.push(`MISSING ${CONFIG_PY_PATH}`);
+  if (orchestrationSchemaMissing) summaryParts.push(`MISSING ${ORCHESTRATION_SCHEMA_PATH}`);
+  if (settingsBlind) summaryParts.push("SETTINGS EXTRACTOR BLIND");
+  if (curatedFieldsBlind) summaryParts.push("CURATED-OPTIONS EXTRACTOR BLIND");
+  if (snapshotEmpty) summaryParts.push("SNAPSHOT EMPTY");
+  if (snapshotStale)
+    summaryParts.push(
+      `SNAPSHOT STALE (older than ${MODEL_SNAPSHOT_MAX_AGE_DAYS}d \u2014 run refresh-openrouter-model-snapshot.ts)`
+    );
+  return {
+    configPath: CONFIG_PY_PATH,
+    orchestrationSchemaPath: ORCHESTRATION_SCHEMA_PATH,
+    configMissing,
+    orchestrationSchemaMissing,
+    settingsBlind,
+    curatedFieldsBlind,
+    snapshotFetchedAt,
+    snapshotModelCount: knownModelIds.length,
+    snapshotEmpty,
+    snapshotStale,
+    findings,
+    ok,
+    summary: summaryParts.join("; ")
+  };
+}
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
@@ -11115,37 +11683,82 @@ function auditPluginToolSupply(pluginsRoot) {
 // src/scripts/check-plugin-tool-supply.ts
 async function runPluginToolSupplyCheck() {
   const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  let allOk = true;
   const pluginsRoot = join43(root, "services", "_plugins");
-  if (!existsSync39(pluginsRoot)) {
+  if (!existsSync40(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
-    return;
-  }
-  const report = auditPluginToolSupply(pluginsRoot);
-  console.log(
-    `audited ${report.plugins.length} plugin dir(s), ${report.findings.length} declared tool(s) cross-checked, under ${pluginsRoot}`
-  );
-  if (!report.ok) {
-    console.error("\u2717 plugin tool-supply guard: an unsatisfiable tool grant found\n");
-    if (report.noPluginsFound) {
-      console.error(`  NO PLUGINS FOUND under ${pluginsRoot} \u2014 cannot evaluate an empty world.`);
-    }
-    if (report.registryBlind) {
-      console.error(
-        "  REGISTRY BLIND: raw source contains ToolDefinition( call site(s) but the extractor resolved none \u2014 the extractor broke, this is not evidence a plugin registers nothing."
-      );
-    }
-    if (report.terraformBlind) {
-      console.error(
-        "  TERRAFORM BLIND: raw source contains environment_variables but the extractor resolved no keys \u2014 the extractor broke, this is not evidence of an empty Lambda."
-      );
+  } else {
+    const report = auditPluginToolSupply(pluginsRoot);
+    console.log(
+      `audited ${report.plugins.length} plugin dir(s), ${report.findings.length} declared tool(s) cross-checked, under ${pluginsRoot}`
+    );
+    if (!report.ok) {
+      allOk = false;
+      console.error("\u2717 plugin tool-supply guard: an unsatisfiable tool grant found\n");
+      if (report.noPluginsFound) {
+        console.error(`  NO PLUGINS FOUND under ${pluginsRoot} \u2014 cannot evaluate an empty world.`);
+      }
+      if (report.registryBlind) {
+        console.error(
+          "  REGISTRY BLIND: raw source contains ToolDefinition( call site(s) but the extractor resolved none \u2014 the extractor broke, this is not evidence a plugin registers nothing."
+        );
+      }
+      if (report.terraformBlind) {
+        console.error(
+          "  TERRAFORM BLIND: raw source contains environment_variables but the extractor resolved no keys \u2014 the extractor broke, this is not evidence of an empty Lambda."
+        );
+      }
+      for (const f of report.findings.filter((f2) => f2.status !== "ok")) {
+        console.error(`  ${f.status.toUpperCase()}  ${f.plugin}/${f.tool}  ${f.detail}`);
+      }
+    } else {
+      console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
-    for (const f of report.findings.filter((f2) => f2.status !== "ok")) {
-      console.error(`  ${f.status.toUpperCase()}  ${f.plugin}/${f.tool}  ${f.detail}`);
+  }
+  const servicesApiRoot = join43(root, "services", "api");
+  if (!existsSync40(servicesApiRoot)) {
+    console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
+  } else {
+    const modelReport = auditDeclaredModelIds(root);
+    console.log(`audited ${modelReport.findings.length} declared model id(s)`);
+    if (!modelReport.ok) {
+      allOk = false;
+      console.error("\u2717 plugin model-id guard: a declared model id does not match the provider\n");
+      if (modelReport.configMissing) {
+        console.error(`  MISSING ${modelReport.configPath}`);
+      }
+      if (modelReport.orchestrationSchemaMissing) {
+        console.error(`  MISSING ${modelReport.orchestrationSchemaPath}`);
+      }
+      if (modelReport.settingsBlind) {
+        console.error(
+          `  SETTINGS EXTRACTOR BLIND: ${modelReport.configPath} exists but no model-named string field resolved \u2014 the extractor broke, this is not evidence there is no default.`
+        );
+      }
+      if (modelReport.curatedFieldsBlind) {
+        console.error(
+          `  CURATED-OPTIONS EXTRACTOR BLIND: ${modelReport.orchestrationSchemaPath} has a "name": "model" field but no default/options resolved from it.`
+        );
+      }
+      if (modelReport.snapshotEmpty) {
+        console.error("  SNAPSHOT EMPTY: the committed OpenRouter snapshot has zero ids.");
+      }
+      if (modelReport.snapshotStale) {
+        console.error(
+          `  SNAPSHOT STALE: fetched ${modelReport.snapshotFetchedAt}, older than the refresh window \u2014 run refresh-openrouter-model-snapshot.ts and commit the result.`
+        );
+      }
+      for (const f of modelReport.findings.filter((f2) => f2.status !== "ok")) {
+        console.error(`  ${f.status.toUpperCase()}  ${f.source}  ${f.detail}`);
+      }
+    } else {
+      console.log(`\u2713 plugin model-id guard: ${modelReport.summary}`);
     }
+  }
+  if (!allOk) {
     console.error("\nSee biffo-template#822.");
     process.exit(1);
   }
-  console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
 }
 
 // src/scripts/check-release-subject.ts
@@ -11329,7 +11942,7 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync40, readFileSync as readFileSync31 } from "fs";
+import { existsSync as existsSync41, readFileSync as readFileSync31 } from "fs";
 import { join as join44, resolve as resolve18 } from "path";
 import chalk21 from "chalk";
 import { Command as Command24 } from "commander";
@@ -11506,7 +12119,7 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
 }
 function readLocalCoreVersion(cwd) {
   const path = join44(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync40(path)) return null;
+  if (!existsSync41(path)) return null;
   try {
     return parseCoreRecord(readFileSync31(path, "utf8"));
   } catch {
@@ -11524,7 +12137,7 @@ function parseCoreRecord(contents) {
 }
 function readFossil(cwd) {
   const path = join44(cwd, CORE_VERSION_FILE);
-  if (!existsSync40(path)) return null;
+  if (!existsSync41(path)) return null;
   try {
     const value = readFileSync31(path, "utf8").trim();
     return value === "" ? null : value;
@@ -11975,13 +12588,13 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command26 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync41 } from "fs";
+import { existsSync as existsSync42 } from "fs";
 import { dirname as dirname10, join as join45 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
     const candidate = join45(dir, relativePath);
-    if (existsSync41(candidate)) return candidate;
+    if (existsSync42(candidate)) return candidate;
     const parent = dirname10(dir);
     if (parent === dir) return null;
     dir = parent;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.266.1",
+  "version": "0.267.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",
@@ -50,7 +50,8 @@
     "check:core-ownership": "tsx src/index.ts check ownership",
     "check:plugin-terraform": "tsx src/index.ts check plugin-terraform",
     "sync:core-tag": "tsx src/scripts/sync-core-tag.ts",
-    "report:publish-failure": "tsx src/scripts/report-publish-failure.ts"
+    "report:publish-failure": "tsx src/scripts/report-publish-failure.ts",
+    "refresh:openrouter-models": "tsx src/scripts/refresh-openrouter-model-snapshot.ts"
   },
   "dependencies": {
     "@aws-sdk/client-cloudformation": "^3.726.1",