@bubblebrain-ai/bubble 0.0.52 → 0.0.54

package/dist/model-catalog.js

@@ -1,3 +1,4 @@
+import { OPENROUTER_MODEL_ID } from "./provider-model-policy.js";
 export const BUILTIN_PROVIDERS = [
     { id: "openrouter", name: "OpenRouter", baseURL: "https://openrouter.ai/api/v1" },
     { id: "openai", name: "OpenAI", baseURL: "https://api.openai.com/v1", supportsOAuth: true },
@@ -38,13 +39,16 @@ const GPT51_LEVELS = ["off", "low", "medium", "high"];
 const GPT51_CODEX_MAX_LEVELS = ["off", "low", "medium", "high", "xhigh"];
 const GPT51_CODEX_MINI_LEVELS = ["off", "medium", "high"];
 const OPENAI_CHAT_LEVELS = ["off"];
+// Ox Alpha declares mandatory reasoning with exactly low/high/max through
+// OpenRouter's live model metadata. The endpoint rejects disabled reasoning.
+const OPENROUTER_OX_REASONING_LEVELS = ["low", "high", "max"];
 // Internal representation for APIs that expose thinking as enabled/disabled.
 // UI code must render supported toggle models as on/off, not as "medium" effort.
 const TOGGLE_THINKING_LEVELS = ["off", "medium"];
 // GLM-5.2 accepts OpenAI-style `reasoning_effort`. We expose high and max plus
 // "off", which disables thinking outright via `thinking: {type: "disabled"}`.
 const GLM_5_2_LEVELS = ["high", "max", "off"];
-// GLM-5.3 Coding Plan normalizes efforts into exactly three real tiers. Its
+// The GLM-5.3 family normalizes efforts into exactly three real tiers. Its
 // default is max, and disabling thinking maps to low rather than turning it off.
 const GLM_5_3_LEVELS = ["low", "high", "max"];
 // Kimi K2.7 Code variants only support thinking mode (disabling it errors), so
@@ -56,7 +60,9 @@ const KIMI_THINKING_ONLY_LEVELS = ["medium"];
 // "disabled"); the 256k variant exposes effort only, so it has no "off".
 const KIMI_K3_LEVELS = ["off", "low", "high", "max"];
 const KIMI_K3_EFFORT_ONLY_LEVELS = ["low", "high", "max"];
-const DEEPSEEK_V4_LEVELS = ["high", "max"];
+// DeepSeek V4 defaults to thinking/high, but the OpenAI-compatible API also
+// supports disabling thinking and selecting low/high/max effort explicitly.
+const DEEPSEEK_V4_LEVELS = ["off", "low", "high", "max"];
 // Bailian token plan grades, read off the endpoint's own 400 responses
 // ("'reasoning_effort' must be one of: ..."), which differ per model. "none"
 // maps to our "off". qwen3.6-flash / qwen3.7-* stop at xhigh; deepseek-v4-pro
@@ -84,6 +90,10 @@ const GEMINI_3_FLASH_LEVELS = ["minimal", "low", "medium", "high"];
 const GEMINI_25_PRO_LEVELS = ["low", "medium", "high"];
 const GEMINI_25_FLASH_LEVELS = ["off", "low", "medium", "high"];
 export const BUILTIN_MODELS = [
+    // OpenRouter exposes a very large catalog, but Bubble intentionally offers
+    // only Ox Alpha. Discovery refreshes this entry's public metadata without
+    // expanding provider membership.
+    { id: OPENROUTER_MODEL_ID, name: "Ox Alpha", providerId: "openrouter", tier: "strong", reasoningLevels: OPENROUTER_OX_REASONING_LEVELS, defaultReasoningLevel: "max", contextWindow: 1048576 },
     { id: "gpt-5.6-sol", name: "GPT-5.6-Sol", providerId: "openai-codex", tier: "balanced", reasoningLevels: GPT56_LEVELS, defaultReasoningLevel: "low", contextWindow: 372000, useResponsesLite: true, toolOutputTokenLimit: 10000 },
     { id: "gpt-5.6-terra", name: "GPT-5.6-Terra", providerId: "openai-codex", tier: "strong", reasoningLevels: GPT56_LEVELS, defaultReasoningLevel: "medium", contextWindow: 372000, useResponsesLite: true, toolOutputTokenLimit: 10000 },
     { id: "gpt-5.6-luna", name: "GPT-5.6-Luna", providerId: "openai-codex", tier: "strong", reasoningLevels: GPT56_LUNA_LEVELS, defaultReasoningLevel: "medium", contextWindow: 372000, useResponsesLite: true, toolOutputTokenLimit: 10000 },
@@ -108,8 +118,12 @@ export const BUILTIN_MODELS = [
     { id: "claude-opus-4-8", name: "Claude Opus 4.8", providerId: "anthropic", tier: "strong", reasoningLevels: ANTHROPIC_OPUS_EFFORT_LEVELS, defaultReasoningLevel: "high", contextWindow: 1000000 },
     { id: "claude-sonnet-4-6", name: "Claude Sonnet 4.6", providerId: "anthropic", tier: "balanced", reasoningLevels: ANTHROPIC_SONNET_EFFORT_LEVELS, defaultReasoningLevel: "high", contextWindow: 1000000 },
     { id: "claude-haiku-4-5-20251001", name: "Claude Haiku 4.5", providerId: "anthropic", tier: "fast", reasoningLevels: ANTHROPIC_CHAT_LEVELS, contextWindow: 200000 },
-    { id: "deepseek-v4-flash", name: "deepseek-v4-flash", providerId: "deepseek", tier: "fast", reasoningLevels: DEEPSEEK_V4_LEVELS, contextWindow: 1048576 },
-    { id: "deepseek-v4-pro", name: "deepseek-v4-pro", providerId: "deepseek", tier: "strong", reasoningLevels: DEEPSEEK_V4_LEVELS, contextWindow: 1048576 },
+    { id: "deepseek-v4-flash", name: "deepseek-v4-flash", providerId: "deepseek", tier: "fast", reasoningLevels: DEEPSEEK_V4_LEVELS, defaultReasoningLevel: "high", contextWindow: 1048576 },
+    // Experimental vision model stays explicit-only: it is text-capable, but
+    // automatic fast-tier routing must not silently switch ordinary subagents
+    // from the stable Flash model to an experimental multimodal endpoint.
+    { id: "deepseek-v4-flash-vision-exp", name: "DeepSeek-V4-Flash-Vision-Exp", providerId: "deepseek", reasoningLevels: DEEPSEEK_V4_LEVELS, defaultReasoningLevel: "high", contextWindow: 1048576 },
+    { id: "deepseek-v4-pro", name: "deepseek-v4-pro", providerId: "deepseek", tier: "strong", reasoningLevels: DEEPSEEK_V4_LEVELS, defaultReasoningLevel: "high", contextWindow: 1048576 },
     // Offline/no-key fallback only: with an API key the registry replaces this
     // list via fetchGeminiModels (GET /v1beta/models, newest five). Gemini 3
     // exposes thinking_level (minimal/low/medium/high); 2.5 Pro cannot disable
@@ -123,8 +137,13 @@ export const BUILTIN_MODELS = [
     { id: "glm-5.1", name: "GLM-5.1", providerId: "zhipuai", tier: "balanced", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 200000 },
     { id: "glm-4.7", name: "GLM-4.7", providerId: "zhipuai", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 204800 },
     { id: "glm-4.6", name: "GLM-4.6", providerId: "zhipuai", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 204800 },
-    // Coding Plan exposes GLM-5.3 before GET /models lists it (verified live
-    // 2026-08-14). The standard API is still marked "coming soon" in the docs.
+    // GLM-5.3-Flash is a native multimodal model with the same mandatory
+    // low/high/max thinking contract as GLM-5.3. It is fully available on the
+    // Coding Plan and GET /models (verified live 2026-08-26). Official docs list
+    // a 1M context window and position it as the fast/low-cost plan model.
+    { id: "glm-5.3-flash", name: "GLM-5.3-Flash", providerId: "zhipuai-coding-plan", tier: "fast", reasoningLevels: GLM_5_3_LEVELS, defaultReasoningLevel: "max", contextWindow: 1000000 },
+    // Coding Plan exposed GLM-5.3 before GET /models listed it (verified live
+    // 2026-08-14). The standard API was still marked "coming soon" at that time.
     { id: "glm-5.3", name: "GLM-5.3", providerId: "zhipuai-coding-plan", tier: "strong", reasoningLevels: GLM_5_3_LEVELS, defaultReasoningLevel: "max", contextWindow: 1000000 },
     { id: "glm-5.2", name: "GLM-5.2", providerId: "zhipuai-coding-plan", tier: "strong", reasoningLevels: GLM_5_2_LEVELS, contextWindow: 1000000 },
     { id: "glm-5.1", name: "GLM-5.1", providerId: "zhipuai-coding-plan", tier: "balanced", reasoningLevels: TOGGLE_THINKING_LEVELS, contextWindow: 200000 },

package/dist/model-config.js

@@ -7,6 +7,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
+import { filterProviderModels } from "./provider-model-policy.js";
 const MODELS_PATH = join(homedir(), ".bubble", "models.json");
 const MODEL_TIERS = ["fast", "balanced", "strong"];
 function sanitizeTier(value) {
@@ -53,13 +54,13 @@ export class ModelConfig {
         const cfg = this.data?.providers?.[providerId];
         if (!cfg?.models)
             return [];
-        return cfg.models.map((m) => ({
+        return filterProviderModels(providerId, cfg.models.map((m) => ({
             id: m.id,
             name: m.name || m.id,
             providerId,
             tier: sanitizeTier(m.tier),
             routingPriority: sanitizeRoutingPriority(m.routingPriority),
-        }));
+        })));
     }
     getApiKey(providerId) {
         return this.data?.providers?.[providerId]?.apiKey;

package/dist/model-pricing.d.ts

@@ -1,10 +1,7 @@
 import type { TokenUsage, UsageCost } from "./types.js";
 export type { UsageCost } from "./types.js";
 export type PricingCurrency = UsageCost["currency"];
-export interface ModelPricing {
-    providerId: string;
-    modelId: string;
-    currency: PricingCurrency;
+export interface ModelPricingRate {
     inputCacheHitPerMillion: number;
     inputCacheMissPerMillion: number;
     /**
@@ -15,6 +12,28 @@ export interface ModelPricing {
      */
     inputCacheWritePerMillion?: number;
     outputPerMillion: number;
+}
+export interface UtcPricingWindow {
+    /** Inclusive minute since 00:00 UTC. */
+    startMinute: number;
+    /** Exclusive minute since 00:00 UTC. */
+    endMinute: number;
+}
+export interface ModelPricing extends ModelPricingRate {
+    providerId: string;
+    modelId: string;
+    currency: PricingCurrency;
+    /**
+     * Optional recurring UTC time-of-use tariff. Top-level rates are the peak
+     * tariff; outside these windows, `offPeak` applies. DeepSeek introduced this
+     * pricing shape for the V4 family on 2026-08-16.
+     */
+    peakWindowsUtc?: UtcPricingWindow[];
+    offPeak?: ModelPricingRate;
+    /** When the recurring tariff became effective. */
+    effectiveFrom?: string;
+    /** Rate used before `effectiveFrom` (for historical session statistics). */
+    prior?: ModelPricingRate;
     effectiveUntil?: string;
     original?: {
         inputCacheHitPerMillion: number;
@@ -32,4 +51,4 @@ export interface ModelPricing {
 export declare const MODEL_PRICING_OVERRIDES: ModelPricing[];
 export declare const MODEL_PRICING: ModelPricing[];
 export declare function getModelPricing(providerId: string, modelId: string): ModelPricing | undefined;
-export declare function calculateUsageCost(providerId: string, modelId: string, usage: TokenUsage): UsageCost | undefined;
+export declare function calculateUsageCost(providerId: string, modelId: string, usage: TokenUsage, at?: Date): UsageCost | undefined;

package/dist/model-selection.js

@@ -1,9 +1,18 @@
-import { encodeModel } from "./provider-registry.js";
+import { decodeModel, encodeModel } from "./provider-registry.js";
+import { assertProviderModelAllowed } from "./provider-model-policy.js";
 export function resolveConfiguredModel(input) {
     const selected = input.cliModel ?? input.sessionModel ?? input.defaultModel;
     if (!selected)
         return "";
-    if (selected.includes(":"))
-        return selected;
-    return input.fallbackProviderId ? encodeModel(input.fallbackProviderId, selected) : "";
+    const normalized = selected.includes(":")
+        ? selected
+        : input.fallbackProviderId
+            ? encodeModel(input.fallbackProviderId, selected)
+            : "";
+    if (!normalized)
+        return "";
+    const { providerId, modelId } = decodeModel(normalized);
+    if (providerId)
+        assertProviderModelAllowed(providerId, modelId);
+    return normalized;
 }

package/dist/network/chatgpt-transport.js

@@ -32,8 +32,6 @@ export function createChatGptFetch(options = {}) {
     };
 }
 export function createChatGptDispatcher(env = process.env, input) {
-    if (isBunRuntime())
-        return undefined;
     const ca = loadExtraCaCertificates(env);
     const proxy = input ? nodeProxyForUrl(input, env) : defaultNodeProxy(env);
     if (!proxy && ca.length === 0)
@@ -49,15 +47,6 @@ export function createChatGptDispatcher(env = process.env, input) {
 }
 export function withChatGptNetworkOptions(input, init, env = process.env, dispatcher = createChatGptDispatcher(env, input)) {
     const next = { ...(init ?? {}) };
-    if (isBunRuntime()) {
-        const proxy = bunProxyForUrl(input, env);
-        if (proxy)
-            next.proxy = proxy;
-        const ca = bunExtraCaFiles(env);
-        if (ca.length > 0)
-            next.tls = { ...(next.tls ?? {}), ca };
-        return next;
-    }
     if (dispatcher)
         next.dispatcher = dispatcher;
     return next;
@@ -94,23 +83,6 @@ function hasProxyEnv(env) {
 function chatGptProxyOverride(env) {
     return env.BUBBLE_CHATGPT_PROXY ?? env.bubble_chatgpt_proxy;
 }
-function isBunRuntime() {
-    return typeof globalThis.Bun !== "undefined";
-}
-function bunProxyForUrl(input, env) {
-    const url = urlFromInput(input);
-    if (!url || shouldBypassProxy(url, env))
-        return undefined;
-    const override = chatGptProxyOverride(env);
-    if (override)
-        return override;
-    const allProxy = env.ALL_PROXY ?? env.all_proxy;
-    if (url.protocol === "https:")
-        return env.HTTPS_PROXY ?? env.https_proxy ?? allProxy ?? getSystemProxyForUrl(url, env);
-    if (url.protocol === "http:")
-        return env.HTTP_PROXY ?? env.http_proxy ?? allProxy ?? getSystemProxyForUrl(url, env);
-    return undefined;
-}
 function nodeProxyForUrl(input, env) {
     const url = urlFromInput(input);
     if (!url || shouldBypassProxy(url, env))
@@ -129,12 +101,6 @@ function defaultNodeProxy(env) {
         ?? env.HTTPS_PROXY ?? env.https_proxy ?? env.HTTP_PROXY ?? env.http_proxy ?? env.ALL_PROXY ?? env.all_proxy
         ?? getSystemProxyForUrl(new URL("https://system-proxy-default.invalid/"), env);
 }
-function bunExtraCaFiles(env) {
-    const bun = globalThis.Bun;
-    if (!bun?.file)
-        return [];
-    return extraCaCertificatePaths(env).map((path) => bun.file(path));
-}
 function urlFromInput(input) {
     if (input instanceof URL)
         return input;

package/dist/network/errors.d.ts

@@ -17,6 +17,25 @@ export declare class RateLimitError extends Error {
     });
 }
 export declare function isRateLimitError(error: unknown): error is RateLimitError;
+/**
+ * A provider accepted the HTTP request but terminated generation with an
+ * in-band protocol error (for example OpenRouter's HTTP-200 SSE error chunk).
+ * Keeping the wire status/type structured prevents the agent from mistaking
+ * the terminal event for a successful empty response.
+ */
+export declare class ProviderResponseError extends Error {
+    readonly isProviderResponseError = true;
+    readonly status?: number;
+    readonly errorType?: string;
+    readonly retryAfterMs?: number;
+    constructor(message: string, options?: {
+        status?: number;
+        errorType?: string;
+        retryAfterMs?: number;
+        cause?: unknown;
+    });
+}
+export declare function isProviderResponseError(error: unknown): error is ProviderResponseError;
 /**
  * How a provider transport should treat HTTP 429 responses.
  *

package/dist/network/errors.js

@@ -22,3 +22,27 @@ export function isRateLimitError(error) {
         && typeof error === "object"
         && error.isRateLimitError === true;
 }
+/**
+ * A provider accepted the HTTP request but terminated generation with an
+ * in-band protocol error (for example OpenRouter's HTTP-200 SSE error chunk).
+ * Keeping the wire status/type structured prevents the agent from mistaking
+ * the terminal event for a successful empty response.
+ */
+export class ProviderResponseError extends Error {
+    isProviderResponseError = true;
+    status;
+    errorType;
+    retryAfterMs;
+    constructor(message, options = {}) {
+        super(message, options.cause !== undefined ? { cause: options.cause } : undefined);
+        this.name = "ProviderResponseError";
+        this.status = options.status;
+        this.errorType = options.errorType;
+        this.retryAfterMs = options.retryAfterMs;
+    }
+}
+export function isProviderResponseError(error) {
+    return !!error
+        && typeof error === "object"
+        && error.isProviderResponseError === true;
+}

package/dist/network/provider-transport.d.ts

@@ -8,10 +8,6 @@ export interface ProviderFetchOptions {
 }
 type RequestInitWithProviderOptions = RequestInit & {
     dispatcher?: Dispatcher;
-    proxy?: string;
-    tls?: {
-        ca?: unknown[];
-    };
     verbose?: boolean;
 };
 export declare function providerFetch(input: RequestInfo | URL, init: RequestInit | undefined, options: ProviderFetchOptions): Promise<Response>;

package/dist/network/provider-transport.js

@@ -28,8 +28,6 @@ export function createProviderFetch(options) {
     };
 }
 export function createProviderDispatcher(env = process.env, input, providerName = "provider") {
-    if (isBunRuntime())
-        return undefined;
     const ca = loadExtraCaCertificates(env, providerName);
     const proxy = input ? nodeProxyForUrl(input, env) : defaultNodeProxy(env);
     if (!proxy && ca.length === 0)
@@ -47,19 +45,9 @@ export function withProviderNetworkOptions(input, init, options = {}) {
     const env = options.env ?? process.env;
     const providerName = options.providerName ?? "provider";
     const next = { ...(init ?? {}) };
-    if (isBunRuntime()) {
-        const proxy = bunProxyForUrl(input, env);
-        if (proxy)
-            next.proxy = proxy;
-        const ca = bunExtraCaFiles(env);
-        if (ca.length > 0)
-            next.tls = { ...(next.tls ?? {}), ca };
-    }
-    else {
-        const dispatcher = createProviderDispatcher(env, input, providerName);
-        if (dispatcher)
-            next.dispatcher = dispatcher;
-    }
+    const dispatcher = createProviderDispatcher(env, input, providerName);
+    if (dispatcher)
+        next.dispatcher = dispatcher;
     if (shouldEnableFetchVerbose(env, options.verboseEnvVar)) {
         next.verbose = true;
     }
@@ -129,20 +117,6 @@ function hasProxyEnv(env) {
 function hasCustomCaEnv(env) {
     return Boolean(env.NODE_EXTRA_CA_CERTS?.trim() || env.BUBBLE_EXTRA_CA_CERTS?.trim());
 }
-function isBunRuntime() {
-    return typeof globalThis.Bun !== "undefined";
-}
-function bunProxyForUrl(input, env) {
-    const url = urlFromInput(input);
-    if (!url || shouldBypassProxy(url, env))
-        return undefined;
-    const allProxy = env.ALL_PROXY ?? env.all_proxy;
-    if (url.protocol === "https:")
-        return env.HTTPS_PROXY ?? env.https_proxy ?? allProxy ?? getSystemProxyForUrl(url, env);
-    if (url.protocol === "http:")
-        return env.HTTP_PROXY ?? env.http_proxy ?? allProxy ?? getSystemProxyForUrl(url, env);
-    return undefined;
-}
 function nodeProxyForUrl(input, env) {
     const url = urlFromInput(input);
     if (!url || shouldBypassProxy(url, env))
@@ -157,12 +131,6 @@ function defaultNodeProxy(env) {
     return env.HTTPS_PROXY ?? env.https_proxy ?? env.HTTP_PROXY ?? env.http_proxy ?? env.ALL_PROXY ?? env.all_proxy
         ?? getSystemProxyForUrl(new URL("https://system-proxy-default.invalid/"), env);
 }
-function bunExtraCaFiles(env) {
-    const bun = globalThis.Bun;
-    if (!bun?.file)
-        return [];
-    return extraCaCertificatePaths(env).map((path) => bun.file(path));
-}
 function urlFromInput(input) {
     if (input instanceof URL)
         return input;

package/dist/network/retry.d.ts

@@ -10,11 +10,16 @@
 export declare const MAX_STREAM_INTERRUPTION_RETRIES = 2;
 export declare class ProviderStreamInterruptedError extends Error {
     readonly isProviderStreamInterruption = true;
+    readonly retryAfterMs?: number;
+    readonly maxRetries?: number;
     constructor(message: string, options?: {
         cause?: unknown;
+        retryAfterMs?: number;
+        maxRetries?: number;
     });
 }
-export declare function isProviderStreamInterruption(error: unknown): boolean;
+export declare function isProviderStreamInterruption(error: unknown): error is ProviderStreamInterruptedError;
+export declare function providerStreamRetryLimit(error: ProviderStreamInterruptedError): number;
 export declare function getProviderMaxRetries(env?: NodeJS.ProcessEnv): number;
 export declare function isRetryableHttpStatus(status: number): boolean;
 /**

package/dist/network/retry.js

@@ -16,9 +16,13 @@ export const MAX_STREAM_INTERRUPTION_RETRIES = 2;
 const RETRYABLE_HTTP_STATUSES = new Set([408, 429, 500, 502, 503, 504, 529]);
 export class ProviderStreamInterruptedError extends Error {
     isProviderStreamInterruption = true;
+    retryAfterMs;
+    maxRetries;
     constructor(message, options) {
         super(message, options);
         this.name = "ProviderStreamInterruptedError";
+        this.retryAfterMs = options?.retryAfterMs;
+        this.maxRetries = options?.maxRetries;
     }
 }
 export function isProviderStreamInterruption(error) {
@@ -26,6 +30,11 @@ export function isProviderStreamInterruption(error) {
         && typeof error === "object"
         && error.isProviderStreamInterruption === true;
 }
+export function providerStreamRetryLimit(error) {
+    if (error.maxRetries === undefined)
+        return MAX_STREAM_INTERRUPTION_RETRIES;
+    return Math.max(0, Math.min(MAX_CONFIGURABLE_RETRIES, Math.floor(error.maxRetries)));
+}
 export function getProviderMaxRetries(env = process.env) {
     const raw = env.BUBBLE_PROVIDER_MAX_RETRIES?.trim();
     if (!raw)

package/dist/provider-model-policy.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Stable provider-level model constraints.
+ *
+ * Catalog discovery describes what a provider currently lists; it is not a
+ * runtime security boundary. A fixed policy is different: Bubble deliberately
+ * exposes and permits exactly one model for that provider, across every host
+ * and caller (TUI, CLI, SDK, Feishu, parent agents, and subagents).
+ */
+export declare const OPENROUTER_MODEL_ID = "stealth/ox-alpha";
+export declare function getFixedProviderModelId(providerId: string): string | undefined;
+export declare function isProviderModelAllowed(providerId: string, modelId: string): boolean;
+export declare function providerModelPolicyError(providerId: string, modelId: string): string | undefined;
+export declare function assertProviderModelAllowed(providerId: string, modelId: string): void;
+export declare function filterProviderModels<T extends {
+    id: string;
+}>(providerId: string, models: readonly T[]): T[];

package/dist/provider-model-policy.js

@@ -0,0 +1,33 @@
+/**
+ * Stable provider-level model constraints.
+ *
+ * Catalog discovery describes what a provider currently lists; it is not a
+ * runtime security boundary. A fixed policy is different: Bubble deliberately
+ * exposes and permits exactly one model for that provider, across every host
+ * and caller (TUI, CLI, SDK, Feishu, parent agents, and subagents).
+ */
+export const OPENROUTER_MODEL_ID = "stealth/ox-alpha";
+const FIXED_PROVIDER_MODELS = {
+    openrouter: OPENROUTER_MODEL_ID,
+};
+export function getFixedProviderModelId(providerId) {
+    return FIXED_PROVIDER_MODELS[providerId.toLowerCase()];
+}
+export function isProviderModelAllowed(providerId, modelId) {
+    const fixedModelId = getFixedProviderModelId(providerId);
+    return !fixedModelId || modelId === fixedModelId;
+}
+export function providerModelPolicyError(providerId, modelId) {
+    const fixedModelId = getFixedProviderModelId(providerId);
+    if (!fixedModelId || modelId === fixedModelId)
+        return undefined;
+    return `Provider "${providerId}" is fixed to model "${fixedModelId}"; received "${modelId}".`;
+}
+export function assertProviderModelAllowed(providerId, modelId) {
+    const error = providerModelPolicyError(providerId, modelId);
+    if (error)
+        throw new Error(error);
+}
+export function filterProviderModels(providerId, models) {
+    return models.filter((model) => isProviderModelAllowed(providerId, model.id));
+}

package/dist/provider-registry.d.ts

@@ -10,7 +10,7 @@ import { ModelConfig } from "./model-config.js";
 import { AuthStorage } from "./oauth/index.js";
 import { type OpenAICodexAuthAdapter } from "./provider-openai-codex.js";
 import { type GrokAuthAdapter } from "./provider-grok.js";
-import type { ThinkingLevel } from "./types.js";
+import { type ThinkingLevel } from "./types.js";
 export interface ProviderProfile {
     id: string;
     name: string;

package/dist/provider-registry.js

@@ -16,6 +16,8 @@ import { extractChatGptAccountId, fetchOpenAICodexModelCatalog } from "./provide
 import { fetchGrokSubscriptionModels } from "./provider-grok.js";
 import { refreshOpenAICodex } from "./oauth/openai-codex.js";
 import { refreshGrok } from "./oauth/grok.js";
+import { THINKING_LEVELS } from "./types.js";
+import { filterProviderModels, OPENROUTER_MODEL_ID, } from "./provider-model-policy.js";
 /** True for providers speaking the OpenAI chat-completions protocol (the default). */
 export function isOpenAICompatibleProtocol(protocol) {
     return protocol === undefined || protocol === "openai-chat";
@@ -67,9 +69,56 @@ const MODEL_DISCOVERY_FAILURE_TTL_MS = 10_000;
 const MODEL_DISCOVERY_DISK_TTL_MS = 24 * 60 * 60 * 1000;
 /** Discovery must never delay startup or a model picker for long. */
 const MODEL_DISCOVERY_TIMEOUT_MS = 5_000;
+// Included in the cache identity so a pre-single-model OpenRouter disk cache
+// can never repopulate the picker with the old full remote catalog.
+const OPENROUTER_CATALOG_SCOPE = "ox-alpha-only-v2";
+const OPENROUTER_WIRE_EFFORTS = new Map([
+    ["none", "off"],
+    ["minimal", "minimal"],
+    ["low", "low"],
+    ["medium", "medium"],
+    ["high", "high"],
+    ["xhigh", "xhigh"],
+    ["max", "max"],
+]);
+function openRouterReasoningMetadata(value, fallback) {
+    const fallbackMetadata = {
+        reasoningLevels: fallback.reasoningLevels,
+        defaultReasoningLevel: fallback.defaultReasoningLevel,
+    };
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return fallbackMetadata;
+    const raw = value;
+    if (!Array.isArray(raw.supported_efforts))
+        return fallbackMetadata;
+    const declared = new Set();
+    for (const effort of raw.supported_efforts) {
+        if (typeof effort !== "string")
+            continue;
+        const mapped = OPENROUTER_WIRE_EFFORTS.get(effort);
+        if (mapped)
+            declared.add(mapped);
+    }
+    if (raw.mandatory === true)
+        declared.delete("off");
+    const reasoningLevels = THINKING_LEVELS.filter((level) => declared.has(level));
+    if (reasoningLevels.length === 0)
+        return fallbackMetadata;
+    const rawDefault = typeof raw.default_effort === "string"
+        ? OPENROUTER_WIRE_EFFORTS.get(raw.default_effort)
+        : undefined;
+    const defaultReasoningLevel = rawDefault && reasoningLevels.includes(rawDefault)
+        ? rawDefault
+        : fallback.defaultReasoningLevel && reasoningLevels.includes(fallback.defaultReasoningLevel)
+            ? fallback.defaultReasoningLevel
+            : reasoningLevels.includes("medium")
+                ? "medium"
+                : reasoningLevels[0];
+    return { reasoningLevels, defaultReasoningLevel };
+}
 export const BUILTIN_PROVIDERS = CATALOG_PROVIDERS;
 export const USER_VISIBLE_PROVIDER_IDS = BUILTIN_PROVIDERS
-    .filter((provider) => !provider.hidden && provider.id !== "openrouter" && provider.id !== "openai-codex")
+    .filter((provider) => !provider.hidden && provider.id !== "openai-codex")
     .map((provider) => provider.id);
 export function isUserVisibleProvider(providerId) {
     return USER_VISIBLE_PROVIDER_IDS.includes(providerId);
@@ -289,7 +338,7 @@ export class ProviderRegistry {
         };
     }
     getDefaultModel(providerId, authType = "api") {
-        const customModels = this.modelConfig.getCustomModels(providerId);
+        const customModels = filterProviderModels(providerId, this.modelConfig.getCustomModels(providerId));
         if (customModels.length > 0) {
             return customModels[0].id;
         }
@@ -533,22 +582,34 @@ export class ProviderRegistry {
         return pending;
     }
     async performModelDiscovery(provider) {
-        const customModels = this.modelConfig.getCustomModels(provider.id);
+        const customModels = filterProviderModels(provider.id, this.modelConfig.getCustomModels(provider.id));
         if (customModels.length > 0) {
             return { models: customModels, source: "static", authoritative: true };
         }
         if (provider.id === "openrouter") {
             try {
-                const response = await fetch("https://openrouter.ai/api/v1/models");
+                const response = await fetch("https://openrouter.ai/api/v1/models", {
+                    signal: AbortSignal.timeout(MODEL_DISCOVERY_TIMEOUT_MS),
+                });
                 if (!response.ok)
                     throw new Error(`HTTP ${response.status}`);
                 const data = (await response.json());
+                const local = this.localModelsForProvider(provider);
+                const fallback = local.find((model) => model.id === OPENROUTER_MODEL_ID);
+                const remote = (data.data ?? []).find((model) => model?.id === OPENROUTER_MODEL_ID);
+                if (!remote || !fallback) {
+                    return { models: local, source: "static", authoritative: true };
+                }
+                const reasoning = openRouterReasoningMetadata(remote.reasoning, fallback);
                 return {
-                    models: (data.data ?? []).map((model) => ({
-                        id: model.id,
-                        name: model.name || model.id,
-                        providerId: provider.id,
-                    })),
+                    models: [{
+                            ...fallback,
+                            name: typeof remote.name === "string" && remote.name.trim() ? remote.name : fallback.name,
+                            ...reasoning,
+                            contextWindow: typeof remote.context_length === "number" && remote.context_length > 0
+                                ? remote.context_length
+                                : fallback.contextWindow,
+                        }],
                     source: "remote",
                     authoritative: true,
                 };
@@ -719,7 +780,7 @@ export class ProviderRegistry {
         };
     }
     localModelsForProvider(provider) {
-        const customModels = this.modelConfig.getCustomModels(provider.id);
+        const customModels = filterProviderModels(provider.id, this.modelConfig.getCustomModels(provider.id));
         if (customModels.length > 0)
             return customModels;
         const catalogProviderId = provider.id === "openai" && provider.authType === "oauth"
@@ -732,6 +793,7 @@ export class ProviderRegistry {
             reasoningLevels: model.reasoningLevels,
             defaultReasoningLevel: model.defaultReasoningLevel,
             contextWindow: model.contextWindow,
+            tier: model.tier,
             useResponsesLite: model.useResponsesLite,
             toolOutputTokenLimit: model.toolOutputTokenLimit,
         }));
@@ -755,6 +817,7 @@ export class ProviderRegistry {
             provider.authType ?? "api",
             provider.protocol ?? "default",
             this.discoveryIdentity(provider),
+            provider.id === "openrouter" ? OPENROUTER_CATALOG_SCOPE : undefined,
         ]);
     }
     /**