@ebony-vinyl/dsh-our-free-model 2.7.4 → 2.8.2

package/src/aggregate.js

@@ -530,33 +530,73 @@ export async function postAggregateStreamed({ config, providerId, modelId, body,
   }
   const bodyText = typeof outbound === 'string' ? outbound
     : JSON.stringify({ ...outbound, ...(model === '' ? {} : { model }), stream: true })
+  return postCompatibleStreamed({
+    url: resolved.chatUrl,
+    headers: {
+      ...resolved.headers,
+      // The provider's gateway either ignores this or uses it to keep this
+      // conversation's state separate from concurrent ones on the same key —
+      // the free lane's session dimension, without its fingerprint family.
+      ...(text(session) === '' ? {} : { 'x-session-id': text(session) }),
+    },
+    body: bodyText,
+    model,
+    wire: resolved.wire,
+    signal,
+    onData,
+    timeoutMs,
+    secret: resolved.apiKey,
+    label: resolved.provider.name,
+  })
+}
+
+/**
+ * POST one streaming completion to a resolved endpoint and push raw SSE `data:`
+ * payloads to `onData`.
+ *
+ * The lane-neutral core `postAggregateStreamed` shares with the extension
+ * channels: the URL, headers, body and wire are already decided by the caller
+ * (the aggregate resolver, or an extension's `prepareChat`); this layer owns
+ * the transport discipline — body-shape sniffing, head replay, the idle
+ * deadline, the JSON-answer fold into the row's wire's frame sequence — and
+ * the credential scrubbing (`secret`) on every refusal message.
+ *
+ * @param {object} options
+ * @param {string} options.url - absolute endpoint
+ * @param {Record<string, string>} options.headers - complete header set
+ * @param {string} options.body - serialized request body (`stream: true` included)
+ * @param {string} [options.model] - the bare outbound model id, labelling synthesised frames
+ * @param {'chat'|'messages'|'responses'} [options.wire='chat']
+ * @param {AbortSignal} [options.signal]
+ * @param {(payload: string) => void} options.onData
+ * @param {number} [options.timeoutMs]
+ * @param {string} [options.secret] - the credential scrubbed from refusal text
+ * @param {string} [options.label] - the lane name in error messages
+ */
+export async function postCompatibleStreamed({ url, headers, body, model = '', wire = 'chat', signal, onData, timeoutMs = TURN_TIMEOUT_MS, secret = '', label = 'the provider' }) {
   let response
   try {
-    response = await egressFetch(resolved.chatUrl, {
+    response = await egressFetch(url, {
       method: 'POST',
       headers: {
-        ...resolved.headers,
+        ...headers,
         accept: 'text/event-stream',
-        // The provider's gateway either ignores this or uses it to keep this
-        // conversation's state separate from concurrent ones on the same key —
-        // the free lane's session dimension, without its fingerprint family.
-        ...(text(session) === '' ? {} : { 'x-session-id': text(session) }),
       },
-      body: bodyText,
+      body,
       redirect: 'error',
       signal,
     })
   } catch (error) {
     if (signal?.aborted === true || error?.name === 'AbortError') throw new UpstreamError('request aborted', CODE.aborted)
     throw new UpstreamError(
-      `model request to ${resolved.provider.name} failed: ${redact(error?.message ?? error, resolved.apiKey)}${transportCause(error)}`,
+      `model request to ${label} failed: ${redact(error?.message ?? error, secret)}${transportCause(error)}`,
       CODE.transport)
   }
 
   const setRetry = retryAfterMs(response)
   if (!response.ok) {
     const refusal = await response.text().catch(() => '')
-    throw classifyUpstream(response.status, refusal, setRetry, resolved.apiKey)
+    throw classifyUpstream(response.status, refusal, setRetry, secret)
   }
   if (response.body === null) throw new UpstreamError('model stream returned no body', CODE.empty)
 
@@ -588,7 +628,7 @@ export async function postAggregateStreamed({ config, providerId, modelId, body,
   rawText += head.decoder.decode()
   let payload
   try {
-    payload = JSON.parse(redact(rawText, resolved.apiKey))
+    payload = JSON.parse(redact(rawText, secret))
   } catch {
     // A 200 body that is not JSON is a hop speaking for the provider. Markup is
     // a front proxy (a WAF page, a CDN error), and replaying the identical body
@@ -598,12 +638,12 @@ export async function postAggregateStreamed({ config, providerId, modelId, body,
         `the provider's front proxy answered HTTP ${response.status} with an HTML error page`,
         CODE.client, { status: response.status })
     }
-    throw new UpstreamError(`unexpected non-stream response: ${redact(rawText, resolved.apiKey).slice(0, 200)}`, CODE.server, { status: response.status })
+    throw new UpstreamError(`unexpected non-stream response: ${redact(rawText, secret).slice(0, 200)}`, CODE.server, { status: response.status })
   }
   if (payload?.error !== undefined || payload?.type === 'error') {
-    throw classifyUpstream(response.status, rawText, setRetry, resolved.apiKey)
+    throw classifyUpstream(response.status, rawText, setRetry, secret)
   }
-  for (const frame of synthesisedFrames(resolved.wire, payload, model)) onData(frame)
+  for (const frame of synthesisedFrames(wire, payload, model)) onData(frame)
   return { status: response.status }
 }
 

package/src/bun-fetch.js

@@ -1,15 +1,17 @@
-import { accessSync, constants, statSync, writeFileSync, mkdtempSync } from 'node:fs';
+import { accessSync, constants, existsSync, mkdirSync, statSync, writeFileSync, mkdtempSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
 import { delimiter, join, resolve } from 'node:path';
 import { spawn } from 'node:child_process';
 import { PassThrough, Readable } from 'node:stream';
+import { DATA_DIR_NAME, resolveDshHome } from './store.js';
 
 /**
  * The worker source, inlined so the published package stays inside the
  * historical updater's 80-file ceiling (adding a second file overran it).
- * It is written once to a private temporary directory and reused for the
- * process lifetime. It speaks one JSON line on stdin and returns one metadata
- * line plus raw response bytes on stdout; no request content is evaluated.
+ * It is written once to the plugin data directory and reused for the process
+ * lifetime, re-created when an external sweep deletes it. It speaks one JSON
+ * line on stdin and returns one metadata line plus raw response bytes on
+ * stdout; no request content is evaluated.
  */
 const WORKER_SOURCE = `import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
@@ -37,13 +39,34 @@ try {
 
 let workerPath;
 
-/** Materialize the inlined worker once; never executes request content. */
+/**
+ * Materialize the inlined worker; never executes request content.
+ *
+ * The file lives under the plugin's own data directory rather than the OS temp
+ * directory, and its existence is re-checked on every call. Both details are
+ * load-bearing: the path used to be memoized into `tmpdir()`, so a temp sweep
+ * that deleted `ofm-bun-worker-*` left every later request in that process
+ * failing with `Bun worker failed before completing the response` — bun exits 1
+ * on a missing entry script, before it can reach the network — until the whole
+ * plugin was restarted. Re-materializing a missing file makes the sweep
+ * self-healing, and an unwritable home still falls back to temp so the lane
+ * degrades to the previous behavior rather than failing to start.
+ */
 export function bunWorkerPath() {
-  if (workerPath !== undefined) return workerPath;
-  const dir = mkdtempSync(join(tmpdir(), 'ofm-bun-worker-'));
-  const file = join(dir, 'worker.mjs');
-  writeFileSync(file, WORKER_SOURCE, { mode: 0o600 });
-  workerPath = file;
+  if (workerPath !== undefined && existsSync(workerPath)) return workerPath;
+  try {
+    const dir = join(resolveDshHome(), DATA_DIR_NAME, 'run');
+    mkdirSync(dir, { recursive: true });
+    const file = join(dir, 'worker.mjs');
+    writeFileSync(file, WORKER_SOURCE, { mode: 0o600 });
+    workerPath = file;
+  } catch {
+    // mkdir may succeed for an existing directory even when writing the worker
+    // fails. Both operations must be covered by the fallback.
+    const dir = mkdtempSync(join(tmpdir(), 'ofm-bun-worker-'));
+    workerPath = join(dir, 'worker.mjs');
+    writeFileSync(workerPath, WORKER_SOURCE, { mode: 0o600 });
+  }
   return workerPath;
 }
 

package/src/catalog.js

@@ -17,8 +17,11 @@ import { baseModelId, isResponsesModel } from './upstream.js'
 /** Free-tier ids the listing does not mark with a `-free` suffix. `big-pickle`
  *  is the lane's own long-standing free id (9router keeps the same id in its
  *  `KNOWN_FREE_OPENCODE_MODELS` for exactly this reason); models.dev prices it
- *  at 0/0. */
-const ALWAYS_FREE = new Set(['union-alpha', 'space-bunny-free', 'big-pickle'])
+ *  at 0/0. `union-alpha` (the lane's Messages-wire id) and `space-bunny-free`
+ *  retired from the live listing in the 2026-10-31 churn and are no longer
+ *  advertised — they stay classified here so a listing that revives them is
+ *  still served, and so the wire tests keep an honest Messages vehicle. */
+const ALWAYS_FREE = new Set(['big-pickle', 'union-alpha', 'space-bunny-free'])
 
 /**
  * Local capability baseline. `contextWindow`/`maxOutput` are the provider's
@@ -126,12 +129,36 @@ const FREE_ID_OVERRIDES = {
     effortPatch: { reasoning_effort: '$effort' },
     effortOffPatch: { reasoning_effort: 'none' },
   },
-  // models.dev: effort low|medium|high|xhigh|max; 1M window, 524288 output.
-  'space-bunny-free': {
-    vision: true, contextWindow: 1048576, maxOutput: 524288,
+  // models.dev (2026-11-06 roster): the live free set as the Oct-31 churn left
+  // it. Numbers are models.dev's published limits; region-gated ids (beam,
+  // crouton, pulse) are marked in REGION_SENSITIVE, not here.
+  'beam-free': {
+    vision: false, contextWindow: 1048576, maxOutput: 131072,
     efforts: ['low', 'medium', 'high', 'xhigh', 'max'], effortDefault: 'high',
     effortPatch: { reasoning_effort: '$effort' },
   },
+  'flint-40b-free': {
+    vision: false, contextWindow: 262144, maxOutput: 65536,
+    efforts: ['low', 'medium', 'high', 'xhigh', 'max'], effortDefault: 'high',
+    effortPatch: { reasoning_effort: '$effort' },
+  },
+  'pulse-alpha-free': {
+    vision: true, contextWindow: 1048576, maxOutput: 131072,
+    efforts: ['low', 'high', 'max'], effortDefault: 'high',
+    effortPatch: { reasoning_effort: '$effort' },
+  },
+  // models.dev: 1M window, 270000 output, effort minimal..max (no `none` —
+  // thinking does not switch off in practice, so the menu starts at minimal).
+  'crouton-alpha-free': {
+    vision: true, contextWindow: 1048576, maxOutput: 262144,
+    efforts: ['minimal', 'low', 'medium', 'high', 'xhigh', 'max'], effortDefault: 'high',
+    effortPatch: { reasoning_effort: '$effort' },
+  },
+  // models.dev: 262144/262144, reasoning_options empty → no level menu, so the
+  // free lane's token ladder applies.
+  'nemotron-3.5-lightning-free': {
+    vision: false, contextWindow: 262144, maxOutput: 262144,
+  },
   // models.dev: 1M window, 131072 output, reasoning_options `toggle` only →
   // no level menu, so the free lane's token ladder applies.
   'longcat-2.5-preview-free': {
@@ -145,22 +172,19 @@ const FREE_ID_OVERRIDES = {
 /** Human-facing display names, so a raw upstream id never reaches the picker. */
 const DISPLAY_NAMES = {
   'mimo-v2.6-flash-free': 'MiMo V2.6 Flash',
-  'mimo-v2.5-free': 'MiMo V2.5',
-  'muse-spark-1.3-contributor-free': 'Muse Spark 1.3',
-  'muse-spark-1.2-contributor-free': 'Muse Spark 1.2',
-  'nemotron-3-ultra-free': 'Nemotron 3 Ultra',
+  'beam-free': 'Beam Free',
+  'flint-40b-free': 'Flint 40B Free',
+  'pulse-alpha-free': 'Pulse Alpha Free',
+  'crouton-alpha-free': 'Crouton Alpha Free',
   'nemotron-3.5-lightning-free': 'Nemotron 3.5 Lightning',
-  'ling-3.0-flash-fin-free': 'Ling 3.0 Flash Fin',
-  'space-bunny-free': 'Space Bunny',
-  'union-alpha': 'Union Alpha',
-  'deepseek-v4-flash-free': 'DeepSeek V4 Flash',
   'deepseek-v4.1-flash-free': 'DeepSeek V4.1 Flash',
   'glm-5.3-flash-free': 'GLM 5.3 Flash',
-  'jev-1.13-free': 'Jev 1.13',
 }
 
-/** Ids whose regional availability is known to be egress-dependent. */
-const REGION_SENSITIVE = [/^muse.?spark/]
+/** Ids whose regional availability is known to be egress-dependent. The 2.2
+ * docs name Beam Free, Crouton Alpha Free and Pulse Alpha Free as region-gated;
+ * `muse-spark` kept its marker from the era it served. */
+const REGION_SENSITIVE = [/^muse.?spark/, /^beam/, /crouton/, /pulse-alpha/]
 
 /**
  * Is this id on the免密 lane? The gateway's listing mixes paid and free ids;
@@ -273,66 +297,101 @@ export const EAC_TAG = 'EAC'
 
 const EAC_DISPLAY_NAMES = {
   // The OpenCode free lane is relayed server-side; the org prefix is routing
-  // detail, so the picker shows the model's own name with the lane's Free mark.
-  'opencode/deepseek-v4.1-flash-free': 'deepseek-v4.1-flash-free 1017',
-  'opencode/glm-5.3-flash-free': 'GLM 5.3 Flash Free',
+  // detail, so the picker shows the model's own name with the lane's mark.
+  'opencode/deepseek-v4.1-flash-free': 'DeepSeek V4.1 Flash Highspeed',
+  'opencode/glm-5.3-flash-free': 'GLM 5.3 Flash Highspeed',
   'deepseek-ai/deepseek-v4.1-flash': 'DeepSeek V4.1 Flash',
   'moonshotai/kimi-k2.6': 'Kimi K2.6',
   'moonshotai/kimi-k3': 'Kimi K3',
   'openai/gpt-oss-20b': 'GPT-OSS 20B',
   'z-ai/glm-5.3': 'GLM 5.3',
   'z-ai/glm-5.3-flash': 'GLM 5.3 Flash',
+  'mistralai/mistral-large-4-1t-a52b': 'Mistral Large 4 1T A52B',
 }
 
 /**
- * Capacities per model: published specs cross-checked against this lane where
- * the relay allowed a probe (2026-10-03), and the thinking-level menu copied
- * from ZCode's built-in provider config (`config/provider/zcode-builtin.json`,
- * the `modelRules`/`modelApiRules`/`providerSiteRules` buckets) — the same
- * per-model declaration shape that product ships: a list of levels plus a
- * JSON merge patch the level maps onto the request body. `vision` records what
- * the relay actually accepted under a direct image-input probe — DeepSeek V4.1
- * Flash and GLM 5.3 Flash answered a 1×1 image with its colour; the Kimi
- * models carry native vision encoders per their model cards but the relay's
- * kimi routes were down during the probe, so their flag follows the published
- * spec. These numbers bound the client-side truncation estimates and the sent
- * max_tokens; the relay enforces its own ceilings on the wire.
+ * Capacities per model, read from NVIDIA's own model pages
+ * (`build.nvidia.com/<org>/<model>`, fetched 2026-10-31) — the platform that
+ * actually serves these ids through the co-paid lane's NVIDIA Build channel.
+ *
+ * Each page embeds its request schema and its `specifications` block; those are
+ * the figures below, not a guess:
+ *
+ * - `mistralai/mistral-large-4-1t-a52b`: `contextLength` 262144, `parameters`
+ *   1050B, `inputModalities` Text+Image, `reasoning: true`. Its schema declares
+ *   `reasoning_effort` as `enum: ["none","high"]`, default `"high"`, and states
+ *   that an omitted field is served as `none` — so its menu is exactly Off and
+ *   High, with High as the default. The wire accepted `medium` too, but a value
+ *   the published schema does not list is not offered.
+ * - `deepseek-ai/deepseek-v4.1-flash`: `contextLength` 1048576, `parameters`
+ *   552B, `inputModalities` Text+Image, `reasoning: true`.
+ * - `z-ai/glm-5.3-flash`: served on the same NVIDIA Build platform; its page
+ *   carries no embedded spec block (a client-rendered page), so its window and
+ *   output follow the same NVIDIA Build schema family as the two above, and its
+ *   menu is the shared `reasoning_effort` enum.
  *
- * `efforts`/`effortDefault`/`effortPatch` mirror ZCode's declaration for the
- * model families it names; `effortPatch` uses `$effort` as the selected
- * level's placeholder, and `effortOffPatch` (when present) replaces the patch
- * for the off level. Models ZCode does not declare (kimi-k2.6, gpt-oss-20b)
- * fall back to the family-standard `reasoning_effort` field.
+ * NVIDIA Build's chat schema validates `reasoning_effort` against
+ * `none|minimal|low|medium|high|xhigh|max` — a value outside that set answers
+ * 400 naming the accepted list. A model's menu here is the intersection of that
+ * enum with what the model's own page declares, so every rung is one the
+ * platform accepts; a model whose page declares only `none|high` gets exactly
+ * those two rather than a generic ladder.
+ *
+ * `vision` follows `inputModalities` on each page. `maxOutput` is not published
+ * per model there, so it is the platform's chat ceiling for these recipes, and
+ * the relay still enforces its own limit on the wire.
  */
 const EAC_CAPABILITIES = [
-  // The OpenCode free lane. models.dev declares reasoning_options
-  // [{type:"effort", values:["low","high","max"]}] for both ids, and the upstream
-  // answers on its OpenAI wire, so the selected level rides `reasoning_effort`
-  // verbatim. `disabled` maps to the upstream's own off value ("none"), which
-  // zeroes the reasoning tokens — a level that is enforced, not a hint.
-  // Capacities are the underlying model's own, not the free listing's rounded
-  // floor: both are the same model the canonical entries below describe, so the
-  // numbers are copied from them (1M window; 384K / 131K output) and were
-  // re-checked against the upstream, which accepts max_tokens up to 384000.
+  // NVIDIA Build — the ids the co-paid lane relays from integrate.api.nvidia.com.
+  {
+    match: /^mistralai\/mistral-large-4-1t-a52b/,
+    vision: true, reasoning: true, contextWindow: 262144, maxOutput: 32768,
+    efforts: ['disabled', 'high'], effortDefault: 'high',
+    effortPatch: { reasoning_effort: '$effort' },
+    effortOffPatch: { reasoning_effort: 'none' },
+  },
+  {
+    match: /^deepseek-ai\/deepseek-v4\.1-flash/,
+    vision: true, reasoning: true, contextWindow: 1048576, maxOutput: 32768,
+    efforts: ['disabled', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'], effortDefault: 'high',
+    effortPatch: { reasoning_effort: '$effort' },
+    effortOffPatch: { reasoning_effort: 'none' },
+  },
+  {
+    match: /^z-ai\/glm-5\.3-flash/,
+    vision: true, reasoning: true, contextWindow: 1048576, maxOutput: 32768,
+    efforts: ['disabled', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'], effortDefault: 'high',
+    effortPatch: { reasoning_effort: '$effort' },
+    effortOffPatch: { reasoning_effort: 'none' },
+  },
+  // The OpenCode lane's two ids, relayed through the highspeed NVIDIA Build
+  // channel. The model is the same one the NVIDIA entries above describe, so
+  // its window and its menu are theirs: the shared `reasoning_effort` enum
+  // NVIDIA Build validates, with `none` as the off rung. `maxOutput` stays the
+  // free relay's own re-verified ceiling (384000 / 131072) — the relay enforces
+  // its own limit on the wire, which is tighter than NVIDIA's published one.
+  // The upstream id keeps its `-free` suffix (routing detail); the card's label
+  // says highspeed.
   {
     match: /^opencode\/deepseek-v4/,
     vision: true, reasoning: true, contextWindow: 1048576, maxOutput: 384000,
-    efforts: ['disabled', 'low', 'high', 'max'], effortDefault: 'high',
+    efforts: ['disabled', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'], effortDefault: 'high',
     effortPatch: { reasoning_effort: '$effort' },
     effortOffPatch: { reasoning_effort: 'none' },
   },
   {
     match: /^opencode\/glm-5\.3-flash/,
     vision: true, reasoning: true, contextWindow: 1048576, maxOutput: 131072,
-    efforts: ['low', 'high', 'max'], effortDefault: 'high',
+    efforts: ['disabled', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'], effortDefault: 'high',
     effortPatch: { reasoning_effort: '$effort' },
+    effortOffPatch: { reasoning_effort: 'none' },
   },
   {
     match: /^deepseek-ai\/deepseek-v4/,
-    vision: true, reasoning: true, contextWindow: 1048576, maxOutput: 384000,
-    efforts: ['disabled', 'low', 'high', 'max'], effortDefault: 'high',
+    vision: true, reasoning: true, contextWindow: 1048576, maxOutput: 32768,
+    efforts: ['disabled', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'], effortDefault: 'high',
     effortPatch: { reasoning_effort: '$effort' },
-    effortOffPatch: { reasoning: { enabled: false } },
+    effortOffPatch: { reasoning_effort: 'none' },
   },
   {
     match: /^moonshotai\/kimi-k3/,
@@ -346,12 +405,6 @@ const EAC_CAPABILITIES = [
     efforts: ['low', 'high', 'max'], effortDefault: 'high',
     effortPatch: { reasoning_effort: '$effort' },
   },
-  {
-    match: /^z-ai\/glm-5\.3-flash/,
-    vision: true, reasoning: true, contextWindow: 1048576, maxOutput: 131072,
-    efforts: ['low', 'high', 'max'], effortDefault: 'high',
-    effortPatch: { thinking: { type: 'enabled' }, output_config: { effort: '$effort' } },
-  },
   {
     match: /^z-ai\/glm-5/,
     vision: false, reasoning: true, contextWindow: 1048576, maxOutput: 131072,
@@ -375,6 +428,30 @@ const EAC_FEATURED = new Set([
   'opencode/glm-5.3-flash-free',
 ])
 
+/**
+ * Display-only ids for the card's small line.
+ *
+ * The OpenCode lane serves its ids with a `-free` suffix that is upstream
+ * routing detail; this build relays those two models through the highspeed
+ * NVIDIA Build channel, so the line shows the id the channel actually names
+ * (`deepseek-v4.1-flash-free 1017` → `deepseek-v4.1-flash-highspeed 1017`).
+ * Only the label moves: the catalog `id` is what the adapter matches, and it
+ * keeps the upstream spelling.
+ */
+const EAC_LABELS = {
+  'opencode/deepseek-v4.1-flash-free': 'deepseek-v4.1-flash-highspeed 1017',
+  'opencode/glm-5.3-flash-free': 'glm-5.3-flash-highspeed',
+}
+
+function eacLabel(modelId) {
+  const known = EAC_LABELS[modelId]
+  if (known !== undefined) return known
+  const bare = modelId.includes('/') ? modelId.slice(modelId.indexOf('/') + 1) : modelId
+  // Any remaining `-free` suffix is the same upstream detail; it is shown as
+  // the channel's highspeed mark rather than leaked into the card.
+  return bare.replace(/(?:^|[-_])free(?:$|[-_.])/, match => match.replace('free', 'highspeed'))
+}
+
 /** `org/model` → the model's own name under the channel tag. */
 export function eacDisplayName(modelId) {
   const base = String(modelId ?? '').trim()
@@ -415,8 +492,11 @@ export function buildEacCatalog(ids) {
       // that is what keeps this row distinct from the free lane's same-named
       // model during the merge — but the prefix is routing detail, so the line
       // shows the model's own id, with a display-only version marker where needed.
-      label: id === 'opencode/deepseek-v4.1-flash-free' ? 'deepseek-v4.1-flash-free 1017'
-        : id.includes('/') ? id.slice(id.indexOf('/') + 1) : id,
+      // The OpenCode lane's two ids are shown as their highspeed ids: the lane
+      // relays them through the highspeed NVIDIA Build channel, and the raw
+      // upstream id keeps its `-free` suffix, which is routing detail the line
+      // must not show. The catalog id is untouched, so routing still matches.
+      label: eacLabel(id),
       channel: EAC_CHANNEL,
       wire: 'chat',
       vision: caps.vision === true,
@@ -610,3 +690,103 @@ export function reviveKiloCatalog(stored) {
 export function isKiloEntry(entry) {
   return entry?.channel === KILO_CHANNEL
 }
+
+// ── the extension lane ─────────────────────────────────────────────────────────
+
+/** Catalog tag for models an installed extension serves. */
+export const EXTENSION_CHANNEL = 'extension'
+
+/** The built-in lanes an extension may take over (`replaces`). Kept in step
+ *  with the marketplace's policy and with the runtime's takeover: only `kilo`
+ *  is actually stood down (`laneStandsDown` in src/core/runtime.js), and the
+ *  marketplace validator refuses any other claim — listing a lane here that
+ *  nothing implements would hand an extension the built-in ids and then lose
+ *  its rows to the built-in they collide with. */
+const REPLACEABLE_LANES = new Set(['kilo'])
+
+/** Wire spellings an extension channel may speak. */
+const EXTENSION_WIRES = new Set(['chat', 'responses', 'messages'])
+
+/**
+ * The catalog id one extension model answers to. Extension models are
+ * namespaced (`ext:<plugin>/<model>`) so a third-party roster can never shadow
+ * a built-in id by accident — unless the extension `replaces` that lane, in
+ * which case its models keep the lane's own ids and the built-in rows stand
+ * down (the kilo-free official extension demonstrates exactly this).
+ */
+export function extensionModelId(manifestId, modelId, replaces) {
+  const clean = String(modelId ?? '').trim()
+  if (replaces !== undefined && REPLACEABLE_LANES.has(replaces)) return clean
+  return `ext:${String(manifestId ?? '').trim()}/${clean}`
+}
+
+/** Is this catalog row served by an installed extension? */
+export function isExtensionEntry(entry) {
+  return entry?.channel === EXTENSION_CHANNEL
+}
+
+/** Normalize one `listModels`/manifest model row into a catalog entry, or null. */
+function extensionEntryOf(manifest, row) {
+  if (row === null || typeof row !== 'object' || Array.isArray(row)) return null
+  const modelId = typeof row.id === 'string' ? row.id.trim() : ''
+  if (modelId === '' || modelId.length > 128) return null
+  const wire = EXTENSION_WIRES.has(row.wire) ? row.wire : 'chat'
+  const contextWindow = number(row.contextWindow) ?? 131072
+  const entry = {
+    id: extensionModelId(manifest.id, modelId, manifest.replaces),
+    name: typeof row.name === 'string' && row.name.trim() !== '' ? row.name.trim() : displayModelName(modelId),
+    channel: EXTENSION_CHANNEL,
+    extensionId: manifest.id,
+    extensionName: typeof manifest.name === 'string' ? manifest.name : manifest.id,
+    modelId,
+    wire,
+    vision: row.vision === true,
+    reasoning: row.reasoning !== false,
+    contextWindow,
+    maxOutput: number(row.maxOutput) ?? Math.min(32768, contextWindow),
+    canDisableThinking: true,
+    regionSensitive: false,
+    source: 'manifest',
+  }
+  if (Array.isArray(row.efforts) && row.efforts.length > 0) {
+    const efforts = row.efforts.filter(level => typeof level === 'string' && level !== '').slice(0, 8)
+    if (efforts.length > 0) {
+      entry.efforts = efforts
+      entry.effortDefault = efforts.includes(row.effortDefault) ? row.effortDefault : efforts[efforts.length - 1]
+      // The declared level rides the wire as the model's own effort field — the
+      // extension names its own spelling via `effortKey` when it is not the
+      // common `reasoning_effort`/`reasoning.effort` shapes.
+      const key = typeof row.effortKey === 'string' && row.effortKey.trim() !== '' ? row.effortKey.trim() : null
+      entry.effortPatch = key !== null ? { [key]: '$effort' } : { reasoning_effort: '$effort' }
+      entry.canDisableThinking = efforts.includes('disabled') || efforts.includes('none')
+    }
+  }
+  return entry
+}
+
+/**
+ * Build the extension lane's catalog rows from one installed channel
+ * extension's model list. Rows that repeat an id are dropped.
+ */
+export function buildExtensionCatalog(manifest, rows) {
+  if (!manifest || typeof manifest !== 'object' || typeof manifest.id !== 'string') return []
+  const seen = new Set()
+  const entries = []
+  for (const row of Array.isArray(rows) ? rows : []) {
+    const entry = extensionEntryOf(manifest, row)
+    if (entry === null || seen.has(entry.id)) continue
+    seen.add(entry.id)
+    entries.push(entry)
+  }
+  return entries
+}
+
+/**
+ * Which built-in lane an enabled extension takes over, or null. Only one
+ * extension may replace a lane; the first enabled claim wins and the rest are
+ * ignored until the conflict is resolved.
+ */
+export function extensionReplaces(manifest) {
+  const replaces = typeof manifest?.replaces === 'string' ? manifest.replaces : ''
+  return REPLACEABLE_LANES.has(replaces) ? replaces : null
+}