@goodandready/dsh-model-sync 0.5.6 → 0.5.8

package/lib/adapter-registry.js

@@ -1,8 +1,6 @@
 import { catalogRequestError } from './reliability.js'
-import { canUseGenericAdapter, createGenericAdapter } from './generic-adapter.js'
+import { canUseGenericAdapter, createGenericAdapter, readBoundedText, MAX_RESPONSE_BYTES } from './generic-adapter.js'
 import { normalizeModels, parseClinePassModels } from './models.js'
-
-const MAX_RESPONSE_BYTES = 4 * 1024 * 1024
 const SAFE_AUTH = new Set(['bearer', 'x-api-key', 'query-key', 'none'])
 const SAFE_PARSERS = new Set(['openai', 'google', 'clinebot-plan'])
 const CAPABILITIES = new Set(['vision', 'tools', 'reasoning', 'embeddings', 'code'])
@@ -214,17 +212,14 @@ async function fetchSpecific(profile, descriptor, options) {
     }
     const respEtag = response.headers?.get?.('etag') || undefined
     const respLastMod = response.headers?.get?.('last-modified') || undefined
-    const declared = Number(response.headers?.get?.('content-length') ?? NaN)
-    if (Number.isFinite(declared) && declared > MAX_RESPONSE_BYTES) {
-      const error = new Error('model catalog response is too large')
-      error.adapterCode = 'schema'
-      throw error
-    }
-    const text = await response.text()
-    if (Buffer.byteLength(text, 'utf8') > MAX_RESPONSE_BYTES) {
-      const error = new Error('model catalog response is too large')
-      error.adapterCode = 'schema'
-      throw error
+    let text
+    try {
+      text = await readBoundedText(response, MAX_RESPONSE_BYTES)
+    } catch (err) {
+      if (err.message === 'model catalog response is too large') {
+        err.adapterCode = 'schema'
+      }
+      throw err
     }
     try { payload = JSON.parse(text) } catch {
       const error = new Error('model catalog response is not valid JSON')

package/lib/alias-resolver.js

@@ -1,9 +1,12 @@
 export const VIRTUAL_STRATEGIES = Object.freeze(['fastest', 'cheapest', 'best-code'])
 
-export function isVirtualAlias(name) {
+export const VIRTUAL_ALIASES = Object.freeze(new Set(['@fast', '@cheap', '@best-code']))
+
+export function isVirtualAlias(name, strategy) {
+  if (strategy && VIRTUAL_STRATEGIES.includes(typeof strategy === 'string' ? strategy.trim() : '')) return true
   if (typeof name !== 'string') return false
   const clean = name.trim().toLowerCase()
-  return clean === '@fast' || clean === '@cheap' || clean === '@best-code' || clean.startsWith('@')
+  return VIRTUAL_ALIASES.has(clean)
 }
 
 export function validateAliasName(name) {
@@ -12,7 +15,7 @@ export function validateAliasName(name) {
   return /^@?[a-zA-Z0-9_\-.]{1,64}$/.test(clean)
 }
 
-function modelScoreForCode(provider, model) {
+function modelScoreForCode(model) {
   let score = 0
   const id = String(model?.id ?? '').toLowerCase()
   const name = String(model?.name ?? '').toLowerCase()
@@ -135,11 +138,22 @@ export function resolveAlias(aliasName, {
     }
 
     if (strategy === 'fastest') {
-      const scored = available.map((item) => ({
-        ...item,
-        latencyMs: estimateLatency(item.provider, item.model, modelProbes),
-      }))
-      scored.sort((a, b) => a.latencyMs - b.latencyMs)
+      const scored = available.map((item) => {
+        const probeKey = `${item.provider}:${item.model.id}`
+        const probe = modelProbes[probeKey]
+        const measured = probe?.latencyMs && Number.isFinite(probe.latencyMs) && probe.ok !== false
+        const latencyMs = measured ? Math.round(probe.latencyMs) : estimateLatency(item.provider, item.model, modelProbes)
+        return {
+          ...item,
+          latencyMs,
+          measured: Boolean(measured),
+        }
+      })
+      scored.sort((a, b) => {
+        if (a.measured && !b.measured) return -1
+        if (!a.measured && b.measured) return 1
+        return a.latencyMs - b.latencyMs
+      })
       const best = scored[0]
       return {
         alias: clean,
@@ -149,7 +163,7 @@ export function resolveAlias(aliasName, {
         name: best.model.name || best.model.id,
         latencyMs: best.latencyMs,
         fallbackUsed: false,
-        reason: 'lowest_latency',
+        reason: best.measured ? 'lowest_latency' : 'estimated_lowest_latency',
       }
     }
 
@@ -194,7 +208,7 @@ export function resolveAlias(aliasName, {
     if (strategy === 'best-code') {
       const scored = available.map((item) => ({
         ...item,
-        score: modelScoreForCode(item.provider, item.model),
+        score: modelScoreForCode(item.model),
       }))
       scored.sort((a, b) => b.score - a.score)
       const best = scored[0]

package/lib/client.js

@@ -25,23 +25,23 @@ window.__ModuleLoader__.load({
       '.dms-card-body{border-top:1px solid var(--dsw-alias-border-l2);margin:0 16px;padding-bottom:8px;display:flex;flex-direction:column;gap:10px;box-sizing:border-box}' +
       '.dms-wrap{display:flex;flex-direction:column;gap:14px;max-width:760px;box-sizing:border-box;color:var(--dsw-alias-label-primary,inherit)}' +
       '.dms-wrap>p{margin:0;color:var(--dsw-alias-label-secondary);font-size:12px;line-height:1.55}' +
-      '.dms-toolbar,.dms-section{display:flex;flex-direction:row;align-items:center;flex-wrap:wrap;gap:10px;padding:13px 14px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent);box-sizing:border-box}' +
+      '.dms-toolbar,.dms-section{display:flex;flex-direction:row;align-items:center;flex-wrap:wrap;gap:10px;padding:13px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent);box-sizing:border-box}' +
       '.dms-toolbar>select{flex:1 1 190px;min-width:190px}' +
       '.dms-toolbar>.dms-actions{flex-basis:100%}' +
       '.dms-toolbar>label{display:inline-flex;align-items:flex-start;gap:7px;font-size:12px;line-height:1.35;color:var(--dsw-alias-label-secondary)}' +
       '.dms-toolbar>select,.dms-editor input,.dms-editor textarea,.dms-input{box-sizing:border-box;min-width:0;background:var(--dsw-specific-input-major,var(--dsw-alias-bg-layer-2,transparent));border:1px solid var(--dsw-alias-border-l1,var(--dsw-alias-border-l2));border-radius:6px;color:var(--dsw-alias-label-primary);font:inherit;padding:7px 9px}' +
       '.dms-toolbar>label input{accent-color:var(--dsw-alias-brand-primary,var(--dsw-alias-button-info-fill))}' +
       '.dms-actions{display:flex;align-items:center;flex-wrap:wrap;gap:7px}' +
-      '.dms-wrap>.dms-actions{padding:10px 14px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent)}' +
-      '.dms-btn{margin:0!important;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:6px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12px;line-height:1.35;padding:6px 10px;cursor:pointer;white-space:normal}' +
+      '.dms-wrap>.dms-actions{padding:10px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent)}' +
+      '.dms-btn{margin:0!important;border:1px solid var(--dsw-alias-border-l2);border-radius:6px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12px;line-height:1.35;padding:6px 10px;cursor:pointer;white-space:normal}' +
       '.dms-btn:hover:not(:disabled){border-color:var(--dsw-alias-brand-primary);background:var(--dsw-alias-bg-layer-2)}' +
       '.dms-btn:disabled{opacity:.45;cursor:default}' +
       '.dms-section>strong{display:block;font-size:13px;font-weight:650}' +
       '.dms-provider-wrap{margin:0 0 7px}' +
-      '.dms-provider{display:grid!important;grid-template-columns:minmax(0,1fr) auto auto;align-items:center;gap:10px;padding:10px 11px;margin:0;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:8px;background:var(--dsw-alias-bg-layer-2,transparent)}' +
+      '.dms-provider{display:grid!important;grid-template-columns:minmax(0,1fr) auto auto;align-items:center;gap:10px;padding:10px 11px;margin:0;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-2,transparent)}' +
       '.dms-provider>span{min-width:0;overflow-wrap:anywhere;line-height:1.4}' +
       '.dms-section>div[style]{padding:8px 0;border-top:1px solid var(--dsw-alias-border-l2)}' +
-      '.dms-editor{display:flex;flex-direction:column;align-items:stretch;gap:10px;padding:13px 14px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent);box-sizing:border-box;border-color:var(--dsw-alias-brand-primary,var(--dsw-alias-border-l2))}' +
+      '.dms-editor{display:flex;flex-direction:column;align-items:stretch;gap:10px;padding:13px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent);box-sizing:border-box;border-color:var(--dsw-alias-brand-primary,var(--dsw-alias-border-l2))}' +
       '.dms-editor strong{font-size:13px}' +
       '.dms-editor label{display:block;gap:5px;margin-top:8px;color:var(--dsw-alias-label-secondary);font-size:12px}' +
       '.dms-editor label input,.dms-editor label textarea{width:100%}' +
@@ -53,10 +53,10 @@ window.__ModuleLoader__.load({
       '.dms-grid-2{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:12px}' +
       '.dms-badge{font-size:11px;padding:2px 8px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);display:inline-flex;align-items:center;gap:4px;font-weight:500}' +
       '.dms-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:var(--dsw-alias-state-success-secondary,var(--dsw-alias-bg-layer-2))}' +
-      '.dms-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:var(--dsw-alias-state-warning-secondary,var(--dsw-alias-bg-layer-2))}' +
+      '.dms-badge-warn{border-color:var(--dsw-alias-state-warn-primary);color:var(--dsw-alias-state-warn-primary);background:var(--dsw-alias-state-warn-secondary,var(--dsw-alias-bg-layer-2))}' +
       '.dms-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:var(--dsw-alias-state-error-secondary,var(--dsw-alias-bg-layer-2))}' +
       '.dms-input{height:34px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border-radius:6px;padding:0 10px;font-size:13px;box-sizing:border-box}' +
-      '.dms-input:focus{outline:none;border-color:var(--dsw-alias-state-brand-primary)}' +
+      '.dms-input:focus{outline:none;border-color:var(--dsw-alias-brand-primary)}' +
       '.dms-btn-primary{background:var(--dsw-alias-label-primary)!important;color:var(--dsw-alias-bg-layer-3)!important;border-color:transparent!important;font-weight:600}' +
       '.dms-btn-primary:hover:not(:disabled){opacity:0.88}' +
       '.dms-btn-danger{color:var(--dsw-alias-state-error-primary)!important;border-color:var(--dsw-alias-state-error-primary)!important}' +
@@ -517,7 +517,7 @@ window.__ModuleLoader__.load({
                 }, updaterChecking ? t.checkingUpdates : (updaterStatus ? t.upToDate : t.checkForUpdates))
           )
         ),
-        updaterNotice ? React.createElement('div', { style: { color: 'var(--dsw-alias-state-success)', marginTop: 8, fontSize: 12 } }, updaterNotice) : null,
+        updaterNotice ? React.createElement('div', { style: { color: 'var(--dsw-alias-state-success-primary)', marginTop: 8, fontSize: 12 } }, updaterNotice) : null,
         updaterError ? React.createElement('div', { style: { color: 'var(--dsw-alias-state-error-primary)', marginTop: 8, fontSize: 12 } }, updaterError) : null
       )
     }
@@ -1117,7 +1117,7 @@ window.__ModuleLoader__.load({
               return React.createElement('div', { key: p.name, style: { display: 'flex', flexDirection: 'column', gap: 4, padding: '8px 10px', border: '1px solid var(--dsw-alias-border-l2)', borderRadius: 6, background: 'var(--dsw-alias-bg-layer-2)' } },
                 React.createElement('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center' } },
                   React.createElement('div', { style: { display: 'flex', gap: 8, alignItems: 'center' } },
-                    React.createElement('strong', { style: { fontFamily: 'monospace', fontSize: 13, color: 'var(--dsw-alias-state-brand-primary)' } }, p.name),
+                    React.createElement('strong', { style: { fontFamily: 'monospace', fontSize: 13, color: 'var(--dsw-alias-brand-primary)' } }, p.name),
                     React.createElement('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } }, p.label)
                   ),
                   button(isResolving ? t.resolvingAlias : t.resolveAlias, () => resolveSmartAlias(p.name), 'secondary')
@@ -1318,8 +1318,8 @@ window.__ModuleLoader__.load({
                     React.createElement('input', { type: 'checkbox', checked: selectionDraft.includes(model.id), onChange: (e) => setSelectionDraft((current) => e.target.checked ? [...current, model.id] : current.filter((id) => id !== model.id)) }),
                     ` ${model.name ?? model.id} (${model.id})`,
                     isNewModel(model, row) ? React.createElement('span', { style: { marginLeft: 6, fontSize: 11, padding: '1px 5px', borderRadius: 4, background: 'var(--dsw-alias-state-business-primary)', color: 'white' } }, 'NEW') : null,
-                    deprecationDays !== null ? React.createElement('span', { style: { marginLeft: 6, fontSize: 10, padding: '1px 5px', borderRadius: 4, background: 'var(--dsw-alias-state-warning-primary)', color: 'white' } }, deprecationDays > 0 ? t.deprecatesIn.replace('%d', deprecationDays) : t.deprecated) : null,
-                    (model.contextWindow && maxContext > 0 && model.contextWindow >= maxContext) ? React.createElement('span', { style: { marginLeft: 4, fontSize: 10, padding: '1px 4px', borderRadius: 3, background: 'var(--dsw-alias-state-warning-primary)', color: 'white' } }, '★') : null,
+                    deprecationDays !== null ? React.createElement('span', { style: { marginLeft: 6, fontSize: 10, padding: '1px 5px', borderRadius: 4, background: 'var(--dsw-alias-state-warn-primary)', color: 'white' } }, deprecationDays > 0 ? t.deprecatesIn.replace('%d', deprecationDays) : t.deprecated) : null,
+                    (model.contextWindow && maxContext > 0 && model.contextWindow >= maxContext) ? React.createElement('span', { style: { marginLeft: 4, fontSize: 10, padding: '1px 4px', borderRadius: 3, background: 'var(--dsw-alias-state-warn-primary)', color: 'white' } }, '★') : null,
                     (model.pricing && minPrice !== Infinity && model.pricing.inputPerToken === minPrice) ? React.createElement('span', { style: { marginLeft: 4, fontSize: 10, padding: '1px 4px', borderRadius: 3, background: 'var(--dsw-alias-state-success-primary)', color: 'white' } }, '$') : null,
                     model.tags && model.tags.length ? React.createElement('small', { style: { marginLeft: 6, color: 'var(--dsw-alias-label-secondary)' } }, model.tags.join(', ')) : null,
                     model.pricing ? React.createElement('small', { style: { marginLeft: 6, color: 'var(--dsw-alias-label-secondary)', fontSize: 11 } }, `in $${(model.pricing.inputPerToken * 1000000).toFixed(2)}/1M` + (model.pricing.cacheReadPerToken !== undefined ? ` / cache $${(model.pricing.cacheReadPerToken * 1000000).toFixed(2)}` : '') + (model.pricing.outputPerToken !== undefined ? ` / out $${(model.pricing.outputPerToken * 1000000).toFixed(2)}` : '')) : null,

package/lib/diff-notifier.js

@@ -74,7 +74,7 @@ export function extractDiffEvents(results, options = {}) {
         const bp = pair?.before?.pricing
         const ap = pair?.after?.pricing
         if (bp || ap) {
-          const inputDiff = bp?.inputPerToken !== ap?.outputPerToken && bp?.inputPerToken !== ap?.inputPerToken
+          const inputDiff = bp?.inputPerToken !== ap?.inputPerToken
           const outputDiff = bp?.outputPerToken !== ap?.outputPerToken
           if (inputDiff || outputDiff) {
             priceChanged.push({

package/lib/generic-adapter.js

@@ -1,7 +1,7 @@
 import { catalogRequestError } from './reliability.js'
 import { normalizeModels } from './models.js'
 
-const MAX_RESPONSE_BYTES = 4 * 1024 * 1024
+export const MAX_RESPONSE_BYTES = 4 * 1024 * 1024
 const SUPPORTED_APIS = new Set(['openai-completions', 'openai-responses'])
 
 function endpointFor(baseURL) {
@@ -10,16 +10,68 @@ function endpointFor(baseURL) {
   return base.endsWith('/models') ? base : `${base}/models`
 }
 
-async function readBody(response) {
+export async function readBoundedText(response, maxBytes = MAX_RESPONSE_BYTES) {
   const declared = Number(response.headers?.get?.('content-length') ?? NaN)
-  if (Number.isFinite(declared) && declared > MAX_RESPONSE_BYTES) {
+  if (Number.isFinite(declared) && declared > maxBytes) {
     throw new Error('model catalog response is too large')
   }
-  const text = await response.text()
-  if (Buffer.byteLength(text, 'utf8') > MAX_RESPONSE_BYTES) {
-    throw new Error('model catalog response is too large')
+
+  if (response.body && typeof response.body[Symbol.asyncIterator] === 'function') {
+    const chunks = []
+    let totalBytes = 0
+    for await (const chunk of response.body) {
+      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+      totalBytes += buf.byteLength
+      if (totalBytes > maxBytes) {
+        if (typeof response.body.cancel === 'function') {
+          try { await response.body.cancel('response too large') } catch (_err) { /* best-effort */ }
+        } else if (typeof response.body.destroy === 'function') {
+          try { response.body.destroy() } catch (_err) { /* best-effort */ }
+        }
+        throw new Error('model catalog response is too large')
+      }
+      chunks.push(buf)
+    }
+    return Buffer.concat(chunks).toString('utf8')
   }
-  return text
+
+  if (response.body && typeof response.body.getReader === 'function') {
+    const reader = response.body.getReader()
+    const chunks = []
+    let totalBytes = 0
+    try {
+      while (true) {
+        const { done, value } = await reader.read()
+        if (done) break
+        if (value) {
+          const buf = Buffer.isBuffer(value) ? value : Buffer.from(value)
+          totalBytes += buf.byteLength
+          if (totalBytes > maxBytes) {
+            try { await reader.cancel('response too large') } catch (_err) { /* best-effort */ }
+            throw new Error('model catalog response is too large')
+          }
+          chunks.push(buf)
+        }
+      }
+    } finally {
+      try { reader.releaseLock?.() } catch (_err) { /* best-effort */ }
+    }
+    return Buffer.concat(chunks).toString('utf8')
+  }
+
+  if (typeof response.text === 'function') {
+    const text = await response.text()
+    if (Buffer.byteLength(text, 'utf8') > maxBytes) {
+      throw new Error('model catalog response is too large')
+    }
+    return text
+  }
+
+  return ''
+}
+
+async function readBody(response) {
+  return readBoundedText(response, MAX_RESPONSE_BYTES)
 }
 
 function rowsFrom(payload) {

package/lib/http.js

@@ -1,4 +1,7 @@
+import crypto from 'node:crypto'
 import { validateAliasName } from './alias-resolver.js'
+import { validatePolicy } from './policy.js'
+
 function normalizeWebhookTestRequest(body) {
   if (!body || typeof body !== "object") throw Object.assign(new Error("body is required"), { code: "INVALID_REQUEST" })
   if (typeof body.url !== "string" || !body.url.trim()) throw Object.assign(new Error("url is required"), { code: "INVALID_REQUEST" })
@@ -30,8 +33,6 @@ function normalizeWebhookTestRequest(body) {
     secret: typeof body.secret === "string" ? body.secret.trim() : "",
   }
 }
-import crypto from 'node:crypto'
-import { validatePolicy } from './policy.js'
 
 const BASE = '/dsh-model-sync'
 
@@ -82,8 +83,6 @@ export function trusted(req, { requireLoopback = false } = {}) {
   }
   // If sec-fetch-site is same-origin or same-site, allow
   if (fetchSite === 'same-origin' || fetchSite === 'same-site') return true
-  // If sec-fetch-mode is present but origin/referer missing on a cross-site request, reject
-  if (req.headers?.['sec-fetch-mode'] && !host) return false
   // For requests requiring loopback or POST without any browser origin/referer headers, require explicit loopback
   if ((requireLoopback || req?.method === 'POST') && !origin && !referer) {
     if (!isLoopbackAddress(remoteAddress ?? (req?.headers?.host ? req.headers.host.split(':')[0] : ''))) return false

package/lib/models.js

@@ -146,11 +146,8 @@ function normalizeCapabilities(row) {
   if (!result.code && (/(^|[_-])(coder|code|starcoder|codellama)($|[_-])/i.test(idStr) || idStr.includes('coder') || idStr.includes('code-'))) {
     result.code = true
   }
-  if (!result.vision && (/(^|[_-])(vision|vl|multimodal|4v|4o|flash)($|[_-])/i.test(idStr) || idStr.includes('-vl') || idStr.includes('-vision'))) {
-    // Only set vision if clearly indicated by vision/vl tags
-    if (/(^|[_-])(vision|vl)($|[_-])/i.test(idStr) || idStr.includes('-vl') || idStr.includes('-vision')) {
-      result.vision = true
-    }
+  if (!result.vision && (/(^|[_-])(vision|vl)($|[_-])/i.test(idStr) || idStr.includes('-vl') || idStr.includes('-vision'))) {
+    result.vision = true
   }
 
   return Object.keys(result).length > 0 ? result : undefined

package/lib/policy.js

@@ -33,9 +33,21 @@ export function normalizePolicy(policy) {
   return res
 }
 
+function isDangerousPattern(pattern) {
+  if (typeof pattern !== 'string') return false
+  // Check for nested quantifiers like (a+)+, (a*)*, (a+)*, (a{1,2})+
+  if (/(\([^)]*[+*]\)[+*?{])|(\([^)]*\{[0-9]+,[0-9]*\}\)[+*?{])/.test(pattern)) return true
+  // Check for quantified groups containing quantified inner constructs
+  if (/\([^\)]*([+*]|\{[0-9]+,[0-9]*\})[^\)]*\)([+*]|\{[0-9]+,[0-9]*\})/.test(pattern)) return true
+  // Check for multiple consecutive open-ended wildcards (e.g. .*.*)
+  if (/(\.\*|\.\+){2,}/.test(pattern)) return true
+  return false
+}
+
 function compilePatterns(patterns, field) {
   return patterns.map((pattern) => {
     if (pattern.length > MAX_PATTERN_LENGTH) throw Object.assign(new Error(`${field} pattern is too long`), { code: 'INVALID_POLICY' })
+    if (isDangerousPattern(pattern)) throw Object.assign(new Error(`${field} pattern has catastrophic backtracking risk: ${pattern}`), { code: 'INVALID_POLICY' })
     try {
       return new RegExp(pattern, 'i')
     } catch {
@@ -53,10 +65,12 @@ export function validatePolicy(policy) {
 
 export function hasPolicy(policy) {
   const normalized = normalizePolicy(policy)
+  const hasRequire = Object.values(normalized.requireCapabilities).some((v) => v === true)
+  const hasDeny = Object.values(normalized.denyCapabilities).some((v) => v === true)
   return normalized.include.length > 0
     || normalized.exclude.length > 0
-    || Object.keys(normalized.requireCapabilities).length > 0
-    || Object.keys(normalized.denyCapabilities).length > 0
+    || hasRequire
+    || hasDeny
     || (normalized.enableCostFilter && normalized.maxPricePerMillion !== undefined)
     || (normalized.enableContextFilter && normalized.minContextTokens !== undefined)
 }
@@ -74,10 +88,10 @@ export function filterModels(models, policy) {
     if (exclude.some((pattern) => pattern.test(haystack))) return false
     const modelCapabilities = model?.capabilities ?? {}
     for (const [key, expected] of Object.entries(normalized.requireCapabilities)) {
-      if (modelCapabilities[key] !== expected) return false
+      if (expected === true && modelCapabilities[key] !== true) return false
     }
     for (const [key, denied] of Object.entries(normalized.denyCapabilities)) {
-      if (modelCapabilities[key] === denied) return false
+      if (denied === true && modelCapabilities[key] === true) return false
     }
     if (normalized.enableCostFilter && normalized.maxPricePerMillion !== undefined) {
       const inputPrice = model?.pricing?.inputPerToken

package/lib/pricing-database.js

@@ -100,14 +100,13 @@ export function lookupReferencePricing(provider, modelId) {
   const rawId = modelId.toLowerCase().trim()
   const cleaned = cleanId(rawId)
 
-  // 1. Direct check in provider table
+  // 1. Direct check in provider table (exact match or date-cleaned match)
   const table = REFERENCE_PRICING[provKey]
   if (table) {
     if (table[rawId]) return { ...table[rawId] }
     if (table[cleaned]) return { ...table[cleaned] }
-    for (const [key, val] of Object.entries(table)) {
-      if (rawId.startsWith(key) || cleaned.startsWith(key)) return { ...val }
-    }
+    // If the provider has a dedicated pricing table, do not search other providers' tables
+    return undefined
   }
 
   // 2. Vendor prefix check (e.g. "openai/gpt-4o" or "anthropic/claude-3-5-sonnet")
@@ -120,18 +119,12 @@ export function lookupReferencePricing(provider, modelId) {
     if (subTable) {
       if (subTable[subId]) return { ...subTable[subId] }
       if (subTable[subCleaned]) return { ...subTable[subCleaned] }
-      for (const [key, val] of Object.entries(subTable)) {
-        if (subId.startsWith(key) || subCleaned.startsWith(key)) return { ...val }
-      }
     }
   }
 
-  // 3. Fallback search across all tables if cleaned matches well-known key
+  // 3. Fallback search across tables ONLY for unknown/aggregator providers without a dedicated table
   for (const [p, t] of Object.entries(REFERENCE_PRICING)) {
     if (t[cleaned]) return { ...t[cleaned] }
-    for (const [key, val] of Object.entries(t)) {
-      if (cleaned.startsWith(key)) return { ...val }
-    }
   }
 
   return undefined

package/lib/reliability.js

@@ -110,13 +110,11 @@ export async function retryWithBackoff(operation, {
   onRetry,
 } = {}) {
   const total = Math.max(1, Math.floor(Number(attempts) || 1))
-  let lastError
   for (let attempt = 1; attempt <= total; attempt += 1) {
     if (signal?.aborted) throw signal.reason ?? abortError()
     try {
       return await operation({ attempt })
     } catch (error) {
-      lastError = error
       if (attempt >= total || !isRetryableError(error)) throw error
       const exponential = Math.max(0, Number(baseDelayMs) || 0) * (2 ** (attempt - 1))
       // Full jitter: randomized between [0.5, 1.0] of calculated exponential backoff
@@ -130,7 +128,6 @@ export async function retryWithBackoff(operation, {
       await delay(delayMs, signal)
     }
   }
-  throw lastError
 }
 
 export async function mapWithConcurrency(items, worker, concurrency = 4) {

package/lib/reporting.js

@@ -127,7 +127,7 @@ export function appendNotification(existing, report, { limit = DEFAULT_NOTIFICAT
     rows.push({
       ...current,
       updatedAt: now,
-      occurrences: boundedInteger(current.occurrences, 1, 1, 1000000) + 1,
+      occurrences: boundedInteger(Number(current.occurrences || 0) + 1, 1, 1, 1000000),
     })
   } else {
     rows.push(notification)

package/lib/scheduler.js

@@ -82,6 +82,7 @@ export function createSyncScheduler(sync, {
   async function tick() {
     const config = getConfig() ?? {}
     if (config.enabled === false || config.scheduleEnabled === false || running) return
+    resetStates(config)
     const rows = scheduleRows(config)
     if (rows.length === 0) return
     const now = nowFn()
@@ -131,8 +132,6 @@ export function createSyncScheduler(sync, {
   }
 
   function status() {
-    const config = getConfig() ?? {}
-    resetStates(config)
     const values = [...state.values()]
     const nextAt = (timer !== null && values.length > 0) ? Math.min(...values.map((row) => row.nextAt)) : null
     const lastRunAt = values.filter((row) => row.lastRunAt).reduce((max, row) => Math.max(max, row.lastRunAt), 0) || null

package/lib/synchronizer-prober.js

@@ -1,40 +1,92 @@
-export function createModelProber({ health }) {
+export function createModelProber({ health, getProviderCatalog = () => [] } = {}) {
+  const modelProbes = new Map()
+
   async function tryModel({ provider, model } = {}) {
     if (typeof provider !== 'string' || !provider) throw new Error('provider is required')
     if (typeof model !== 'string' || !model) throw new Error('model is required')
     const start = Date.now()
     const result = await health({ provider })
     const entry = result?.results?.find((r) => r.provider === provider)
-    return {
+    const providerOk = entry?.status === 'ok'
+
+    // Verify model in provider catalog if catalog is available
+    const catalog = typeof getProviderCatalog === 'function' ? getProviderCatalog(provider) : []
+    const hasCatalog = Array.isArray(catalog) && catalog.length > 0
+    const inCatalog = !hasCatalog || catalog.some((m) => (typeof m === 'string' ? m : m?.id) === model)
+
+    const ok = Boolean(providerOk && inCatalog)
+    const latencyMs = Date.now() - start
+    const status = !providerOk ? (entry?.status ?? 'error') : (!inCatalog ? 'model_not_found' : 'ok')
+    const errorMsg = !providerOk
+      ? (entry?.message || entry?.status || 'probe failed')
+      : (!inCatalog ? `model "${model}" not found in provider catalog` : undefined)
+
+    const probeResult = {
       provider,
       model,
-      ok: entry?.status === 'ok',
-      latencyMs: Date.now() - start,
-      status: entry?.status ?? 'unknown',
-      ...(entry?.status !== 'ok' ? { error: entry?.message || entry?.status || 'probe failed' } : {}),
+      ok,
+      latencyMs,
+      status,
+      ...(errorMsg ? { error: errorMsg } : {}),
     }
+
+    modelProbes.set(`${provider}:${model}`, {
+      latencyMs,
+      ok,
+      status,
+      timestamp: Date.now(),
+    })
+
+    return probeResult
   }
 
   async function batchTryModels({ provider, models } = {}) {
     if (typeof provider !== 'string' || !provider) throw new Error('provider is required')
     if (!Array.isArray(models)) throw new Error('models must be an array')
     const list = [...new Set(models.filter((m) => typeof m === 'string' && m.trim()).map((m) => m.trim()))].slice(0, 50)
+
+    // Probe provider health ONCE for the entire batch rather than per-model
+    const start = Date.now()
+    const healthResult = await health({ provider })
+    const entry = healthResult?.results?.find((r) => r.provider === provider)
+    const providerOk = entry?.status === 'ok'
+    const catalog = typeof getProviderCatalog === 'function' ? getProviderCatalog(provider) : []
+    const hasCatalog = Array.isArray(catalog) && catalog.length > 0
+    const baseLatency = Date.now() - start
+
     const results = []
-    const concurrency = 3
+    const concurrency = 5
     for (let i = 0; i < list.length; i += concurrency) {
       const chunk = list.slice(i, i + concurrency)
-      const chunkResults = await Promise.all(
-        chunk.map((model) => tryModel({ provider, model }).catch((err) => ({
+      const chunkResults = chunk.map((model) => {
+        const inCatalog = !hasCatalog || catalog.some((m) => (typeof m === 'string' ? m : m?.id) === model)
+        const ok = Boolean(providerOk && inCatalog)
+        const status = !providerOk ? (entry?.status ?? 'error') : (!inCatalog ? 'model_not_found' : 'ok')
+        const errorMsg = !providerOk
+          ? (entry?.message || entry?.status || 'probe failed')
+          : (!inCatalog ? `model "${model}" not found in provider catalog` : undefined)
+
+        const itemResult = {
           provider,
           model,
-          ok: false,
-          latencyMs: 0,
-          status: 'error',
-          error: err instanceof Error ? err.message : String(err)
-        })))
-      )
+          ok,
+          latencyMs: baseLatency,
+          status,
+          ...(errorMsg ? { error: errorMsg } : {}),
+        }
+
+        modelProbes.set(`${provider}:${model}`, {
+          latencyMs: baseLatency,
+          ok,
+          status,
+          timestamp: Date.now(),
+        })
+
+        return itemResult
+      })
       results.push(...chunkResults)
     }
+
     const reachable = results.filter((r) => r.ok).length
     return {
       provider,
@@ -43,8 +95,13 @@ export function createModelProber({ health }) {
     }
   }
 
+  function getModelProbes() {
+    return Object.fromEntries(modelProbes)
+  }
+
   return {
     tryModel,
     batchTryModels,
+    getModelProbes,
   }
 }

package/lib/synchronizer-transfer.js

@@ -54,7 +54,7 @@ export function createConfigTransfer({
             importedProviders.push(pname)
           }
           if (Array.isArray(pdata.selectedModels)) {
-            currentSelections[pname] = pdata.selectedModels.filter((m) => typeof m === 'string')
+            currentSelections[pname] = [...new Set(pdata.selectedModels.filter((m) => typeof m === 'string' && m.trim()).map((m) => m.trim()))].slice(0, 1000)
             importedProviders.push(pname)
           }
         }
@@ -74,7 +74,7 @@ export function createConfigTransfer({
             const strat = v.strategy.trim()
             if (VIRTUAL_STRATEGIES.includes(strat)) {
               entry.strategy = strat
-              entry.isVirtual = isVirtualAlias(k)
+              entry.isVirtual = isVirtualAlias(k, strat)
             } else {
               continue
             }
@@ -125,7 +125,7 @@ export function createConfigTransfer({
       }
       currentAliases[trimmedAlias] = {
         strategy: cleanStrategy,
-        isVirtual: isVirtualAlias(trimmedAlias),
+        isVirtual: isVirtualAlias(trimmedAlias, cleanStrategy),
         updatedAt: Date.now(),
       }
     } else {

package/lib/synchronizer.js

@@ -452,7 +452,13 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
     return transientNotifications.find((row) => row.id === id)
   }
 
-  const prober = createModelProber({ health })
+  const prober = createModelProber({
+    health,
+    getProviderCatalog: (p) => {
+      const row = providers().find((item) => item.provider === p)
+      return row?.availableModels || row?.models || []
+    },
+  })
 
   const rollbackHistory = (opts) => performHistoryRollback({ ctx, config: getConfig() ?? {}, providers: providers(), ...opts })
 
@@ -533,6 +539,7 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
     validatePolicy,
     isCircuitOpen: (p) => Boolean(circuits.get(p)?.blockedUntil > Date.now()),
     getHealthResults: () => lastHealth?.results ?? [],
+    getModelProbes: () => prober.getModelProbes(),
   })
 
   return Object.freeze({
@@ -547,6 +554,7 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
     listPolicies,
     health,
     ...prober,
+    getModelProbes: prober.getModelProbes,
     ...transfer,
     credentialDiagnostics,
     history,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-model-sync",
-  "version": "0.5.6",
+  "version": "0.5.8",
   "description": "Automatic model catalog synchronization for API-key DeepSeek Harness providers.",
   "keywords": [
     "deepseek-harness",
@@ -53,7 +53,10 @@
   "license": "MIT",
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/schemastery": "^3.18.4",
-    "@deepseek-ai/dsh-llm": "^0.1.7-rc.2 || ^0.2.0-rc.1"
+    "@deepseek-ai/dsh-credentials": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-settings": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/schemastery": "^3.18.4"
   }
 }