@kevin5251984/guild 0.2.19 → 0.2.20

package/src/reasoning-catalog.ts

@@ -0,0 +1,346 @@
+import type { ModelReasoning } from "@guild/protocol";
+import { guildUserAgent } from "./version.ts";
+
+const MODELS_DEV = "https://models.dev/api.json";
+const OPENROUTER_MODELS = "https://openrouter.ai/api/v1/models";
+const TTL_MS = 6 * 60 * 60 * 1000;
+const FETCH_MS = 4_000;
+
+const DEV_PROVIDER: Record<string, string> = {
+  xai: "xai",
+  "xai-oauth": "xai",
+  openai: "openai",
+  "openai-codex": "openai",
+  anthropic: "anthropic",
+  "anthropic-oauth": "anthropic",
+  "github-copilot": "github-copilot",
+  "opencode-free": "opencode",
+  openrouter: "openrouter",
+  "openrouter-oauth": "openrouter",
+};
+
+const OPENROUTER_PREFIX: Record<string, string> = {
+  xai: "x-ai",
+  openai: "openai",
+  anthropic: "anthropic",
+  "opencode-free": "opencode",
+  "github-copilot": "github-copilot",
+};
+
+/** Sort key only — never used as the displayed list. */
+const EFFORT_RANK = [
+  "none",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max",
+];
+
+type CatalogMaps = {
+  at: number;
+  dev: Map<string, ModelReasoning>;
+  openrouter: Map<string, ModelReasoning>;
+  gatewayEfforts: string[];
+};
+
+let maps: CatalogMaps | null = null;
+
+export function parseEffortList(raw: unknown): string[] {
+  if (!Array.isArray(raw)) return [];
+  const out: string[] = [];
+  for (const item of raw) {
+    if (typeof item !== "string") continue;
+    const key = item.trim().toLowerCase();
+    if (!/^[a-z][a-z0-9_-]{0,31}$/.test(key) || out.includes(key)) continue;
+    out.push(key);
+  }
+  return out;
+}
+
+export function sanitizeEffort(raw: unknown): string | undefined {
+  if (typeof raw !== "string") return undefined;
+  const key = raw.trim().toLowerCase();
+  if (!/^[a-z][a-z0-9_-]{0,31}$/.test(key)) return undefined;
+  return key;
+}
+
+export function fromModelsDevModel(raw: unknown): ModelReasoning | undefined {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return undefined;
+  const row = raw as Record<string, unknown>;
+  if (row.reasoning === false) return undefined;
+  const options = Array.isArray(row.reasoning_options)
+    ? row.reasoning_options
+    : [];
+  let efforts: string[] = [];
+  let supportsMaxTokens = false;
+  for (const opt of options) {
+    if (!opt || typeof opt !== "object" || Array.isArray(opt)) continue;
+    const rec = opt as Record<string, unknown>;
+    if (rec.type === "effort") efforts = parseEffortList(rec.values);
+    if (rec.type === "budget_tokens") supportsMaxTokens = true;
+  }
+  if (row.reasoning !== true && !efforts.length && !supportsMaxTokens) {
+    return undefined;
+  }
+  const spec: ModelReasoning = {};
+  if (efforts.length) spec.supportedEfforts = efforts;
+  if (supportsMaxTokens) spec.supportsMaxTokens = true;
+  spec.defaultEnabled = true;
+  if (efforts.length) spec.mandatory = !efforts.includes("none");
+  if (efforts.includes("high")) spec.defaultEffort = "high";
+  else if (efforts.includes("medium")) spec.defaultEffort = "medium";
+  else if (efforts.length) spec.defaultEffort = efforts[0];
+  return spec;
+}
+
+export function fromOpenRouterModel(raw: unknown): ModelReasoning | undefined {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return undefined;
+  const row = raw as Record<string, unknown>;
+  const block = row.reasoning;
+  if (block === undefined) return undefined;
+  if (!block || typeof block !== "object" || Array.isArray(block)) {
+    return undefined;
+  }
+  const rec = block as Record<string, unknown>;
+  const spec: ModelReasoning = {};
+  if (rec.supported_efforts === null) {
+    spec.supportedEfforts = undefined;
+  } else {
+    const efforts = parseEffortList(rec.supported_efforts);
+    if (efforts.length) spec.supportedEfforts = efforts;
+  }
+  const def = sanitizeEffort(rec.default_effort);
+  if (def) spec.defaultEffort = def;
+  if (typeof rec.mandatory === "boolean") spec.mandatory = rec.mandatory;
+  if (typeof rec.default_enabled === "boolean") {
+    spec.defaultEnabled = rec.default_enabled;
+  }
+  if (rec.supports_max_tokens === true) spec.supportsMaxTokens = true;
+  if (
+    !spec.supportedEfforts &&
+    spec.defaultEffort === undefined &&
+    spec.mandatory === undefined &&
+    spec.supportsMaxTokens === undefined
+  ) {
+    return { defaultEnabled: spec.defaultEnabled ?? true };
+  }
+  return spec;
+}
+
+function indexDev(data: unknown): Map<string, ModelReasoning> {
+  const out = new Map<string, ModelReasoning>();
+  if (!data || typeof data !== "object") return out;
+  for (const [pid, prov] of Object.entries(data as Record<string, unknown>)) {
+    if (!prov || typeof prov !== "object") continue;
+    const models = (prov as { models?: Record<string, unknown> }).models;
+    if (!models || typeof models !== "object") continue;
+    for (const [mid, model] of Object.entries(models)) {
+      const spec = fromModelsDevModel(model);
+      if (!spec) continue;
+      out.set(`${pid}/${mid}`, spec);
+      const bare = mid.split("/").pop() || mid;
+      if (bare !== mid) out.set(`${pid}/${bare}`, spec);
+    }
+  }
+  return out;
+}
+
+function indexOpenRouter(data: unknown): {
+  map: Map<string, ModelReasoning>;
+  gateway: string[];
+} {
+  const map = new Map<string, ModelReasoning>();
+  const seen = new Set<string>();
+  const rows = Array.isArray(data)
+    ? data
+    : data && typeof data === "object" && Array.isArray((data as { data?: unknown }).data)
+      ? ((data as { data: unknown[] }).data)
+      : [];
+  for (const row of rows) {
+    const spec = fromOpenRouterModel(row);
+    if (!spec) continue;
+    const id =
+      row && typeof row === "object" && typeof (row as { id?: unknown }).id === "string"
+        ? (row as { id: string }).id
+        : "";
+    if (!id) continue;
+    map.set(id, spec);
+    const bare = id.split("/").pop() || id;
+    if (bare !== id && !map.has(bare)) map.set(bare, spec);
+    for (const effort of spec.supportedEfforts ?? []) seen.add(effort);
+  }
+  const gateway = EFFORT_RANK.filter((key) => seen.has(key));
+  for (const key of seen) {
+    if (!gateway.includes(key)) gateway.push(key);
+  }
+  return { map, gateway };
+}
+
+export function setReasoningCatalogForTests(input: {
+  dev?: unknown;
+  openrouter?: unknown;
+}): void {
+  const openrouter = indexOpenRouter(input.openrouter ?? { data: [] });
+  maps = {
+    at: Date.now(),
+    dev: indexDev(input.dev ?? {}),
+    openrouter: openrouter.map,
+    gatewayEfforts: openrouter.gateway,
+  };
+}
+
+export function resetReasoningCatalog(): void {
+  maps = null;
+}
+
+function skipLiveFetch(): boolean {
+  return Boolean(
+    process.env.NODE_TEST_CONTEXT ||
+      process.argv.some((arg) => arg === "--test" || arg.includes("--test=")),
+  );
+}
+
+export async function refreshReasoningCatalog(
+  force = false,
+  fetcher: typeof fetch = fetch,
+): Promise<void> {
+  if (!force && maps && Date.now() - maps.at < TTL_MS) return;
+  if (!force && skipLiveFetch() && maps) return;
+  if (skipLiveFetch() && !force) return;
+  const ctrl = AbortSignal.timeout(FETCH_MS);
+  const [devRes, orRes] = await Promise.allSettled([
+    fetcher(MODELS_DEV, {
+      headers: { accept: "application/json", "user-agent": guildUserAgent() },
+      signal: ctrl,
+    }),
+    fetcher(OPENROUTER_MODELS, {
+      headers: { accept: "application/json", "user-agent": guildUserAgent() },
+      signal: ctrl,
+    }),
+  ]);
+  let dev = maps?.dev ?? new Map<string, ModelReasoning>();
+  let openrouter = maps?.openrouter ?? new Map<string, ModelReasoning>();
+  let gateway = maps?.gatewayEfforts ?? [];
+  let got = false;
+  if (devRes.status === "fulfilled" && devRes.value.ok) {
+    try {
+      dev = indexDev(await devRes.value.json());
+      got = true;
+    } catch {
+      /* keep previous */
+    }
+  }
+  if (orRes.status === "fulfilled" && orRes.value.ok) {
+    try {
+      const indexed = indexOpenRouter(await orRes.value.json());
+      openrouter = indexed.map;
+      gateway = indexed.gateway;
+      got = true;
+    } catch {
+      /* keep previous */
+    }
+  }
+  if (!got && !maps) return;
+  if (!got) return;
+  maps = {
+    at: Date.now(),
+    dev,
+    openrouter,
+    gatewayEfforts: gateway,
+  };
+}
+
+function fillNullEfforts(spec: ModelReasoning): ModelReasoning {
+  if (spec.supportedEfforts?.length) return spec;
+  if (!maps?.gatewayEfforts.length) return spec;
+  return { ...spec, supportedEfforts: [...maps.gatewayEfforts] };
+}
+
+export function reasoningFor(
+  providerId: string,
+  modelId: string,
+): ModelReasoning | undefined {
+  if (!maps) return undefined;
+  const provider = String(providerId || "").trim().toLowerCase();
+  const model = String(modelId || "").trim();
+  if (!provider || !model) return undefined;
+  const bare = model.split("/").pop() || model;
+  const devId = DEV_PROVIDER[provider] || provider.replace(/-oauth$/, "");
+
+  if (devId === "openrouter") {
+    const hit =
+      maps.openrouter.get(model) ||
+      maps.openrouter.get(bare) ||
+      maps.openrouter.get(model.toLowerCase());
+    return hit ? fillNullEfforts(hit) : undefined;
+  }
+
+  const devHit =
+    maps.dev.get(`${devId}/${model}`) ||
+    maps.dev.get(`${devId}/${bare}`) ||
+    maps.dev.get(`${devId}/${bare.toLowerCase()}`);
+  if (devHit) return devHit;
+
+  const prefix = OPENROUTER_PREFIX[devId] || OPENROUTER_PREFIX[provider];
+  if (prefix) {
+    const slug = `${prefix}/${bare}`;
+    const orHit = maps.openrouter.get(slug) || maps.openrouter.get(model);
+    if (orHit) return fillNullEfforts(orHit);
+  }
+  return undefined;
+}
+
+export function attachReasoning(
+  providerId: string,
+  models: { id: string; name?: string; reasoning?: ModelReasoning }[],
+): { id: string; name?: string; reasoning?: ModelReasoning }[] {
+  return models.map((model) => {
+    const spec = reasoningFor(providerId, model.id);
+    if (!spec) return model;
+    return { ...model, reasoning: spec };
+  });
+}
+
+export function clampEffort(
+  want: string | undefined,
+  spec: ModelReasoning | undefined,
+  fast = false,
+): string | undefined {
+  const efforts = spec?.supportedEfforts;
+  if (!efforts?.length) return undefined;
+  const usable = spec?.mandatory
+    ? efforts.filter((key) => key !== "none")
+    : efforts;
+  if (!usable.length) return undefined;
+  if (fast) {
+    if (usable.includes("low")) return "low";
+    if (usable.includes("minimal")) return "minimal";
+    const ranked = EFFORT_RANK.filter((key) => usable.includes(key));
+    return ranked[0] || usable[usable.length - 1];
+  }
+  const picked = sanitizeEffort(want);
+  if (picked && usable.includes(picked)) return picked;
+  if (spec?.defaultEffort && usable.includes(spec.defaultEffort)) {
+    return spec.defaultEffort;
+  }
+  return usable.includes("high")
+    ? "high"
+    : usable.includes("medium")
+      ? "medium"
+      : usable[0];
+}
+
+export function reasoningPayload(
+  providerId: string,
+  baseUrl: string,
+  effort: string | undefined,
+): Record<string, unknown> {
+  if (!effort) return {};
+  const viaOpenRouter =
+    providerId.includes("openrouter") ||
+    /openrouter\.ai/i.test(baseUrl);
+  if (viaOpenRouter) return { reasoning: { effort } };
+  return { reasoning_effort: effort, reasoning: { effort } };
+}

package/src/router.ts

@@ -29,6 +29,7 @@ import {
   mergeModelsFile,
   publicModels,
   refreshOpenCodeFreeCatalog,
+  refreshReasoningCatalog,
   listBench,
   listLibrary,
   listMcpServers,
@@ -102,11 +103,107 @@ const LIBRARY_KINDS = new Set<LibraryKind>([
   "subagents",
 ]);
 
-const CORS_HEADERS = {
-  "access-control-allow-origin": "*",
-  "access-control-allow-methods": "GET, POST, PATCH, PUT, DELETE, OPTIONS",
-  "access-control-allow-headers": "content-type, authorization",
-} as const;
+/**
+ * Same-origin guard. The hall UI is served by this daemon (`http://127.0.0.1:7420/`
+ * and the Tailscale address), so it never needs CORS. A request that carries an
+ * `Origin` from somewhere else is a foreign page trying to read local files
+ * (`/host/read`), so it is refused before any route runs.
+ */
+const LOCAL_HOSTS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+/** Tailscale MagicDNS names: `machine.tailnet.ts.net`. */
+const MAGIC_DNS_SUFFIX = ".ts.net";
+
+function headerLine(value: string | string[] | undefined): string {
+  const first = Array.isArray(value) ? value[0] : value;
+  return typeof first === "string" ? first.trim() : "";
+}
+
+function normalizeHost(host: string): string {
+  const lower = host.trim().toLowerCase().replace(/\.$/, "");
+  return LOCAL_HOSTS.has(lower) ? "127.0.0.1" : lower;
+}
+
+/** Host header is an authority, not a URL: `127.0.0.1:7420`, `[::1]:7420`, `bot.local`. */
+function hostPortOf(authority: string): { host: string; port: string } {
+  const value = authority.trim();
+  if (!value) return { host: "", port: "" };
+  if (value.startsWith("[")) {
+    const end = value.indexOf("]");
+    const host = end === -1 ? value : value.slice(0, end + 1);
+    const rest = end === -1 ? "" : value.slice(end + 1);
+    const colon = rest.indexOf(":");
+    return { host, port: colon === -1 ? "" : rest.slice(colon + 1) };
+  }
+  const colon = value.indexOf(":");
+  if (colon === -1) return { host: value, port: "" };
+  return { host: value.slice(0, colon), port: value.slice(colon + 1) };
+}
+
+/** Dotted-quad octets, or null when this is not an IPv4 literal. */
+function ipv4Octets(host: string): number[] | null {
+  const parts = host.split(".");
+  if (parts.length !== 4) return null;
+  const octets: number[] = [];
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null;
+    const value = Number(part);
+    if (!Number.isInteger(value) || value > 255) return null;
+    octets.push(value);
+  }
+  return octets;
+}
+
+/**
+ * True only for authorities that cannot be a public name: loopback, RFC1918,
+ * CGNAT / Tailscale 100.64/10, and MagicDNS `*.ts.net`. A rebinding page
+ * (`evil.com` resolving to 127.0.0.1) matches Origin against Host, so the
+ * authority itself has to be checked too.
+ */
+export function isLocalAuthority(raw: string): boolean {
+  let host = String(raw || "").trim().toLowerCase().replace(/\.$/, "");
+  if (!host) return false;
+  if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
+  if (host === "::1" || host === "0:0:0:0:0:0:0:1") return true;
+  if (LOCAL_HOSTS.has(host)) return true;
+  const octets = ipv4Octets(host);
+  if (octets) {
+    const [first, second] = octets as [number, number, number, number];
+    if (first === 127) return true; // 127/8 loopback
+    if (first === 10) return true; // RFC1918
+    if (first === 172 && second >= 16 && second <= 31) return true;
+    if (first === 192 && second === 168) return true;
+    if (first === 100 && second >= 64 && second <= 127) return true; // CGNAT
+    return false;
+  }
+  return host.endsWith(MAGIC_DNS_SUFFIX);
+}
+
+/** True when there is no Origin (curl, Node fetch, same-origin opaque) or it matches Host. */
+export function sameOrigin(req: IncomingMessage): boolean {
+  const raw = headerLine(req.headers.origin);
+  if (!raw) return true;
+  let origin: URL;
+  try {
+    origin = new URL(raw);
+  } catch {
+    return false;
+  }
+  const secure = origin.protocol === "https:";
+  if (!secure && origin.protocol !== "http:") return false;
+  const host = headerLine(req.headers.host);
+  if (!host) return false;
+  const wanted = hostPortOf(host);
+  // Origin == Host is not enough: DNS rebinding makes a public name resolve to
+  // this machine, so both authorities must be loopback / private.
+  if (!isLocalAuthority(wanted.host) || !isLocalAuthority(origin.hostname)) {
+    return false;
+  }
+  return (
+    normalizeHost(wanted.host) === normalizeHost(origin.hostname) &&
+    (wanted.port || (secure ? "443" : "80")) ===
+      (origin.port || (secure ? "443" : "80"))
+  );
+}
 
 function send(
   res: ServerResponse,
@@ -119,7 +216,6 @@ function send(
     "content-type": type,
     "content-length": Buffer.byteLength(body),
     "cache-control": "no-store",
-    ...CORS_HEADERS,
     ...extra,
   });
   res.end(body);
@@ -261,8 +357,12 @@ export async function handleRequest(
   const path = pathname(req);
 
   try {
+    if (!sameOrigin(req)) {
+      throw new StoreError(403, "cross-origin refused");
+    }
+
     if (method === "OPTIONS") {
-      res.writeHead(204, CORS_HEADERS);
+      res.writeHead(204);
       res.end();
       return;
     }
@@ -311,7 +411,6 @@ export async function handleRequest(
         "content-type": type,
         "content-length": bytes.length,
         "cache-control": "private, max-age=86400",
-        ...CORS_HEADERS,
       });
       res.end(bytes);
       return;
@@ -859,6 +958,7 @@ export async function handleRequest(
     if (method === "GET" && path === "/settings/models") {
       await refreshCopilotCatalog(store.dataDir);
       await refreshOpenCodeFreeCatalog(store.dataDir);
+      await refreshReasoningCatalog().catch(() => {});
       json(res, 200, publicModels(store.dataDir));
       return;
     }

package/src/store.ts

@@ -26,7 +26,11 @@ import { DEFAULT_BOTS } from "./catalog/default-bots.ts";
 import { CATALOG_SKILLS } from "./catalog/skills.ts";
 import { CATALOG_SUBAGENTS } from "./catalog/subagents.ts";
 import { parseAgentFile } from "./agent-file.ts";
-import { parseMentionIds, sanitizeMentionIds } from "./mention.ts";
+import {
+  parseMentionIds,
+  sanitizeMentionIds,
+  withoutDeferredIds,
+} from "./mention.ts";
 
 const MARKDOWN: Record<LibraryKind, string> = {
   souls: "SOUL.md",
@@ -989,11 +993,14 @@ export class GuildStore {
     const now = new Date().toISOString();
     const startedAt = author !== "you" ? usage?.startedAt : undefined;
     const bots = this.listBots();
-    const mentionIds = (
-      mentions !== undefined
+    const mentionIds = withoutDeferredIds(
+      (mentions !== undefined
         ? sanitizeMentionIds(mentions, bots)
         : parseMentionIds(text, bots, author === "you" ? "user" : "bot")
-    ).filter((id) => id !== author);
+      ).filter((id) => id !== author),
+      text,
+      bots,
+    );
     const message: ChatMessage = {
       id: randomUUID(),
       roomId,
@@ -1022,10 +1029,12 @@ export class GuildStore {
     const text = body.trim();
     if (!text) throw new StoreError(400, "message is required");
     const bots = this.listBots();
-    const mentionIds = (
+    const mentionIds = withoutDeferredIds(
       mentions !== undefined
         ? sanitizeMentionIds(mentions, bots)
-        : parseMentionIds(text, bots, "user")
+        : parseMentionIds(text, bots, "user"),
+      text,
+      bots,
     );
     const next = this.db.updateMessageBody(roomId, messageId, text, mentionIds);
     if (!next) throw new StoreError(404, "message not found");

package/src/subagent.ts

@@ -73,16 +73,21 @@ function agentKey(value: string): string {
   return value.trim().replace(/^\/+/, "").toLowerCase();
 }
 
-/** Parent read_only cannot escalate via spawn. Explorer from full_access keeps run. */
+/**
+ * A child never outruns its parent, and a read-only agent never gets `run`
+ * back: a readOnly child is pinned to read_only even under a full_access
+ * parent (that used to be an escalation hole — CHILD_TOOLS_RO advertised run
+ * and gateTool let a full_access child through it).
+ */
 export function childSpawnPolicy(
   parentSandbox: ToolContext["sandbox"],
   agentReadOnly: boolean,
 ): { sandbox: Sandbox; allowWrite: boolean } {
   const parent = parseSandbox(parentSandbox);
-  if (parent === "read_only") {
+  if (parent === "read_only" || agentReadOnly) {
     return { sandbox: "read_only", allowWrite: false };
   }
-  return { sandbox: parent, allowWrite: !agentReadOnly };
+  return { sandbox: parent, allowWrite: true };
 }
 
 export function resolveSubagent(
@@ -108,8 +113,8 @@ Never say you cannot access this machine. Check [exit code: N] on every run.
 Independent searches: emit multiple tool calls in one round; they run in parallel.`;
 
 const CHILD_TOOLS_RO = `You ARE already running on the user's local computer (Guild).
-Tools: run, read, list, skill. You cannot write files and cannot spawn subagents.
-Read-only. Never edit, patch, or create files. Check [exit code: N] on every run.
+Tools: read, list, skill. You cannot run shell commands, cannot write files, and cannot spawn subagents.
+Read-only. Never edit, patch, or create files.
 Independent searches: emit multiple tool calls in one round; they run in parallel.`;
 
 export const SPAWN_MAX_PARALLEL = 8;

package/src/tools.ts

@@ -7,6 +7,7 @@ import { Type, type Tool } from "@earendil-works/pi-ai";
 import { listHostSkills } from "./host-skills.ts";
 import type { McpToolRef } from "./mcp.ts";
 import {
+  defaultWorkspace,
   gateTool,
   parseSandbox,
   resolveToolPath,
@@ -186,7 +187,9 @@ export function guildTools(
       (tool) => tool.name === "read" || tool.name === "list",
     );
   } else if (sandbox === "workspace_write") {
-    tools = tools.filter((tool) => tool.name !== "image_gen");
+    tools = tools.filter(
+      (tool) => tool.name !== "image_gen" && tool.name !== "browser",
+    );
   }
   tools.push({
     name: "skill",
@@ -465,9 +468,11 @@ export async function builtinExecute(
   ctx: ToolContext = {},
 ): Promise<ToolOutcome> {
   try {
+    // workspace_write resolves relative paths from the workspace root, which
+    // defaults to the guild checkout (same root gateTool checks against).
     const pathBase =
-      parseSandbox(ctx.sandbox) === "workspace_write" && ctx.workspace
-        ? resolveToolPath(ctx.workspace)
+      parseSandbox(ctx.sandbox) === "workspace_write"
+        ? resolveToolPath(ctx.workspace?.trim() || defaultWorkspace())
         : HOME;
     if (name === "run") {
       return await runCommand(

package/src/version.ts

@@ -0,0 +1,25 @@
+import { readFileSync } from "node:fs";
+
+/**
+ * Outbound User-Agent. npm ships this package's source, so the manifest always
+ * sits one level above `src/` — same lookup as `--version` in cli.ts.
+ */
+export function guildUserAgent(): string {
+  return `Guild/${guildVersion()}`;
+}
+
+let cached: string | null = null;
+
+export function guildVersion(): string {
+  if (cached !== null) return cached;
+  try {
+    const pkg = JSON.parse(
+      readFileSync(new URL("../package.json", import.meta.url), "utf8"),
+    ) as { version?: unknown };
+    const version = typeof pkg.version === "string" ? pkg.version.trim() : "";
+    cached = version || "0";
+  } catch {
+    cached = "0";
+  }
+  return cached;
+}

package/vendor/protocol/src/index.ts

@@ -133,9 +133,20 @@ export type LlmApi =
   | "anthropic-messages"
   | "openai-responses";
 
+export type ModelReasoning = {
+  /** Effort strings this model accepts, catalog order. Missing = no effort picker. */
+  supportedEfforts?: string[];
+  defaultEffort?: string;
+  /** When true, do not send `none` — reasoning cannot be turned off. */
+  mandatory?: boolean;
+  defaultEnabled?: boolean;
+  supportsMaxTokens?: boolean;
+};
+
 export type ModelEntry = {
   id: string;
   name?: string;
+  reasoning?: ModelReasoning;
 };
 
 export type ProviderEntry = {
@@ -158,7 +169,8 @@ export type AuxRole =
 
 export type ModelsFile = {
   default?: ModelRef | null;
-  reasoning?: "minimal" | "low" | "medium" | "high";
+  /** Last chosen effort string (catalog-defined: low, high, xhigh, …). */
+  reasoning?: string;
   fast?: boolean;
   aux?: Partial<Record<AuxRole, ModelRef | null>>;
   recent?: ModelRef[];