@kontextmind/kxm 0.7.192 → 0.7.193

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.192",
+      "version": "0.7.193",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/CHANGELOG.md

@@ -714,6 +714,24 @@ All notable user-facing changes are documented here. The project follows [Semant
 
 ### Fixed
 
+- **The weekly model refresh opens its pull request with a GitHub App.**
+  `.github/workflows/refresh-models.yml` uses `actions/create-github-app-token`
+  with repository secrets `KXM_REFRESH_APP_ID` and
+  `KXM_REFRESH_APP_PRIVATE_KEY`. The App is installed on `kontextmind/kxm`
+  only, with Contents read and write and Pull requests read and write. A
+  missing secret fails the job and names both. `GITHUB_TOKEN` is not used to
+  create the pull request. Setup is in
+  [Refresh model prices and inventory](docs/contributing/development.md#refresh-model-prices-and-inventory).
+- **GLM 5.3 prices no longer share one YAML anchor.**
+  `openrouter/z-ai/glm-5.3-flash` tracks the OpenRouter models API on
+  2026-10-20: $0.047076 input, $0.12 output, and $0.006 cache read per 1M
+  tokens. `zai-coding-cn/glm-5.3-flash` keeps the coding-plan rate of $0.15 /
+  $0.50 (cache read $0.03). `zai-coding-cn/glm-5.3` output is $1.40, matching
+  OpenRouter `z-ai/glm-5.3` (input $0.079 and cache read $0.078 were already
+  the same). The refresh does not rewrite a shared anchor that a
+  non-OpenRouter row depends on. `.kxm/prices.yaml` is dated 2026-10-20.
+  The OpenRouter `standard` rates for those two inventory rows match.
+
 - **`kxm improve report` and `kxm routing report` include attempts settled in a registered lane.**
   Inside a KXM project, a present user-state `registry.db` is opened read-only at schema version 2. One query loads the home row and every lane row for that project id. Event-store paths come from the stored project keys, so a stale checkout path cannot hide a lane. A missing store stays a zero-record source. An absent registry, or a checkout that is not registered, still reads only that checkout's own store. `--file` still reads only the named file. See
   [kxm improve report](docs/reference/cli-reference.md#kxm-improve-report).

package/docs/contributing/ci-and-release.md

@@ -46,7 +46,7 @@ together.
 | Push to `main`, or manual | `ci.yml` (Validate matrix) | `validate:pr` on Linux and Windows for Node 22.19.0 and Node 24; not on a pull request |
 | Code pull request and code push | `ci.yml` (Plugin validation) | `claude plugin validate --strict` on the marketplace and the plugin |
 | Daily at 04:00 UTC, or manual | `nightly.yml` | `test:coverage:complete`, `check`, `check:generated`, `npm pack --dry-run` |
-| Monday at 13:00 UTC, or manual | `refresh-models.yml` | Fetches the public OpenRouter catalog, and opens or updates one pull request on `automation/model-refresh` when `.kxm/prices.yaml` or `.kxm/models/inventory.yaml` changes. Uses `GITHUB_TOKEN` only, then dispatches `ci.yml` on that branch |
+| Monday at 13:00 UTC, or manual | `refresh-models.yml` | Fetches the public OpenRouter catalog, and opens or updates one pull request on `automation/model-refresh` when `.kxm/prices.yaml` or `.kxm/models/inventory.yaml` changes. The pull request uses a GitHub App token from `KXM_REFRESH_APP_ID` and `KXM_REFRESH_APP_PRIVATE_KEY` (`actions/create-github-app-token`). `GITHUB_TOKEN` posts `model-catalog-guard` and dispatches `ci.yml` on that branch. App setup is in [Refresh model prices and inventory](development.md#refresh-model-prices-and-inventory) |
 | Merged pull request | `auto-release.yml` | Tags the merge commit and dispatches `release.yml` |
 | Tag push or dispatch | `release.yml` | Verifies, packs and publishes (see [Release flow](#release-flow)) |
 | Manual only | `smoke.yml` | Real Pi smoke, currently disabled (see [Smoke tests](#smoke-tests)) |

package/docs/contributing/development.md

@@ -418,6 +418,43 @@ Review the diff and commit it yourself, or wait for the Monday pull request on
 `automation/model-refresh`. The field reference is
 [Weekly OpenRouter refresh](../reference/config-reference.md#weekly-openrouter-refresh).
 
+The Monday job opens that pull request with a GitHub App installation token,
+not the workflow's `GITHUB_TOKEN`. This repository does not permit GitHub
+Actions to create pull requests, and the workflow does not change that
+setting. The App is installed on `kontextmind/kxm` only. Its repository
+permissions are Contents read and write, and Pull requests read and write.
+No other repository is installed, and the token asks only for those two
+permissions on `kxm`.
+
+Create the App as an organization owner:
+
+1. Open [New GitHub App](https://github.com/organizations/kontextmind/settings/apps/new).
+   Set the homepage URL to `https://github.com/kontextmind/kxm`. Uncheck
+   Active under Webhook. The workflow only mints an installation token.
+2. Under Repository permissions, set **Contents** to Read and write and
+   **Pull requests** to Read and write. Leave every other permission at No
+   access.
+3. Under "Where can this GitHub App be installed?", choose **Only on this
+   account**. Create the App.
+4. On the App's settings page, copy the numeric **App ID**. Generate a
+   private key and keep the downloaded PEM.
+5. Install the App: **Install App**, then **Only select repositories**,
+   then `kontextmind/kxm`, then Install. Do not install it on any other
+   repository.
+6. On [Actions secrets](https://github.com/kontextmind/kxm/settings/secrets/actions)
+   for this repository, add `KXM_REFRESH_APP_ID` (the numeric App ID, not
+   the Client ID) and `KXM_REFRESH_APP_PRIVATE_KEY` (the full PEM, including
+   the `BEGIN` and `END` lines).
+
+`actions/create-github-app-token` reads those secrets as `app-id` and
+`private-key`. If either secret is missing, the job fails before it pushes
+and names both `KXM_REFRESH_APP_ID` and `KXM_REFRESH_APP_PRIVATE_KEY`. An
+unchanged catalog still requires the secrets: a Monday with no diff exits 0
+only after both are set. The workflow `GITHUB_TOKEN` still posts the
+`model-catalog-guard` commit status and dispatches `ci.yml`, because the App
+is not granted statuses or actions. Do not turn on "Allow GitHub Actions to
+create and approve pull requests."
+
 `kxm models inventory-refresh` still rewrites the whole inventory from Pi, Grok,
 agy, OpenRouter, and Nous, including a new `fetchedAt` timestamp. The weekly
 script does not call those local CLIs.

package/docs/contributing/harness-routing-internals.md

@@ -76,7 +76,7 @@ On the capture machine, `kxm harness list` showed `claude` detected but logged o
 
 ### Price catalog and inventory
 
-`.kxm/prices.yaml` is dated `2026-10-17`. A run on that date can record a list estimate. Any other day records `providerMetadata.priceCatalogStale: true` and no list estimate. The list prices below come from `.kxm/models/inventory.yaml`. OpenRouter and Nous were fetched at `2026-10-17T13:45:00.000Z`. `pi`, `grok`, and `agy` were not installed for that refresh, so models that exist only in those CLIs stay, including the previous `agy` rows, and the Gemini 4 Argon and Claude 5.5 `agy` rows were added by hand from `agy models`. Prices are USD per 1M tokens. The checkout has no routing records yet, so none of the examples has recorded latency; for latency, run a bounded side-by-side experiment and compare p50 and p95 in `kxm routing report`.
+`.kxm/prices.yaml` is dated `2026-10-20`. A run on that date can record a list estimate. Any other day records `providerMetadata.priceCatalogStale: true` and no list estimate. The list prices below come from `.kxm/models/inventory.yaml`. OpenRouter and Nous were fetched at `2026-10-17T13:45:00.000Z`. `pi`, `grok`, and `agy` were not installed for that refresh, so models that exist only in those CLIs stay, including the previous `agy` rows, and the Gemini 4 Argon and Claude 5.5 `agy` rows were added by hand from `agy models`. Prices are USD per 1M tokens. The checkout has no routing records yet, so none of the examples has recorded latency; for latency, run a bounded side-by-side experiment and compare p50 and p95 in `kxm routing report`.
 
 ## The developer roster
 
@@ -182,7 +182,7 @@ The code differs from that decision: `.kxm/routes.yaml` admits `google/gemini-3.
 |---|---|---|---|
 | Qwen3.8 Flash | `qwen-token-plan/qwen3.8-flash`: removed from the admitted list on 2026-09-27; `qwen-token-plan` is not allowlisted | `openrouter/qwen/qwen3.8-flash`: admitted, route `pi-qwen3-8-flash-openrouter`, read-only fallback for planner and reviewer-cli | `prices.yaml` keeps both rows. |
 | Qwen3.7 Plus | none | `openrouter/qwen/qwen3.7-plus`: route `pi-qwen3-7-plus-openrouter`, writer #2 | The only admitted Pi writer: exact model, `edit` permission. OpenRouter list on 2026-10-17 is $0.32 input and $1.28 output per 1M tokens, 1,000,000 context, tools supported. |
-| GLM 5.3 and 5.3 Flash | `zai-coding-cn/glm-5.3` and `…/glm-5.3-flash`: removed from the admitted list on 2026-09-27; `zai-coding-cn` is not allowlisted | `openrouter/z-ai/glm-5.3-flash`: admitted, route `pi-glm-5-3-flash-openrouter`, read-only fallback for reviewer-arch | Z.ai has no native harness. |
+| GLM 5.3 and 5.3 Flash | `zai-coding-cn/glm-5.3` and `…/glm-5.3-flash`: removed from the admitted list on 2026-09-27; `zai-coding-cn` is not allowlisted. The flash coding-plan row keeps $0.15 / $0.50 (cache read $0.03). `zai-coding-cn/glm-5.3` output is $1.40 | `openrouter/z-ai/glm-5.3-flash`: admitted, route `pi-glm-5-3-flash-openrouter`, read-only fallback for reviewer-arch. Its own tier, verified 2026-10-20: $0.047076 input, $0.12 output, $0.006 cache read | Z.ai has no native harness. The two flash rows do not share a YAML anchor. |
 | DeepSeek V4.1 Flash | `qwen-token-plan/deepseek-v4.1-flash`: removed from the admitted list on 2026-09-27 | `deepseek/deepseek-v4.1-flash` in the OpenRouter feed | Bills a DeepSeek model through Alibaba's plan. `deepseek` is a native-vendor Pi brake, so this is not a route. |
 
 The developer runner is stricter. Its only Pi writer is `openrouter/qwen/qwen3.7-plus`, and it does not allowlist `qwen-token-plan` or `zai-coding-cn`. Today OpenRouter is the right answer here for Qwen3.7 Plus, Qwen3.8 Flash and GLM 5.3 Flash. `qwen/qwen3-coder-plus` is retired.

package/docs/reference/config-reference.md

@@ -1311,8 +1311,13 @@ node --disable-warning=ExperimentalWarning --experimental-strip-types scripts/re
 `--dry-run` prints the summary and writes nothing. Exit 2 means a referenced
 model would be kept after leaving the catalog. The workflow pushes a non-empty
 diff to `automation/model-refresh` and opens or updates one pull request with
-`GITHUB_TOKEN`. It then dispatches `ci.yml` on that branch, because a push
-made with `GITHUB_TOKEN` does not start CI by itself.
+a GitHub App installation token (`KXM_REFRESH_APP_ID` and
+`KXM_REFRESH_APP_PRIVATE_KEY`). The App is installed on `kontextmind/kxm`
+only, with Contents read and write and Pull requests read and write. A missing
+secret fails the job and names both secrets. Setup is in
+[Refresh model prices and inventory](../contributing/development.md#refresh-model-prices-and-inventory).
+`GITHUB_TOKEN` posts the `model-catalog-guard` status and dispatches `ci.yml`
+on that branch. `ci.yml` does not run on a push to `automation/model-refresh`.
 
 ## Personalization settings (`kxm.config.v1`)
 

package/docs/reference/harness-routing.md

@@ -528,8 +528,9 @@ OpenRouter list prices in `.kxm/prices.yaml` and `.kxm/models/inventory.yaml`
 go stale as models are added, removed, and repriced. A Monday 13:00 UTC
 workflow, `.github/workflows/refresh-models.yml`, fetches the public OpenRouter
 models API and opens one pull request on `automation/model-refresh` when the
-catalog changed. The pull request body lists models added, removed, and
-repriced. A route or roster model that disappeared, or whose input or output
+catalog changed. The pull request is opened with a GitHub App token. App
+setup is in [Refresh model prices and inventory](../contributing/development.md#refresh-model-prices-and-inventory).
+The pull request body lists models added, removed, and repriced. A route or roster model that disappeared, or whose input or output
 rate moved by more than 20 percent, is listed first. A disappeared referenced
 model stays in the inventory with `missingUpstream: true`, and the
 `model-catalog-guard` check fails until someone removes the reference or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.192",
+  "version": "0.7.193",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.192",
+  "version": "0.7.193",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/mcp-server.js

@@ -25462,7 +25462,7 @@ function sessionTokenFixHint(policy) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.192";
+var VERSION = "0.7.193";
 var CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.192",
+  "version": "0.7.193",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/src/mcp-server.ts

@@ -11,7 +11,7 @@ import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 import { sessionTokenFixHint } from "./session-token-hint.ts";
 
-const VERSION = "0.7.192";
+const VERSION = "0.7.193";
 const CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();

package/plugins/kxm/src/model-catalog-refresh.ts

@@ -1,6 +1,6 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { isAlias, isMap, isSeq, parse, parseDocument, stringify, type YAMLMap } from "yaml";
+import { isAlias, isMap, isSeq, parse, parseDocument, stringify, type YAMLMap, type YAMLSeq } from "yaml";
 import type { PriceCatalog } from "./price-calc.ts";
 import { hashPriceCatalog, parsePriceCatalog } from "./prices.ts";
 import {
@@ -131,7 +131,9 @@ function priceRowTokens(row: LoosePriceRow): string[] {
   if (row.model.includes("/")) add(row.model);
   else add(`${row.provider}/${row.model}`);
   // Aliases on native and OpenRouter rows point at the catalog id. A different
-  // plan (qwen-token-plan, zai-coding-cn) keeps its own rate unless it shares a YAML anchor.
+  // plan (qwen-token-plan, zai-coding-cn) keeps its own rate. A YAML anchor that
+  // a non-OpenRouter row depends on is not rewritten: the OpenRouter row is
+  // detached onto its own tier and the plan row keeps the anchored rates.
   const trackAliases = new Set(["anthropic", "openai", "google", "xai", "openrouter"]);
   if (trackAliases.has(row.provider)) {
     for (const alias of row.aliases ?? []) add(alias.includes("/") ? alias : `${row.provider}/${alias}`);
@@ -250,6 +252,71 @@ function writeTierRates(map: YAMLMap, previous: InventoryPrice, incoming: Invent
   return changed;
 }
 
+function mapString(row: YAMLMap, key: string): string | undefined {
+  const value = row.get(key);
+  return typeof value === "string" ? value : undefined;
+}
+
+function soleTier(row: YAMLMap): { tiers: YAMLSeq; tier: unknown } | undefined {
+  const tiers = row.get("tiers", true);
+  if (!isSeq(tiers) || tiers.items.length !== 1) return undefined;
+  return { tiers, tier: tiers.items[0] };
+}
+
+function anchorName(tier: unknown): string | undefined {
+  if (isMap(tier) && tier.anchor) return tier.anchor;
+  if (isAlias(tier)) return tier.source;
+  return undefined;
+}
+
+function nonOpenRouterDependsOn(models: YAMLSeq, anchor: string): boolean {
+  for (const row of models.items) {
+    if (!isMap(row) || mapString(row, "provider") === "openrouter") continue;
+    const sole = soleTier(row);
+    if (sole && anchorName(sole.tier) === anchor) return true;
+  }
+  return false;
+}
+
+function rateTierNode(doc: ReturnType<typeof parseDocument>, rates: InventoryPrice, anchor?: string): YAMLMap {
+  const node = doc.createNode({
+    inputPerMillion: rates.inputPerMillion,
+    outputPerMillion: rates.outputPerMillion,
+    cacheReadPerMillion: rates.cacheReadPerMillion,
+    cacheWritePerMillion: rates.cacheWritePerMillion,
+  });
+  if (!isMap(node)) throw new Error("price tier must be a map");
+  if (anchor) node.anchor = anchor;
+  return node;
+}
+
+/**
+ * Gives an OpenRouter row its own tier. The shared anchor, and every
+ * non-OpenRouter row that uses it, keep the rates they had.
+ */
+function detachOpenRouterTier(doc: ReturnType<typeof parseDocument>, models: YAMLSeq, row: YAMLMap, anchor: string, incoming: InventoryPrice): boolean {
+  const sole = soleTier(row);
+  if (!sole) return false;
+  const { tiers, tier } = sole;
+  if (isAlias(tier)) {
+    tiers.items[0] = rateTierNode(doc, incoming);
+    return true;
+  }
+  if (!isMap(tier) || tier.anchor !== anchor) return false;
+  const previous = tierRates(tier.toJSON() as Record<string, unknown>);
+  if (!previous) return false;
+  for (const other of models.items) {
+    if (!isMap(other) || other === row || mapString(other, "provider") === "openrouter") continue;
+    const alias = soleTier(other);
+    if (!alias || !isAlias(alias.tier) || alias.tier.source !== anchor) continue;
+    delete tier.anchor;
+    alias.tiers.items[0] = rateTierNode(doc, previous, anchor);
+    tiers.items[0] = rateTierNode(doc, incoming);
+    return true;
+  }
+  return false;
+}
+
 function updatePrices(text: string, updates: Map<string, InventoryPrice>, date: string): { text: string; dateChanged: boolean } {
   if (updates.size === 0) return { text, dateChanged: false };
   const doc = parseDocument(text);
@@ -271,9 +338,14 @@ function updatePrices(text: string, updates: Map<string, InventoryPrice>, date:
     if (typeof id !== "string" || !updates.has(id)) continue;
     const incoming = updates.get(id);
     if (!incoming) continue;
-    const tiers = row.get("tiers", true);
-    if (!isSeq(tiers) || tiers.items.length !== 1) continue;
-    const tier = tiers.items[0];
+    const sole = soleTier(row);
+    if (!sole) continue;
+    const { tier } = sole;
+    const name = anchorName(tier);
+    if (name && mapString(row, "provider") === "openrouter" && nonOpenRouterDependsOn(models, name)) {
+      if (detachOpenRouterTier(doc, models, row, name, incoming)) wrote = true;
+      continue;
+    }
     const target = isMap(tier) ? tier : (isAlias(tier) ? maps.get(String(tier.source)) : undefined);
     if (!target || seen.has(target)) continue;
     seen.add(target);