@linxiraos/pi-catalog 1.1.26 → 1.2.0

package/src/model-cache.ts

@@ -3,6 +3,7 @@
  * Replaces per-provider JSON files with a single cache.db.
  */
 import type { Database } from "bun:sqlite";
+import * as path from "node:path";
 import { getModelDbPath, isSqliteCorruptionError, logger, openSqliteDatabaseSync, VERSION } from "@linxiraos/pi-utils";
 import RULES from "./compat/rules.json" with { type: "json" };
 import type { Api, Model } from "./types";
@@ -46,14 +47,19 @@ function materializationPolicy(): string {
 	return cachedMaterializationPolicy;
 }
 
-interface CacheRow {
+interface CacheRowMeta {
 	provider_id: string;
 	version: number;
 	materialization_policy: string;
 	updated_at: number;
 	authoritative: number;
 	static_fingerprint: string;
-	models: string;
+	/**
+	 * `Bun.hash` of `models`; empty for rows written before the column existed
+	 * (never equal). An in-place `UPDATE` of `models` that leaves the hash
+	 * untouched resets it to empty (`model_cache_models_hash_reset` trigger).
+	 */
+	models_hash: string;
 	header_omitted_model_ids: string;
 	unrestorable_header_model_ids: string;
 	header_restore_version: number;
@@ -63,6 +69,10 @@ interface CacheRow {
 	refresh_authoritative: number | null;
 }
 
+interface CacheRow extends CacheRowMeta {
+	models: string;
+}
+
 /**
  * Payload rows are multi-MB and SQLite rewrites a whole record (including its
  * overflow pages) on any column update. Freshness that advances without a
@@ -71,15 +81,23 @@ interface CacheRow {
  * the payload row's `updated_at`, so a payload rewritten by another binary
  * silently invalidates it.
  */
-const SELECT_CACHE_ROW = `
-	SELECT m.*,
-		r.payload_updated_at AS refresh_payload_updated_at,
-		r.updated_at AS refresh_updated_at,
-		r.authoritative AS refresh_authoritative
+const CACHE_ROW_FROM = `
 	FROM model_cache m
 	LEFT JOIN model_cache_refresh r ON r.provider_id = m.provider_id
 	WHERE m.provider_id = ?
 `;
+const CACHE_ROW_REFRESH_COLUMNS = `
+		r.payload_updated_at AS refresh_payload_updated_at,
+		r.updated_at AS refresh_updated_at,
+		r.authoritative AS refresh_authoritative`;
+const SELECT_CACHE_ROW = `SELECT m.*, ${CACHE_ROW_REFRESH_COLUMNS} ${CACHE_ROW_FROM}`;
+/** Scalar columns plus `models_hash`: validates a memoized parse without reading the multi-MB payload. */
+const SELECT_CACHE_ROW_META = `
+	SELECT m.provider_id, m.version, m.materialization_policy, m.updated_at, m.authoritative,
+		m.static_fingerprint, m.models_hash, m.header_omitted_model_ids,
+		m.unrestorable_header_model_ids, m.header_restore_version, ${CACHE_ROW_REFRESH_COLUMNS}
+	${CACHE_ROW_FROM}
+`;
 
 /** Cumulative model-cache write counters for this process. */
 export interface ModelCacheWriteStats {
@@ -149,8 +167,11 @@ let sharedDbPath: string | null = null;
 interface ReadRowCacheEntry {
 	/** `PRAGMA data_version` of the shared connection when validated; null for per-call connections. */
 	dataVersion: number | null;
-	/** Raw row the entry was parsed from; null when the row was absent or rejected. */
-	row: CacheRow | null;
+	/**
+	 * Scalar columns (plus `models_hash`) of the row the entry was parsed from;
+	 * null when the row was absent or rejected. Never the multi-MB payload itself.
+	 */
+	meta: CacheRowMeta | null;
 	entry: CacheEntry<Api> | null;
 }
 
@@ -182,7 +203,7 @@ function withFreshness<TApi extends Api>(
 }
 function invalidateReadRow(providerId: string, dbPath?: string): void {
 	try {
-		readRowCache.delete(readCacheKey(dbPath ?? getModelDbPath(), providerId));
+		readRowCache.delete(readCacheKey(resolveCacheDb(dbPath).resolvedPath, providerId));
 	} catch {
 		// Best-effort only; a missed invalidation just costs one extra parse.
 	}
@@ -213,6 +234,7 @@ function initializeDb(db: Database): void {
 			header_omitted_model_ids TEXT NOT NULL DEFAULT '[]',
 			unrestorable_header_model_ids TEXT NOT NULL DEFAULT '[]',
 			header_restore_version INTEGER NOT NULL DEFAULT 0,
+			models_hash TEXT NOT NULL DEFAULT '',
 			models TEXT NOT NULL
 		)
 	`);
@@ -225,6 +247,17 @@ function initializeDb(db: Database): void {
 		)
 	`);
 	migrateCacheSchema(db);
+	// `models_hash` is the only payload-change detector for the read memo and the
+	// unchanged-write skip. Writers here replace whole rows; this keeps an
+	// in-place edit of `models` by any other tool or binary from reusing a stale hash.
+	db.run(`
+		CREATE TRIGGER IF NOT EXISTS model_cache_models_hash_reset
+		AFTER UPDATE OF models ON model_cache
+		WHEN NEW.models_hash = OLD.models_hash
+		BEGIN
+			UPDATE model_cache SET models_hash = '' WHERE provider_id = NEW.provider_id;
+		END
+	`);
 }
 
 function closeSharedDb(): void {
@@ -234,6 +267,16 @@ function closeSharedDb(): void {
 	sharedDbPath = null;
 }
 
+/**
+ * Closes the shared handle to the default `<agent-dir>/models.db`; the next
+ * default-path access reopens it. Call before deleting an agent directory the
+ * cache was opened under — Windows cannot remove a database that is still open.
+ */
+export function closeModelCache(): void {
+	if (sharedDbPath) invalidateReadPath(sharedDbPath);
+	closeSharedDb();
+}
+
 function runModelCacheDb<T>(resolvedPath: string, shared: boolean, useDb: (db: Database) => T): T {
 	if (shared && sharedDb && sharedDbPath !== resolvedPath) closeSharedDb();
 	if (shared && sharedDb) {
@@ -270,8 +313,22 @@ function runModelCacheDb<T>(resolvedPath: string, shared: boolean, useDb: (db: D
 }
 
 function withModelCacheDb<T>(dbPath: string | undefined, useDb: (db: Database) => T): T {
-	const resolvedPath = dbPath ?? getModelDbPath();
-	return runModelCacheDb(resolvedPath, dbPath === undefined, useDb);
+	const { resolvedPath, shared } = resolveCacheDb(dbPath);
+	return runModelCacheDb(resolvedPath, shared, useDb);
+}
+
+/**
+ * An explicit path naming the default `models.db` (e.g. the SDK passing
+ * `getModelDbPath(agentDir)` for the default agent dir) shares the long-lived
+ * handle, so it gets the `data_version` fast path instead of opening,
+ * initializing and re-reading the row on every call.
+ */
+function resolveCacheDb(dbPath: string | undefined): { resolvedPath: string; shared: boolean } {
+	const defaultPath = getModelDbPath();
+	if (dbPath === undefined || dbPath === defaultPath || path.resolve(dbPath) === path.resolve(defaultPath)) {
+		return { resolvedPath: defaultPath, shared: true };
+	}
+	return { resolvedPath: dbPath, shared: false };
 }
 
 function migrateCacheSchema(db: Database): void {
@@ -296,6 +353,12 @@ function migrateCacheSchema(db: Database): void {
 			// header matching was introduced.
 			db.run("ALTER TABLE model_cache ADD COLUMN header_restore_version INTEGER NOT NULL DEFAULT 0");
 		}
+		if (!columns.some(column => column.name === "models_hash")) {
+			// Rows from older binaries keep '' (never equal), so they are re-read in
+			// full until the next write records their hash; no version bump needed.
+			// Older binaries rewriting a row via INSERT OR REPLACE reset it to ''.
+			db.run("ALTER TABLE model_cache ADD COLUMN models_hash TEXT NOT NULL DEFAULT ''");
+		}
 	} finally {
 		stmt.finalize();
 	}
@@ -409,15 +472,14 @@ export function readModelCache<TApi extends Api>(
 	dbPath?: string,
 ): CacheEntry<TApi> | null {
 	try {
-		const resolvedPath = dbPath ?? getModelDbPath();
-		const key = readCacheKey(resolvedPath, providerId);
 		// Monotonic change signal: same-shaped WAL overwrites after checkpoint
 		// can leave every size:mtime pair identical, so file metadata alone
 		// cannot invalidate. PRAGMA data_version increments on each committed
 		// write transaction visible to a new reader. It is only comparable
 		// across calls on the same connection, so it gates the no-query fast
 		// path for the shared handle only.
-		const shared = dbPath === undefined;
+		const { resolvedPath, shared } = resolveCacheDb(dbPath);
+		const key = readCacheKey(resolvedPath, providerId);
 		return runModelCacheDb(resolvedPath, shared, db => {
 			const dataVersion = shared ? dbDataVersion(db) : null;
 			const cached = readRowCache.get(key);
@@ -426,34 +488,32 @@ export function readModelCache<TApi extends Api>(
 				// cached row's updatedAt so a long-lived process goes stale.
 				return withFreshness(cached.entry as CacheEntry<TApi> | null, ttlMs, now);
 			}
-			// Any commit (to any provider's row) bumps data_version. Re-read this
-			// row, but reuse the parsed entry when its bytes are unchanged.
-			const stmt = db.query<CacheRow, [string]>(SELECT_CACHE_ROW);
-			let row: CacheRow | null;
-			try {
-				row = stmt.get(providerId);
-			} finally {
-				stmt.finalize();
+			// Any commit (to any provider's row) bumps data_version. Validate the
+			// memoized parse against the row's scalar columns and payload hash
+			// first; only a changed payload pays for the multi-MB `models` read.
+			let entry: CacheEntry<TApi> | null = null;
+			let meta: CacheRowMeta | null = null;
+			if (cached?.entry && cached.meta) {
+				meta = queryRow<CacheRowMeta>(db, SELECT_CACHE_ROW_META, providerId);
+				if (meta && meta.materialization_policy === materializationPolicy() && cacheRowsEqual(cached.meta, meta)) {
+					// Payload unchanged; only side-table freshness may have moved.
+					entry = withFreshness(withRowState(cached.entry as CacheEntry<TApi>, meta), ttlMs, now);
+				} else {
+					meta = null;
+				}
 			}
-			let entry: CacheEntry<TApi> | null;
-			if (
-				cached?.entry &&
-				cached.row &&
-				row &&
-				row.materialization_policy === materializationPolicy() &&
-				cacheRowsEqual(cached.row, row)
-			) {
-				// Payload bytes unchanged; only side-table freshness may have moved.
-				entry = withFreshness(withRowState(cached.entry as CacheEntry<TApi>, row), ttlMs, now);
-			} else {
+			if (entry === null) {
+				// One statement reads payload and scalars from the same snapshot.
+				const row = queryRow<CacheRow>(db, SELECT_CACHE_ROW, providerId);
 				entry = parseCacheRow<TApi>(db, providerId, row, ttlMs, now);
+				if (entry !== null && row !== null) {
+					// Drop the payload so the memo never pins the multi-MB `models` string.
+					const { models: _models, ...rowScalars } = row;
+					meta = rowScalars;
+				}
 			}
 			if (readRowCache.size >= READ_ROW_CACHE_MAX) readRowCache.clear();
-			readRowCache.set(key, {
-				dataVersion,
-				row: entry === null ? null : row,
-				entry: entry as CacheEntry<Api> | null,
-			});
+			readRowCache.set(key, { dataVersion, meta, entry: entry as CacheEntry<Api> | null });
 			return entry;
 		});
 	} catch {
@@ -461,8 +521,20 @@ export function readModelCache<TApi extends Api>(
 	}
 }
 
-/** Whether two rows carry the same payload record (refresh side-row columns excluded). */
-function cacheRowsEqual(left: CacheRow, right: CacheRow): boolean {
+function queryRow<T>(db: Database, sql: string, providerId: string): T | null {
+	const stmt = db.query<T, [string]>(sql);
+	try {
+		return stmt.get(providerId);
+	} finally {
+		stmt.finalize();
+	}
+}
+
+/**
+ * Whether two rows carry the same payload record (refresh side-row columns
+ * excluded). Payloads compare by `models_hash`; rows without one never match.
+ */
+function cacheRowsEqual(left: CacheRowMeta, right: CacheRowMeta): boolean {
 	return (
 		left.version === right.version &&
 		left.materialization_policy === right.materialization_policy &&
@@ -472,7 +544,8 @@ function cacheRowsEqual(left: CacheRow, right: CacheRow): boolean {
 		left.header_omitted_model_ids === right.header_omitted_model_ids &&
 		left.unrestorable_header_model_ids === right.unrestorable_header_model_ids &&
 		left.header_restore_version === right.header_restore_version &&
-		left.models === right.models
+		left.models_hash !== "" &&
+		left.models_hash === right.models_hash
 	);
 }
 
@@ -488,7 +561,7 @@ function rowState(row: StoredRowState): { updatedAt: number; authoritative: bool
 	return { updatedAt: row.updated_at, authoritative: row.authoritative === 1 };
 }
 
-function withRowState<TApi extends Api>(entry: CacheEntry<TApi>, row: CacheRow): CacheEntry<TApi> {
+function withRowState<TApi extends Api>(entry: CacheEntry<TApi>, row: StoredRowState): CacheEntry<TApi> {
 	const { updatedAt, authoritative } = rowState(row);
 	return entry.updatedAt === updatedAt && entry.authoritative === authoritative
 		? entry
@@ -638,6 +711,8 @@ export function writeModelCache<TApi extends Api>(
 			const serializedHeaderOmitted = JSON.stringify(headerOmittedModelIds);
 			const serializedUnrestorable = JSON.stringify(unrestorableHeaderModelIds);
 			const serializedModels = JSON.stringify(cachedModels);
+			// Length prefix: a collision would also need an equal payload size.
+			const modelsHash = `${serializedModels.length.toString(36)}:${Bun.hash(serializedModels).toString(36)}`;
 			const outcome = db
 				.transaction((): "skipped" | "refreshed" | "written" => {
 					const matchStmt = db.prepare<
@@ -652,7 +727,7 @@ export function writeModelCache<TApi extends Api>(
 						LEFT JOIN model_cache_refresh r ON r.provider_id = m.provider_id
 						WHERE m.provider_id = ? AND m.version = ? AND m.materialization_policy = ?
 							AND m.static_fingerprint = ? AND m.header_omitted_model_ids = ?
-							AND m.unrestorable_header_model_ids = ? AND m.header_restore_version = ? AND m.models = ?`,
+							AND m.unrestorable_header_model_ids = ? AND m.header_restore_version = ? AND m.models_hash = ?`,
 					);
 					let stored: StoredRowState | null;
 					try {
@@ -664,7 +739,7 @@ export function writeModelCache<TApi extends Api>(
 							serializedHeaderOmitted,
 							serializedUnrestorable,
 							HEADER_RESTORE_VERSION,
-							serializedModels,
+							modelsHash,
 						);
 					} finally {
 						matchStmt.finalize();
@@ -687,8 +762,8 @@ export function writeModelCache<TApi extends Api>(
 						`INSERT OR REPLACE INTO model_cache (
 							provider_id, version, materialization_policy, updated_at, authoritative, static_fingerprint,
 							header_omitted_model_ids, unrestorable_header_model_ids,
-							header_restore_version, models
-						) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+							header_restore_version, models_hash, models
+						) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 						[
 							providerId,
 							CACHE_SCHEMA_VERSION,
@@ -699,6 +774,7 @@ export function writeModelCache<TApi extends Api>(
 							serializedHeaderOmitted,
 							serializedUnrestorable,
 							HEADER_RESTORE_VERSION,
+							modelsHash,
 							serializedModels,
 						],
 					);

package/src/model-manager.d.ts

@@ -35,6 +35,22 @@ export interface ModelManagerOptions<TApi extends Api = Api, TModelsDevPayload =
     cacheTtlMs?: number;
     /** When true, a successful dynamic fetch is the complete provider catalog and prunes static-only models. */
     dynamicModelsAuthoritative?: boolean;
+    /**
+     * When true, a provider's dynamic rows are the deployment's whole truth
+     * for input modality: a live text-only row strips the bundled reference's
+     * image support instead of OR-merging it back. Declared by providers whose
+     * capability flags are authoritative and whose endpoints reject
+     * unsupported content (`github-copilot`, `deepinfra`, `coralbricks`).
+     */
+    dynamicInputAuthoritative?: boolean;
+    /** When true, live reasoning capability replaces the fallback, including an explicit false. */
+    dynamicReasoningAuthoritative?: boolean;
+    /**
+     * When true, a live per-million price replaces the fallback even when it is
+     * an explicit `0` (a free model or a dropped cache-write charge). Without it,
+     * a zero discovery price is treated as unknown and the bundled rate is kept.
+     */
+    dynamicCostAuthoritative?: boolean;
     /**
      * When true, a fresh cache never satisfies an online-eligible refresh: the
      * dynamic fetch always runs (an explicit `"offline"` strategy is still

package/src/model-manager.ts

@@ -1,4 +1,4 @@
-import { VERSION } from "@linxiraos/pi-utils";
+import { logger, VERSION } from "@linxiraos/pi-utils";
 import { buildModel } from "./build";
 import { collapseBuiltVariants } from "./compat/collapse";
 import { applyCatalogMetrics, CatalogMetricsIndex } from "./identity/metrics";
@@ -57,6 +57,22 @@ export interface ModelManagerOptions<TApi extends Api = Api, TModelsDevPayload =
 	cacheTtlMs?: number;
 	/** When true, a successful dynamic fetch is the complete provider catalog and prunes static-only models. */
 	dynamicModelsAuthoritative?: boolean;
+	/**
+	 * When true, a provider's dynamic rows are the deployment's whole truth
+	 * for input modality: a live text-only row strips the bundled reference's
+	 * image support instead of OR-merging it back. Declared by providers whose
+	 * capability flags are authoritative and whose endpoints reject
+	 * unsupported content (`github-copilot`, `deepinfra`, `coralbricks`).
+	 */
+	dynamicInputAuthoritative?: boolean;
+	/** When true, live reasoning capability replaces the fallback, including an explicit false. */
+	dynamicReasoningAuthoritative?: boolean;
+	/**
+	 * When true, a live per-million price replaces the fallback even when it is
+	 * an explicit `0` (a free model or a dropped cache-write charge). Without it,
+	 * a zero discovery price is treated as unknown and the bundled rate is kept.
+	 */
+	dynamicCostAuthoritative?: boolean;
 	/**
 	 * When true, a fresh cache never satisfies an online-eligible refresh: the
 	 * dynamic fetch always runs (an explicit `"offline"` strategy is still
@@ -255,6 +271,11 @@ export async function resolveProviderModels<TApi extends Api = Api, TModelsDevPa
 	const usableCachedModels = restoredCache.models.filter(model => !restoredCache.unresolvedModelIds.has(model.id));
 	const cacheHasUnresolvedHeaders = restoredCache.unresolvedModelIds.size > 0;
 	const dynamicModelsAuthoritative = options.dynamicModelsAuthoritative ?? false;
+	const mergeAuthority: DynamicMergeAuthority = {
+		input: options.dynamicInputAuthoritative ?? false,
+		reasoning: options.dynamicReasoningAuthoritative ?? false,
+		cost: options.dynamicCostAuthoritative ?? false,
+	};
 	const cacheDropIds = options.dropCachedModelIdsOnStaticMismatch;
 	const staticCatalogFingerprint = fingerprintStaticModels(staticModels, dynamicModelsAuthoritative);
 	// Endpoint-migration policy is cache identity: adding an id must invalidate
@@ -298,7 +319,10 @@ export async function resolveProviderModels<TApi extends Api = Api, TModelsDevPa
 			? restoredCache.models.filter(model => !additiveStaticModelIds.has(model.id))
 			: restoredCache.models;
 		const cachedModels = additiveStaticModelIds
-			? mergeCatalogMetrics(mergeDynamicModels(staticModels, cacheContribution), restoredCache.models)
+			? mergeCatalogMetrics(
+					mergeDynamicModels(staticModels, cacheContribution, mergeAuthority),
+					restoredCache.models,
+				)
 			: restoredCache.models;
 		const source: ModelResolutionSource = cacheContribution.length > 0 ? "cache" : "bundled";
 		return {
@@ -351,10 +375,11 @@ export async function resolveProviderModels<TApi extends Api = Api, TModelsDevPa
 			dynamicModels.length > 0 &&
 			(dynamicModelsAuthoritative || !hasModelsDevFetcher || modelsDevFetchSucceeded)
 		: modelsDevFetchSucceeded;
-	const mergedWithCache = mergeDynamicModels(staticModels, cacheModels);
+	const mergedWithCache = mergeDynamicModels(staticModels, cacheModels, mergeAuthority);
 	const mergedWithModelsDev = mergeDynamicModels(
 		mergedWithCache,
 		modelsDevModels,
+		mergeAuthority,
 		fetchedModelsDevModels?.explicitKindModels,
 	);
 	const catalogMetricsSource = modelsDevFetchSucceeded ? normalizedModelsDevModels : preparedCacheModels;
@@ -364,6 +389,7 @@ export async function resolveProviderModels<TApi extends Api = Api, TModelsDevPa
 	const mergedModels = mergeDynamicModels(
 		mergedWithCatalogMetrics,
 		dynamicModels,
+		mergeAuthority,
 		fetchedDynamicModels?.explicitKindModels,
 	);
 	const models = collapseBuiltVariants(
@@ -416,7 +442,11 @@ export async function resolveProviderModels<TApi extends Api = Api, TModelsDevPa
 				? preparedLatestCacheModels.filter(model => !additiveStaticModelIds.has(model.id))
 				: preparedLatestCacheModels;
 			const fallbackSnapshotModels = collapseBuiltVariants(
-				mergeDynamicModels(mergeDynamicModels(staticModels, latestCacheModels), modelsDevModels),
+				mergeDynamicModels(
+					mergeDynamicModels(staticModels, latestCacheModels, mergeAuthority),
+					modelsDevModels,
+					mergeAuthority,
+				),
 			);
 			if (fallbackSnapshotModels.length > 0 || latestCache !== null || cache !== null) {
 				writeModelCache(
@@ -544,9 +574,20 @@ function mergeCatalogMetrics<TApi extends Api>(
 	return applyCatalogMetrics(models, new CatalogMetricsIndex(catalogModels));
 }
 
+/**
+ * Which dynamic-row fields replace the existing row outright instead of
+ * merging additively. Set per provider by `ModelManagerOptions`.
+ */
+interface DynamicMergeAuthority {
+	readonly input: boolean;
+	readonly reasoning: boolean;
+	readonly cost: boolean;
+}
+
 function mergeDynamicModels<TApi extends Api>(
 	baseModels: readonly Model<TApi>[],
 	dynamicModels: readonly Model<TApi>[],
+	authority: DynamicMergeAuthority,
 	explicitKindModels?: ReadonlySet<Model<TApi>>,
 ): Model<TApi>[] {
 	// Empty-side fast paths: `mergeDynamicModels(base, [])` is the common shape
@@ -567,7 +608,7 @@ function mergeDynamicModels<TApi extends Api>(
 		// A policy-derived kind on a chat row is not permission to replace an
 		// authored runner. Only a kind present before materialization can do so.
 		if (modelKind(existingModel) !== "chat" && !explicitKindModels?.has(dynamicModel)) continue;
-		merged.set(dynamicModel.id, mergeDynamicModel(existingModel, dynamicModel));
+		merged.set(dynamicModel.id, mergeDynamicModel(existingModel, dynamicModel, authority));
 	}
 	return Array.from(merged.values());
 }
@@ -598,39 +639,30 @@ export function fingerprintStaticModels<TApi extends Api>(
 	return `${MODEL_CACHE_FINGERPRINT_VERSION}:${Bun.hash(JSON.stringify(models)).toString(36)}`;
 }
 
-function mergeDynamicModel<TApi extends Api>(existingModel: Model<TApi>, dynamicModel: Model<TApi>): Model<TApi> {
+function mergeDynamicModel<TApi extends Api>(
+	existingModel: Model<TApi>,
+	dynamicModel: Model<TApi>,
+	authority: DynamicMergeAuthority,
+): Model<TApi> {
 	// When discovery resolves the same model id to a different endpoint (e.g.
 	// a GitHub Copilot business/enterprise host), the bundled reference's
-	// capabilities are pinned to another endpoint and no longer apply. Copilot
-	// dynamic discovery also pre-applies the correct image fallback for omitted
-	// `supports.vision`, so its explicit `false` must not be OR-upgraded by the
-	// canonical bundled model.
-	// DeepInfra's discovery is authoritative (`dynamicModelsAuthoritative`) and
-	// its `vision`/`vlm` tags are the catalog's whole truth for modality. Every
-	// row shares the single DeepInfra endpoint, so `endpointChanged` never fires
-	// there: without this carve-out a model that dropped those tags would keep
-	// the bundled reference's image support and the agent would go on sending
+	// capabilities are pinned to another endpoint and no longer apply.
+	// `authority.input` carries the descriptor's declaration that a
+	// provider's discovery rows are the deployment's whole truth for input
+	// modality (Copilot's pre-applied `supports.vision` fallback, DeepInfra's
+	// `vision`/`vlm` tags, CoralBricks' authoritative `supports_image_input`
+	// flag): without it, a live row that dropped image support would keep the
+	// bundled reference's image support and the agent would go on sending
 	// images to a now text-only route.
 	const endpointChanged = existingModel.baseUrl !== dynamicModel.baseUrl;
-	const dynamicInputAuthoritative =
-		endpointChanged ||
-		(existingModel.provider === "github-copilot" && dynamicModel.provider === "github-copilot") ||
-		(existingModel.provider === "deepinfra" && dynamicModel.provider === "deepinfra");
+	const dynamicInputAuthoritative = endpointChanged || authority.input;
 	const supportsImage = dynamicInputAuthoritative
 		? dynamicModel.input.includes("image")
 		: existingModel.input.includes("image") || dynamicModel.input.includes("image");
-	// Synthetic's discovery is authoritative (`dynamicModelsAuthoritative`) and
-	// its per-model `reasoning_parameters.efforts` vocabulary is the route's
-	// whole truth: when the wire advertises only the `none` off-state the
-	// mapper emits `reasoning: false`, and OR-ing the bundled reference's
-	// stale `reasoning: true` back would re-arm an effort dial the route
-	// doesn't expose. Other providers keep the OR so a bundled reasoning flag
-	// survives a discovery row that simply omits the capability.
-	const dynamicReasoningAuthoritative =
-		existingModel.provider === "synthetic" && dynamicModel.provider === "synthetic";
-	const reasoning = dynamicReasoningAuthoritative
-		? dynamicModel.reasoning
-		: existingModel.reasoning || dynamicModel.reasoning;
+	// Providers with authoritative reasoning metadata must not regain a
+	// stale bundled dial after explicitly reporting no reasoning. Others
+	// retain the additive fallback for discovery that omits capabilities.
+	const reasoning = authority.reasoning ? dynamicModel.reasoning : existingModel.reasoning || dynamicModel.reasoning;
 	const longContextCost = dynamicModel.cost.longContext ?? existingModel.cost.longContext;
 	const timeBasedCost = dynamicModel.cost.timeBased ?? existingModel.cost.timeBased;
 	const existingHeaders = existingModel.resolveHeaders ?? existingModel.headers;
@@ -651,17 +683,26 @@ function mergeDynamicModel<TApi extends Api>(existingModel: Model<TApi>, dynamic
 	// the effort dial once the id is pinned to Responses (#12901).
 	const compat =
 		dynamicModel.compatConfig ?? (dynamicModel.api === existingModel.api ? existingModel.compatConfig : undefined);
+	// A live row that trusts only its own thinking (e.g. CoralBricks' advertised
+	// ladder) must not inherit the fallback's dial. Cached rows lose an
+	// explicit `thinking: undefined` to JSON, so the spread alone would.
+	const liveCompat = dynamicModel.compatConfig;
+	const trustsOwnThinking =
+		liveCompat !== undefined &&
+		"trustExplicitThinkingOnly" in liveCompat &&
+		liveCompat.trustExplicitThinkingOnly === true;
 	return buildModel({
 		...existingModel,
 		...dynamicModel,
 		name: preferDiscoveryName(dynamicModel.name, existingModel.name, dynamicModel.id),
 		reasoning,
+		...(trustsOwnThinking ? { thinking: dynamicModel.thinking } : {}),
 		input: supportsImage ? ["text", "image"] : ["text"],
 		cost: {
-			input: preferDiscoveryCost(dynamicModel.cost.input, existingModel.cost.input),
-			output: preferDiscoveryCost(dynamicModel.cost.output, existingModel.cost.output),
-			cacheRead: preferDiscoveryCost(dynamicModel.cost.cacheRead, existingModel.cost.cacheRead),
-			cacheWrite: preferDiscoveryCost(dynamicModel.cost.cacheWrite, existingModel.cost.cacheWrite),
+			input: preferDiscoveryCost(dynamicModel.cost.input, existingModel.cost.input, authority.cost),
+			output: preferDiscoveryCost(dynamicModel.cost.output, existingModel.cost.output, authority.cost),
+			cacheRead: preferDiscoveryCost(dynamicModel.cost.cacheRead, existingModel.cost.cacheRead, authority.cost),
+			cacheWrite: preferDiscoveryCost(dynamicModel.cost.cacheWrite, existingModel.cost.cacheWrite, authority.cost),
 			...(longContextCost ? { longContext: longContextCost } : {}),
 			...(timeBasedCost ? { timeBased: timeBasedCost } : {}),
 		},
@@ -678,8 +719,12 @@ function mergeDynamicModel<TApi extends Api>(existingModel: Model<TApi>, dynamic
 	} as ModelSpec<TApi>);
 }
 
-function preferDiscoveryCost(discoveryCost: number, fallbackCost: number): number {
-	if (Number.isFinite(discoveryCost) && discoveryCost > 0) {
+/**
+ * A zero discovery price usually means "not reported", so the fallback wins
+ * unless the provider declared its live prices authoritative (`zeroIsPrice`).
+ */
+function preferDiscoveryCost(discoveryCost: number, fallbackCost: number, zeroIsPrice: boolean): number {
+	if (Number.isFinite(discoveryCost) && (discoveryCost > 0 || (zeroIsPrice && discoveryCost === 0))) {
 		return discoveryCost;
 	}
 	return fallbackCost;
@@ -708,19 +753,40 @@ function preferDiscoveryLimit(discoveryLimit: number | null, fallbackLimit: numb
 	return discoveryLimit;
 }
 
+/**
+ * Materializes a remote source's rows. A row `buildModel` rejects (an id newer
+ * than this build's rule tree that lands on an equal-rank overlap) is skipped
+ * with a warning instead of discarding the source's other rows.
+ *
+ * @throws the first build error when rows were present but none built, so the
+ * caller treats the source as failed (cache/static fallback) rather than as an
+ * intentionally empty catalog that an authoritative provider would prune to.
+ */
 function buildDiscoveredModelSpecs<TApi extends Api>(value: unknown): DiscoveredModelSet<TApi> {
 	const models: Model<TApi>[] = [];
 	const explicitKindModels = new Set<Model<TApi>>();
 	if (!Array.isArray(value)) {
 		return { models, explicitKindModels };
 	}
+	const failures: unknown[] = [];
 	for (const item of value) {
-		if (isModelLike(item)) {
-			const model = buildModel(item as ModelSpec<TApi>);
-			models.push(model);
-			if (item.kind !== undefined) explicitKindModels.add(model);
+		if (!isModelLike(item)) continue;
+		let model: Model<TApi>;
+		try {
+			model = buildModel(item as ModelSpec<TApi>);
+		} catch (error) {
+			failures.push(error);
+			logger.warn("model discovery skipped a model that failed to build", {
+				provider: item.provider,
+				model: item.id,
+				error: error instanceof Error ? error.message : String(error),
+			});
+			continue;
 		}
+		models.push(model);
+		if (item.kind !== undefined) explicitKindModels.add(model);
 	}
+	if (models.length === 0 && failures.length > 0) throw failures[0];
 	return { models, explicitKindModels };
 }
 

package/src/model-tokenizer.ts

@@ -27,6 +27,9 @@ function claudeTokenizer(identity: ModelIdentity): ModelTokenizer | undefined {
 	if (identity.family === "sonnet" || identity.family === "fable" || identity.family === "mythos") {
 		return revisionAtLeast(identity.revision, "5") ? "claude-v5-sonnet" : "claude-v3";
 	}
+	// Haiku 5.5 moved to the post-4.7 tokenizer (~30% more tokens than Haiku
+	// 4.5). No Haiku-measured vocabulary is embedded; Sonnet 5's is the nearest.
+	if (identity.family === "haiku" && revisionAtLeast(identity.revision, "5.5")) return "claude-v5-sonnet";
 	return "claude-v3";
 }