@linxiraos/pi-catalog 1.1.8 → 1.1.10

package/CHANGELOG.md

@@ -2,10 +2,13 @@
 
 ## [Unreleased]
 
-## [1.1.8] - 2026-09-04
+## [1.1.10] - 2026-09-07
 
-- OMP sync v18.1.2–v18.1.5: declarative KDL auth contract compiler (`@bgotink/kdl` now a devDependency), provider auth definitions, and model-policy rule updates.
-- Restored the biome toolchain for catalog scripts after the v18.1.5 merge briefly adopted the upstream oxlint/oxfmt configuration.
+- OMP v18.1.11 sync baseline (`e3106be68f`); no package-specific user-visible changes.
+
+## [1.1.9] - 2026-09-05
+
+- v18.1.10 sync baseline; retired pi-hashline catalog entry removed from the version-line catalogs.
 
 ## [1.1.6] - 2026-08-30
 

package/dist/types/compat/axes.d.ts

@@ -36,6 +36,14 @@ export interface AxisDef {
 }
 /** Effort tiers accepted by taxonomy collapse/override vocabulary (`Effort` ∪ `"off"`). */
 export declare const EFFORT_TIERS: readonly string[];
+/**
+ * How hard agent prompts push subagent delegation for a model lineage
+ * (`delegation-bias` axis). `eager` is the unassigned default: the prompt
+ * actively pushes fan-out. `restrained` keeps fan-out for genuinely parallel
+ * slices but forbids reflexive scouts and single-agent babysitting. `gated`
+ * forbids subagents unless the user or a skill asks.
+ */
+export declare const DELEGATION_BIASES: readonly ["eager", "restrained", "gated"];
 /** Narrow a KDL string to an effort tier (`Effort` ∪ `"off"`). */
 export declare function isEffortTier(value: string): value is Effort | "off";
 /** Narrow a KDL string to a thinking control mode. */

package/dist/types/compat/delegation.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Delegation bias: how hard the coding agent's prompts push subagent
+ * delegation for a model lineage. Authored on the `delegation-bias` catalog
+ * axis in `rules/classes/*.kdl` so appetite corrections live beside the other
+ * lineage truths instead of as revision compares in TypeScript.
+ *
+ * Resolved through the cascade at prompt-build time (session start, model
+ * switch) rather than baked onto `Model`: bundled rows are frozen by the
+ * generator, and the bias is read once per prompt rebuild, not per request.
+ */
+import type { Model } from "../types.js";
+import { DELEGATION_BIASES } from "./axes.js";
+/** One of `DELEGATION_BIASES`; see that constant for the semantics of each tier. */
+export type DelegationBias = (typeof DELEGATION_BIASES)[number];
+/**
+ * Delegation bias for a built model; `eager` when no rule assigns one.
+ * Callers: system-prompt and tool-description rendering in the coding agent.
+ */
+export declare function resolveDelegationBias(model: Model): DelegationBias;

package/dist/types/compat/types.d.ts

@@ -407,7 +407,7 @@ export interface CompiledOAuthRequest {
     headers: Record<string, string>;
     timeoutMs?: number;
 }
-/** Loopback callback configuration for authorization-code logins. */
+/** Callback transport configuration for authorization-code logins. */
 export interface CompiledCallback {
     port: number;
     path: string;
@@ -415,8 +415,10 @@ export interface CompiledCallback {
     redirectUri?: CompiledAuthValue;
     portFallback: boolean;
     manualOnly: boolean;
+    /** Temporarily receive a custom-scheme redirect through the native OS handler. */
+    nativeScheme: boolean;
 }
-/** Authorization-code login through the loopback callback server. */
+/** Authorization-code login through a loopback, native-scheme, or manual callback. */
 export interface CompiledOAuthCodeLogin {
     kind: "oauth-code";
     clientId?: CompiledAuthValue;

package/dist/types/discovery/codex.d.ts

@@ -26,6 +26,13 @@ export interface CodexModelDiscoveryOptions {
 export interface CodexModelDiscoveryResult {
     models: ModelSpec<"openai-codex-responses">[];
     etag?: string;
+    /**
+     * Set when the backend rejected the credential itself (401/403, e.g.
+     * `token_revoked`); `models` is empty. A definitive per-account denial,
+     * unlike the `null` result for transport/parse failures, so multi-account
+     * discovery can skip the account instead of aborting.
+     */
+    rejectedStatus?: 401 | 403;
 }
 /**
  * Fetches model metadata from Codex backend and normalizes it for pi model management.

package/dist/types/identity/metrics.d.ts

@@ -0,0 +1,28 @@
+import type { Api, Model } from "../types.js";
+/** Catalog-delivered intelligence score and output speed for one model. */
+export interface CatalogMetrics {
+    int?: number;
+    tps?: number;
+}
+/** The catalog metrics a model carries, or undefined when it reports none. A zero speed is "unmeasured", not a score. */
+export declare function catalogMetricsOf(model: Model<Api>): CatalogMetrics | undefined;
+/**
+ * Index of catalog metrics over every scored model seen so far. Built once per
+ * discovery cycle by the model registry and per provider by the model manager;
+ * `add` accumulates across providers so a proxy id resolves against any host's
+ * scored row.
+ */
+export declare class CatalogMetricsIndex {
+    #private;
+    constructor(models?: Iterable<Model<Api>>);
+    get isEmpty(): boolean;
+    /** Record the metrics of every scored model; later rows fill fields earlier rows left unset. */
+    add(models: Iterable<Model<Api>>): void;
+    /** Metrics for `model` by exact id, else by dialect-normalized id when the classified identities agree. */
+    resolve(model: Model<Api>): CatalogMetrics | undefined;
+}
+/**
+ * Fill each model's `int`/`tps` from `index`. Returns the input array when no
+ * model changed so callers can keep identity-based caches.
+ */
+export declare function applyCatalogMetrics<TApi extends Api>(models: Model<TApi>[], index: CatalogMetricsIndex): Model<TApi>[];

package/dist/types/identity/reference.d.ts

@@ -9,6 +9,13 @@ export declare function isZeroCostXaiOAuthReference(candidate: Model<Api>): bool
  * Pure: callers are responsible for memoizing the result.
  */
 export declare function buildModelReferenceIndex(models: Iterable<Model<Api>>): ModelReferenceIndex;
+/**
+ * Expand a proxied/affixed model id into the ids it may be catalogued under,
+ * least-stripped first: bracket affixes, model-like segments, `:cloud`,
+ * namespace prefix, `:`→`-`, lowercase, and declared trailing markers.
+ * Shared by reference recovery and catalog-metric matching (`./metrics`).
+ */
+export declare function getReferenceCandidateIds(modelId: string): string[];
 /**
  * Inherit bundled reference thinking only for same-provider matches. Wire routing
  * (`effortRouting`) is provider-specific; cross-provider inheritance can rewrite

package/dist/types/provider-models/openai-compat.d.ts

@@ -31,6 +31,8 @@ export interface ModelsDevModel {
     provider?: {
         npm?: string;
     };
+    int?: number;
+    tps?: number;
 }
 /**
  * Fetches the models.dev catalog via catalog.stencil.so, which serves a

package/dist/types/types.d.ts

@@ -700,6 +700,13 @@ export interface ResolvedOpenAIResponsesCompat extends ResolvedOpenAISharedCompa
      * transport; earlier ids reject the value.
      */
     supportsAllTurnsReasoningContext: boolean;
+    /**
+     * Whether a `configuration_update` input item may change `reasoning.effort`
+     * mid-conversation while the request-level effort stays byte-stable for
+     * prompt caching. Rule-owned: GPT-6 Astra only; every other model rejects
+     * the item type with 400.
+     */
+    supportsConfigurationUpdate: boolean;
     /** Inject the `# Juice: 0 !important` developer item when reasoning is forced off (gpt-5.6+). */
     requiresReasoningOffJuiceInstruction: boolean;
     /**
@@ -997,6 +1004,10 @@ export interface Model<TApi extends Api = Api> {
     isRecommended?: boolean;
     /** Canonical thinking capability metadata for this model. */
     thinking?: ThinkingConfig;
+    /** Intelligence score delivered by the model catalog. */
+    int?: number | null;
+    /** Catalog-estimated output speed in tokens per second. */
+    tps?: number | null;
     /**
      * Fully-resolved compatibility record, materialized once by `buildModel`.
      * Protocol handlers read fields; they never detect, resolve, or allocate.
@@ -1031,6 +1042,12 @@ export interface Model<TApi extends Api = Api> {
     guardrailVersion?: string;
     /** Bedrock guardrail trace verbosity. */
     guardrailTrace?: "enabled" | "disabled" | "enabled_full";
+    /**
+     * Bedrock invocation-log tags attached to every Converse request for this
+     * model. Set from `providers.<provider>.requestMetadata`; the Bedrock
+     * transport reads it directly and validates it against AWS's limits.
+     */
+    requestMetadata?: Record<string, string>;
 }
 /**
  * A model as authored by configs, bundled catalogs, and discovery — the input

package/dist/types/wire/codex.d.ts

@@ -4,8 +4,12 @@
 export declare const CODEX_BASE_URL = "https://chatgpt.com/backend-api";
 /**
  * Pinned OpenAI Codex client version (corresponds to @openai/codex package version).
+ *
+ * The backend version-gates model availability against this value on both
+ * `/models?client_version=` and `/responses` (`gpt-6-astra` requires ≥ 0.153.0);
+ * an older pin silently hides newer SKUs from discovery.
  */
-export declare const CODEX_CLIENT_VERSION = "0.144.1";
+export declare const CODEX_CLIENT_VERSION = "0.153.0";
 export declare const OPENAI_HEADERS: {
     readonly BETA: "OpenAI-Beta";
     /** Codex feature-negotiation header; values identify opt-in wire protocols. */
@@ -28,18 +32,32 @@ export declare const OPENAI_HEADERS: {
     readonly ATTESTATION: "x-oai-attestation";
     /** Client-declared data residency for region-pinned enterprise workspaces. */
     readonly RESIDENCY: "x-openai-internal-codex-residency";
+    /**
+     * Model routing hint (codex-rs `X_CODEX_ROUTING_HINT_HEADER`): `model=<slug>`
+     * or `model=<slug>;tier=<service_tier>`; sent on every ChatGPT-OAuth
+     * Responses, compaction, and WebSocket handshake request. Built by
+     * {@link codexRoutingHint}.
+     */
+    readonly ROUTING_HINT: "x-codex-routing-hint";
 };
 export declare const OPENAI_HEADER_VALUES: {
     readonly BETA_RESPONSES: "responses=experimental";
     readonly BETA_RESPONSES_WEBSOCKETS_V2: "responses_websockets=2026-02-06";
     readonly REMOTE_COMPACTION_V2: "remote_compaction_v2";
-    readonly ORIGINATOR_CODEX: "pi";
+    readonly ORIGINATOR_CODEX: "omp";
 };
 export declare const URL_PATHS: {
     readonly RESPONSES: "/responses";
     readonly CODEX_RESPONSES: "/codex/responses";
 };
 export declare const JWT_CLAIM_PATH: "https://api.openai.com/auth";
+/**
+ * Build the `x-codex-routing-hint` value for a request (codex-rs
+ * `build_routing_hint_header`): the requested model slug plus the explicit
+ * service tier when one is set. Callers set it only on ChatGPT-OAuth requests
+ * to the Codex backend; API-key OpenAI traffic never carries it.
+ */
+export declare function codexRoutingHint(model: string, serviceTier: string | null | undefined): string;
 /**
  * Extract account ID from a Codex JWT access token.
  * Returns undefined if the token is not a valid Codex JWT.

package/package.json

@@ -1,104 +1,101 @@
 {
-	"type": "module",
-	"name": "@linxiraos/pi-catalog",
-	"version": "1.1.8",
-	"description": "Model catalog for omp: bundled model database, provider discovery descriptors, model identity, classification, and equivalence",
-	"homepage": "https://linxira-os.github.io/zeta/",
-	"author": "Can Boluk",
-	"license": "MIT",
-	"repository": {
-		"type": "git",
-		"url": "git+https://github.com/Linxira-OS/linxira-zeta.git",
-		"directory": "packages/catalog"
-	},
-	"bugs": {
-		"url": "https://github.com/Linxira-OS/linxira-zeta/issues"
-	},
-	"keywords": [
-		"ai",
-		"llm",
-		"models",
-		"catalog",
-		"discovery"
-	],
-	"main": "./src/index.ts",
-	"types": "./dist/types/index.d.ts",
-	"scripts": {
-		"check": "biome check . && bun run check:types",
-		"check:types": "tsgo -p tsconfig.json --noEmit",
-		"lint": "biome lint .",
-		"test": "bun test --parallel",
-		"fix": "biome check --write --unsafe .",
-		"fmt": "biome format --write .",
-		"gen:models": "bun scripts/generate-models.ts",
-		"gen:compat": "bun scripts/compile-compat.ts",
-		"gen:proto": "bun scripts/generate-protocols.ts"
-	},
-	"dependencies": {
-		"@linxiraos/pi-omptype": "1.1.8",
-		"@linxiraos/pi-utils": "1.1.8"
-	},
-	"devDependencies": {
-		"@bgotink/kdl": "0.4.0",
-		"@linxiraos/pi-ai": "1.1.8",
-		"@types/bun": "^1.3.14"
-	},
-	"engines": {
-		"bun": ">=1.3.14"
-	},
-	"files": [
-		"src",
-		"README.md",
-		"CHANGELOG.md",
-		"LICENSE",
-		"THIRD-PARTY-NOTICES.txt",
-		"dist/types"
-	],
 	"exports": {
-		".": {
-			"types": "./dist/types/index.d.ts",
-			"import": "./src/index.ts"
+		"./*.js": "./src/*.ts",
+		"./*": {
+			"import": "./src/*.ts",
+			"types": "./dist/types/*.d.ts"
 		},
-		"./models.json": {
-			"types": "./dist/types/models.json.d.d.ts",
-			"import": "./src/models.json"
+		"./compat/*": {
+			"import": "./src/compat/*.ts",
+			"types": "./dist/types/compat/*.d.ts"
 		},
-		"./provider-models": {
-			"types": "./dist/types/provider-models/index.d.ts",
-			"import": "./src/provider-models/index.ts"
+		"./wire/*": {
+			"import": "./src/wire/*.ts",
+			"types": "./dist/types/wire/*.d.ts"
 		},
-		"./provider-models/*": {
-			"types": "./dist/types/provider-models/*.d.ts",
-			"import": "./src/provider-models/*.ts"
+		"./identity/*": {
+			"import": "./src/identity/*.ts",
+			"types": "./dist/types/identity/*.d.ts"
 		},
-		"./discovery": {
-			"types": "./dist/types/discovery/index.d.ts",
-			"import": "./src/discovery/index.ts"
+		"./identity": {
+			"import": "./src/identity/index.ts",
+			"types": "./dist/types/identity/index.d.ts"
 		},
 		"./discovery/*": {
-			"types": "./dist/types/discovery/*.d.ts",
-			"import": "./src/discovery/*.ts"
-		},
-		"./identity": {
-			"types": "./dist/types/identity/index.d.ts",
-			"import": "./src/identity/index.ts"
+			"import": "./src/discovery/*.ts",
+			"types": "./dist/types/discovery/*.d.ts"
 		},
-		"./identity/*": {
-			"types": "./dist/types/identity/*.d.ts",
-			"import": "./src/identity/*.ts"
+		"./discovery": {
+			"import": "./src/discovery/index.ts",
+			"types": "./dist/types/discovery/index.d.ts"
 		},
-		"./wire/*": {
-			"types": "./dist/types/wire/*.d.ts",
-			"import": "./src/wire/*.ts"
+		"./provider-models/*": {
+			"import": "./src/provider-models/*.ts",
+			"types": "./dist/types/provider-models/*.d.ts"
 		},
-		"./compat/*": {
-			"types": "./dist/types/compat/*.d.ts",
-			"import": "./src/compat/*.ts"
+		"./provider-models": {
+			"import": "./src/provider-models/index.ts",
+			"types": "./dist/types/provider-models/index.d.ts"
 		},
-		"./*": {
-			"types": "./dist/types/*.d.ts",
-			"import": "./src/*.ts"
+		"./models.json": {
+			"import": "./src/models.json",
+			"types": "./dist/types/models.json.d.d.ts"
 		},
-		"./*.js": "./src/*.ts"
-	}
+		".": {
+			"import": "./src/index.ts",
+			"types": "./dist/types/index.d.ts"
+		}
+	},
+	"files": [
+		"src",
+		"README.md",
+		"CHANGELOG.md",
+		"LICENSE",
+		"THIRD-PARTY-NOTICES.txt",
+		"dist/types"
+	],
+	"engines": {
+		"bun": ">=1.3.14"
+	},
+	"devDependencies": {
+		"@linxiraos/pi-ai": "1.1.10",
+		"@types/bun": "^1.3.14",
+		"@bgotink/kdl": "0.4.0"
+	},
+	"dependencies": {
+		"@linxiraos/pi-utils": "1.1.10",
+		"@linxiraos/pi-omptype": "1.1.10"
+	},
+	"scripts": {
+		"gen:proto": "bun scripts/generate-protocols.ts",
+		"gen:compat": "bun scripts/compile-compat.ts",
+		"gen:models": "bun scripts/generate-models.ts",
+		"test": "bun test --parallel",
+		"check:types": "tsgo -p tsconfig.json --noEmit",
+		"check": "tsgo -p tsconfig.json --noEmit"
+	},
+	"types": "./dist/types/index.d.ts",
+	"main": "./src/index.ts",
+	"keywords": [
+		"ai",
+		"llm",
+		"models",
+		"catalog",
+		"discovery"
+	],
+	"bugs": {
+		"url": "https://github.com/Linxira-OS/linxira-zeta/issues"
+	},
+	"repository": {
+		"directory": "packages/catalog",
+		"url": "git+https://github.com/Linxira-OS/linxira-zeta.git",
+		"type": "git"
+	},
+	"license": "MIT",
+	"author": "Can Boluk",
+	"homepage": "https://linxira-os.github.io/zeta/",
+	"description": "Model catalog for omp: bundled model database, provider discovery descriptors, model identity, classification, and equivalence",
+	"version": "1.1.10",
+	"name": "@linxiraos/pi-catalog",
+	"type": "module"
 }

package/src/compat/axes.ts

@@ -44,6 +44,15 @@ const EFFORTS = ["minimal", "low", "medium", "high", "xhigh", "max"] as const;
 
 /** Effort tiers accepted by taxonomy collapse/override vocabulary (`Effort` ∪ `"off"`). */
 export const EFFORT_TIERS: readonly string[] = [...EFFORTS, "off"];
+
+/**
+ * How hard agent prompts push subagent delegation for a model lineage
+ * (`delegation-bias` axis). `eager` is the unassigned default: the prompt
+ * actively pushes fan-out. `restrained` keeps fan-out for genuinely parallel
+ * slices but forbids reflexive scouts and single-agent babysitting. `gated`
+ * forbids subagents unless the user or a skill asks.
+ */
+export const DELEGATION_BIASES = ["eager", "restrained", "gated"] as const;
 const THINKING_MODES = [
 	"effort",
 	"budget",
@@ -128,6 +137,7 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"strict-responses-pairing": wire("strictResponsesPairing", ["openai-responses"]),
 	"requires-reasoning-off-juice-instruction": wire("requiresReasoningOffJuiceInstruction", ["openai-responses"]),
 	"supports-all-turns-reasoning-context": wire("supportsAllTurnsReasoningContext", ["openai-responses"]),
+	"supports-configuration-update": wire("supportsConfigurationUpdate", ["openai-responses"]),
 	"strip-deepseek-special-tokens": wire("stripDeepseekSpecialTokens", OAI),
 	"stream-markup-healing-pattern": wire("streamMarkupHealingPattern", OAI, "scalar", [
 		"kimi",
@@ -260,6 +270,7 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"context-promotion-target": { key: "contextPromotionTarget", set: "catalog", shape: "scalar" },
 	"context-window-floor": { key: "contextWindowFloor", set: "catalog", shape: "scalar" },
 	"cost-patch": { key: "costPatch", set: "catalog", shape: "object" },
+	"delegation-bias": { key: "delegationBias", set: "catalog", shape: "scalar", values: DELEGATION_BIASES },
 	"edit-revision": { key: "editRevision", set: "catalog", shape: "scalar" },
 	"input-modalities": { key: "inputModalities", set: "catalog", shape: "array", values: ["text", "image"] },
 	"limits-patch": { key: "limitsPatch", set: "catalog", shape: "object" },

package/src/compat/delegation.ts

@@ -0,0 +1,37 @@
+/**
+ * Delegation bias: how hard the coding agent's prompts push subagent
+ * delegation for a model lineage. Authored on the `delegation-bias` catalog
+ * axis in `rules/classes/*.kdl` so appetite corrections live beside the other
+ * lineage truths instead of as revision compares in TypeScript.
+ *
+ * Resolved through the cascade at prompt-build time (session start, model
+ * switch) rather than baked onto `Model`: bundled rows are frozen by the
+ * generator, and the bias is read once per prompt rebuild, not per request.
+ */
+import type { Model } from "../types";
+import { DELEGATION_BIASES } from "./axes";
+import { resolveCascade } from "./cascade";
+
+/** One of `DELEGATION_BIASES`; see that constant for the semantics of each tier. */
+export type DelegationBias = (typeof DELEGATION_BIASES)[number];
+
+function isDelegationBias(value: unknown): value is DelegationBias {
+	return typeof value === "string" && (DELEGATION_BIASES as readonly string[]).includes(value);
+}
+
+/**
+ * Delegation bias for a built model; `eager` when no rule assigns one.
+ * Callers: system-prompt and tool-description rendering in the coding agent.
+ */
+export function resolveDelegationBias(model: Model): DelegationBias {
+	const { identity } = model;
+	const bias = resolveCascade({
+		provider: model.provider,
+		class: identity.class,
+		model: model.id,
+		reasoning: Boolean(model.reasoning),
+		...(identity.family !== undefined && { family: identity.family }),
+		...(identity.revision !== undefined && { revision: identity.revision }),
+	}).catalog.delegationBias;
+	return isDelegationBias(bias) ? bias : "eager";
+}

package/src/compat/resolve.ts

@@ -714,6 +714,7 @@ function resolveOpenAIResponsesPolicy(
 		supportsImageDetailOriginal: !isXaiHost && !modelMatchesHost(hostModel, "githubCopilot"),
 		supportsReasoningSummary: !isXaiHost,
 		supportsAllTurnsReasoningContext: false,
+		supportsConfigurationUpdate: false,
 		requiresReasoningOffJuiceInstruction: false,
 		stripImageInput: false,
 		thinkingLoopGuard: undefined,
@@ -815,6 +816,7 @@ function pickResponsesOnly(compat: ResolvedOpenAIResponsesCompat): ResponsesOnly
 		supportsImageDetailOriginal: compat.supportsImageDetailOriginal,
 		supportsObfuscationOptOut: compat.supportsObfuscationOptOut,
 		supportsAllTurnsReasoningContext: compat.supportsAllTurnsReasoningContext,
+		supportsConfigurationUpdate: compat.supportsConfigurationUpdate,
 		officialEndpoint: compat.officialEndpoint,
 		harmonyLeakMitigation: compat.harmonyLeakMitigation,
 		cacheControlFormat: compat.cacheControlFormat,

package/src/compat/rules/README.md

@@ -8,7 +8,7 @@ There are three ownership strata:
 - `classes/*.kdl` defines model-lineage truths: behavior inherent to a model line, optionally scoped to the providers where the census established it.
 - `providers/*.kdl` defines deployment contracts: behavior imposed by a host, plus documented per-model residue that taxonomy cannot express exactly.
 - `runtime/behavior.kdl` defines heuristics used before or outside exact model lookup: responses routing, API routes, quota tiers, plan requirements, model limits, roster exclusions, hosted defaults, pricing peers.
-- `auth/<provider>.kdl` defines the provider's auth contract: display name, env-var fallback, credential storage/format, and the declarative login / refresh flow that `@oh-my-pi/pi-ai`'s registry engines interpret (see [Auth grammar](#auth-grammar)).
+- `auth/<provider>.kdl` defines the provider's auth contract: display name, env-var fallback, credential storage/format, and the declarative login / refresh flow that `@linxiraos/pi-ai`'s registry engines interpret (see [Auth grammar](#auth-grammar)).
 
 Do not move a statistically common provider behavior into a class file, or a lineage truth into a provider file. Absence is not evidence that a capability is stripped. Preserve comments that record census provenance, reviewed exceptions, and why a `models` residue remains.
 
@@ -257,7 +257,7 @@ Matcher properties on `route` / `exclude-models` / `tier` nodes are `exact=` / `
 
 ## Auth grammar
 
-Every provider has exactly one `auth "<id>" { … }` node under `auth/`; `auth/_order.kdl` holds a single `login-order "id" …` node pinning the `/login` roster order (every provider with a `login` and `show-in-login-list` unset/true must appear; providers without a login sort alphabetically after it). Runtime accessors live in `src/compat/auth.ts`; the id unions in the generated `src/compat/auth-ids.ts`. Every provider in `provider-models/descriptors.ts` needs an auth node (`@oh-my-pi/pi-ai` type-checks this).
+Every provider has exactly one `auth "<id>" { … }` node under `auth/`; `auth/_order.kdl` holds a single `login-order "id" …` node pinning the `/login` roster order (every provider with a `login` and `show-in-login-list` unset/true must appear; providers without a login sort alphabetically after it). Runtime accessors live in `src/compat/auth.ts`; the id unions in the generated `src/compat/auth-ids.ts`. Every provider in `provider-models/descriptors.ts` needs an auth node (`@linxiraos/pi-ai` type-checks this).
 
 ```kdl
 auth "anthropic" {
@@ -271,7 +271,7 @@ auth "anthropic" {
         state "hex"                              // hex | uuid | none
         authorize-params { code "true" }         // standard=#false drops client_id/response_type/redirect_uri/scope/PKCE/state
         instructions "Complete login in your browser…"
-        callback port=54545 path="/callback" hostname="localhost" redirect-uri="…" redirect-uri-env="VAR" port-fallback=#true manual-only=#false
+        callback port=54545 path="/callback" hostname="localhost" redirect-uri="…" redirect-uri-env="VAR" port-fallback=#true manual-only=#false native-scheme=#false
         token url="https://api.anthropic.com/v1/oauth/token" body="json" { params { state "{state}" } headers { X "y" } }
         credential {
             access "access_token"                // dot path; `claim="a|b"` reads JWT claims; `literal="…"` pins a value
@@ -306,9 +306,9 @@ Login kinds:
 - `login "api-key" { auth-url "…"; instructions "…"; prompt "…" placeholder="…"; empty-fallback "…"; normalize "strip-bearer"; validate … }` — `validate "chat-completions" base-url= model= tolerate-model-denied= max-tokens-field= max-tokens=`, `validate "anthropic-messages" base-url= model=`, or `validate "models-endpoint" url= base-url-env= headers-hook=`; all accept `label=` (error-message label, defaults to `name`) and `optional=#true` (only auth failures reject).
 - `login "oauth-code" { … }` as above; `token`/`refresh` `params` values may use `{code}`, `{state}`, `{redirect_uri}`, `{code_verifier}`, `{client_id}`, `{client_secret}`, `{refresh_token}`, `{scope}`; the standard grant parameters are sent unless `standard=#false`.
 - `login "device-code" { client-id …; base-url "…"; scopes …; headers-hook "…"; device url="{base}/…" body="form" { params {…} headers {…} }; token url="…" url-hook="…"; response user-code= device-code= verification-uri= verification-uri-complete= interval= expires-in=; instructions "Enter code: {user_code}"; credential {…}; userinfo …; after-exchange hook=… }`.
-- `login "custom" hook="name"` — the whole flow is a named `@oh-my-pi/pi-ai` hook (`src/registry/hooks/custom.ts`).
+- `login "custom" hook="name"` — the whole flow is a named `@linxiraos/pi-ai` hook (`src/registry/hooks/custom.ts`).
 
-Hook names are validated against the hook tables in `@oh-my-pi/pi-ai/src/registry/hooks` by that package's `auth-hooks-registry` test. Values marked `encoding="base64"` are public OAuth client ids stored obfuscated to keep secret scanners quiet; they are decoded at runtime.
+Hook names are validated against the hook tables in `@linxiraos/pi-ai/src/registry/hooks` by that package's `auth-hooks-registry` test. Values marked `encoding="base64"` are public OAuth client ids stored obfuscated to keep secret scanners quiet; they are decoded at runtime.
 
 ## Vendoring provenance
 

package/src/compat/rules/auth/openai-codex.kdl

@@ -8,7 +8,7 @@ auth "openai-codex" {
 		authorize-params {
 			id_token_add_organizations "true"
 			codex_cli_simplified_flow "true"
-			originator "pi"
+			originator "omp"
 		}
 		instructions "A browser window should open. Complete login to finish."
 		// OpenAI only allowlists this exact URI; a busy port must fail rather than fall back.

package/src/compat/rules/auth/zai-coding-plan.kdl

@@ -4,9 +4,13 @@ auth "zai-coding-plan" {
 		client-id "client_P8X5CMWmlaRO9gyO-KSqtg" env="ZAI_OAUTH_CLIENT_ID"
 		authorize-url "https://chat.z.ai/api/oauth/authorize" env="ZAI_OAUTH_AUTHORIZE_URL"
 		// No PKCE: matches ZCode's authorize request verbatim.
-		// ZCode registers this exact loopback URI; any other host/port is rejected (#10245).
-		callback port=9999 path="/callback" hostname="127.0.0.1" redirect-uri="http://127.0.0.1:9999/callback" port-fallback=#false
-		instructions "Complete Z.ai login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted."
+		// Z.AI's server-side allowlist now rejects every loopback redirect_uri for
+		// this client (#10745); only ZCode's desktop scheme still validates. On a
+		// supported local desktop, temporarily receive that scheme and restore its
+		// previous handler. Remote and unsupported sessions retain manual input.
+		// `redirect-uri-env` lets users adapt to further allowlist shifts without a release.
+		callback port=0 redirect-uri="zcode://zai-auth/callback" redirect-uri-env="ZAI_OAUTH_REDIRECT_URI" manual-only=#true native-scheme=#true
+		instructions "Complete Z.ai login in your browser. On supported local desktops, omp captures the zcode:// callback and restores its previous handler automatically. You can also paste the final redirect URL or authorization code when prompted."
 		token url="https://zcode.z.ai/api/v1/oauth/token" url-env="ZAI_OAUTH_TOKEN_URL" body="json" standard=#false {
 			params {
 				provider "zai"

package/src/compat/rules/classes/openai.kdl

@@ -30,6 +30,22 @@ class "openai" {
 		thinking-efforts "low" "medium" "high" "xhigh" "max"
 		requires-reasoning-off-juice-instruction #true
 	}
+	// Delegation appetite is a lineage trait. GPT-5.6 was trained on Codex's
+	// "no subagents unless asked" developer message; GPT-6 fans out on its own
+	// and over-delegates under Claude-calibrated prompts (reflexive scouts,
+	// single-agent babysitting), so it gets the restrained tier instead.
+	revision "=5.6" {
+		delegation-bias "gated"
+	}
+	revision ">=6" {
+		delegation-bias "restrained"
+	}
+	// GPT-6 Astra changes reasoning effort mid-conversation through a
+	// `configuration_update` input item so the request-level effort (and the
+	// cached prompt prefix) stays put; every other SKU 400s on the item type.
+	models "gpt-6-astra" {
+		supports-configuration-update #true
+	}
 	// Codex SKUs: the advertised 400K figure includes the output budget; the
 	// true prompt window is 272K. Spark budgets are its own family's.
 	family "codex" {

package/src/compat/rules/providers/openai-codex.kdl

@@ -69,9 +69,9 @@ provider "openai-codex" {
 				}
 			}
 		}
-		// First-party GPT-5 Responses SKUs support the freeform apply_patch
+		// First-party GPT-5/GPT-6 Responses SKUs support the freeform apply_patch
 		// custom tool with a Lark grammar.
-		revision ">=5 <6" {
+		revision ">=5 <7" {
 			apply-patch-tool-type "freeform"
 		}
 	}

package/src/compat/rules/providers/openai.kdl

@@ -40,7 +40,7 @@ provider "openai" {
 				reasoning-disable-mode "none-effort"
 			}
 		}
-		revision ">=5 <6" {
+		revision ">=5 <7" {
 			apply-patch-tool-type "freeform"
 		}
 	}