@linxiraos/pi-catalog 1.1.8 → 1.1.9

package/CHANGELOG.md

@@ -2,10 +2,9 @@
 
 ## [Unreleased]
 
-## [1.1.8] - 2026-09-04
+## [1.1.9] - 2026-09-05
 
-- OMP sync v18.1.2–v18.1.5: declarative KDL auth contract compiler (`@bgotink/kdl` now a devDependency), provider auth definitions, and model-policy rule updates.
-- Restored the biome toolchain for catalog scripts after the v18.1.5 merge briefly adopted the upstream oxlint/oxfmt configuration.
+- v18.1.10 sync baseline; retired pi-hashline catalog entry removed from the version-line catalogs.
 
 ## [1.1.6] - 2026-08-30
 

package/package.json

@@ -1,104 +1,98 @@
 {
-	"type": "module",
-	"name": "@linxiraos/pi-catalog",
-	"version": "1.1.8",
-	"description": "Model catalog for omp: bundled model database, provider discovery descriptors, model identity, classification, and equivalence",
-	"homepage": "https://linxira-os.github.io/zeta/",
-	"author": "Can Boluk",
-	"license": "MIT",
-	"repository": {
-		"type": "git",
-		"url": "git+https://github.com/Linxira-OS/linxira-zeta.git",
-		"directory": "packages/catalog"
-	},
-	"bugs": {
-		"url": "https://github.com/Linxira-OS/linxira-zeta/issues"
-	},
-	"keywords": [
-		"ai",
-		"llm",
-		"models",
-		"catalog",
-		"discovery"
-	],
-	"main": "./src/index.ts",
-	"types": "./dist/types/index.d.ts",
-	"scripts": {
-		"check": "biome check . && bun run check:types",
-		"check:types": "tsgo -p tsconfig.json --noEmit",
-		"lint": "biome lint .",
-		"test": "bun test --parallel",
-		"fix": "biome check --write --unsafe .",
-		"fmt": "biome format --write .",
-		"gen:models": "bun scripts/generate-models.ts",
-		"gen:compat": "bun scripts/compile-compat.ts",
-		"gen:proto": "bun scripts/generate-protocols.ts"
-	},
-	"dependencies": {
-		"@linxiraos/pi-omptype": "1.1.8",
-		"@linxiraos/pi-utils": "1.1.8"
-	},
-	"devDependencies": {
-		"@bgotink/kdl": "0.4.0",
-		"@linxiraos/pi-ai": "1.1.8",
-		"@types/bun": "^1.3.14"
-	},
-	"engines": {
-		"bun": ">=1.3.14"
-	},
-	"files": [
-		"src",
-		"README.md",
-		"CHANGELOG.md",
-		"LICENSE",
-		"THIRD-PARTY-NOTICES.txt",
-		"dist/types"
-	],
-	"exports": {
-		".": {
-			"types": "./dist/types/index.d.ts",
-			"import": "./src/index.ts"
-		},
-		"./models.json": {
-			"types": "./dist/types/models.json.d.d.ts",
-			"import": "./src/models.json"
-		},
-		"./provider-models": {
-			"types": "./dist/types/provider-models/index.d.ts",
-			"import": "./src/provider-models/index.ts"
-		},
-		"./provider-models/*": {
-			"types": "./dist/types/provider-models/*.d.ts",
-			"import": "./src/provider-models/*.ts"
-		},
-		"./discovery": {
-			"types": "./dist/types/discovery/index.d.ts",
-			"import": "./src/discovery/index.ts"
-		},
-		"./discovery/*": {
-			"types": "./dist/types/discovery/*.d.ts",
-			"import": "./src/discovery/*.ts"
-		},
-		"./identity": {
-			"types": "./dist/types/identity/index.d.ts",
-			"import": "./src/identity/index.ts"
-		},
-		"./identity/*": {
-			"types": "./dist/types/identity/*.d.ts",
-			"import": "./src/identity/*.ts"
-		},
-		"./wire/*": {
-			"types": "./dist/types/wire/*.d.ts",
-			"import": "./src/wire/*.ts"
-		},
-		"./compat/*": {
-			"types": "./dist/types/compat/*.d.ts",
-			"import": "./src/compat/*.ts"
-		},
-		"./*": {
-			"types": "./dist/types/*.d.ts",
-			"import": "./src/*.ts"
-		},
-		"./*.js": "./src/*.ts"
-	}
+  "exports": {
+    "./*.js": "./src/*.ts",
+    "./*": {
+      "import": "./src/*.ts",
+      "types": "./src/*.ts"
+    },
+    "./compat/*": {
+      "import": "./src/compat/*.ts",
+      "types": "./src/compat/*.ts"
+    },
+    "./wire/*": {
+      "import": "./src/wire/*.ts",
+      "types": "./src/wire/*.ts"
+    },
+    "./identity/*": {
+      "import": "./src/identity/*.ts",
+      "types": "./src/identity/*.ts"
+    },
+    "./identity": {
+      "import": "./src/identity/index.ts",
+      "types": "./src/identity/index.ts"
+    },
+    "./discovery/*": {
+      "import": "./src/discovery/*.ts",
+      "types": "./src/discovery/*.ts"
+    },
+    "./discovery": {
+      "import": "./src/discovery/index.ts",
+      "types": "./src/discovery/index.ts"
+    },
+    "./provider-models/*": {
+      "import": "./src/provider-models/*.ts",
+      "types": "./src/provider-models/*.ts"
+    },
+    "./provider-models": {
+      "import": "./src/provider-models/index.ts",
+      "types": "./src/provider-models/index.ts"
+    },
+    "./models.json": {
+      "import": "./src/models.json",
+      "types": "./src/models.json.d.ts"
+    },
+    ".": {
+      "import": "./src/index.ts",
+      "types": "./src/index.ts"
+    }
+  },
+  "files": [
+    "src",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "bun": ">=1.3.14"
+  },
+  "devDependencies": {
+    "@linxiraos/pi-ai": "1.1.9",
+    "@types/bun": "^1.3.14",
+    "@bgotink/kdl": "0.4.0"
+  },
+  "dependencies": {
+    "@linxiraos/pi-utils": "1.1.9",
+    "@linxiraos/pi-omptype": "1.1.9"
+  },
+  "scripts": {
+    "gen:proto": "bun scripts/generate-protocols.ts",
+    "gen:compat": "bun scripts/compile-compat.ts",
+    "gen:models": "bun scripts/generate-models.ts",
+    "test": "bun test --parallel",
+    "check:types": "tsgo -p tsconfig.json --noEmit",
+    "check": "tsgo -p tsconfig.json --noEmit"
+  },
+  "types": "./src/index.ts",
+  "main": "./src/index.ts",
+  "keywords": [
+    "ai",
+    "llm",
+    "models",
+    "catalog",
+    "discovery"
+  ],
+  "bugs": {
+    "url": "https://github.com/Linxira-OS/linxira-zeta/issues"
+  },
+  "repository": {
+    "directory": "packages/catalog",
+    "url": "git+https://github.com/Linxira-OS/linxira-zeta.git",
+    "type": "git"
+  },
+  "license": "MIT",
+  "author": "Can Boluk",
+  "homepage": "https://linxira-os.github.io/zeta/",
+  "description": "Model catalog for omp: bundled model database, provider discovery descriptors, model identity, classification, and equivalence",
+  "version": "1.1.9",
+  "name": "@linxiraos/pi-catalog",
+  "type": "module"
 }

package/src/compat/axes.ts

@@ -44,6 +44,15 @@ const EFFORTS = ["minimal", "low", "medium", "high", "xhigh", "max"] as const;
 
 /** Effort tiers accepted by taxonomy collapse/override vocabulary (`Effort` ∪ `"off"`). */
 export const EFFORT_TIERS: readonly string[] = [...EFFORTS, "off"];
+
+/**
+ * How hard agent prompts push subagent delegation for a model lineage
+ * (`delegation-bias` axis). `eager` is the unassigned default: the prompt
+ * actively pushes fan-out. `restrained` keeps fan-out for genuinely parallel
+ * slices but forbids reflexive scouts and single-agent babysitting. `gated`
+ * forbids subagents unless the user or a skill asks.
+ */
+export const DELEGATION_BIASES = ["eager", "restrained", "gated"] as const;
 const THINKING_MODES = [
 	"effort",
 	"budget",
@@ -128,6 +137,7 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"strict-responses-pairing": wire("strictResponsesPairing", ["openai-responses"]),
 	"requires-reasoning-off-juice-instruction": wire("requiresReasoningOffJuiceInstruction", ["openai-responses"]),
 	"supports-all-turns-reasoning-context": wire("supportsAllTurnsReasoningContext", ["openai-responses"]),
+	"supports-configuration-update": wire("supportsConfigurationUpdate", ["openai-responses"]),
 	"strip-deepseek-special-tokens": wire("stripDeepseekSpecialTokens", OAI),
 	"stream-markup-healing-pattern": wire("streamMarkupHealingPattern", OAI, "scalar", [
 		"kimi",
@@ -260,6 +270,7 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"context-promotion-target": { key: "contextPromotionTarget", set: "catalog", shape: "scalar" },
 	"context-window-floor": { key: "contextWindowFloor", set: "catalog", shape: "scalar" },
 	"cost-patch": { key: "costPatch", set: "catalog", shape: "object" },
+	"delegation-bias": { key: "delegationBias", set: "catalog", shape: "scalar", values: DELEGATION_BIASES },
 	"edit-revision": { key: "editRevision", set: "catalog", shape: "scalar" },
 	"input-modalities": { key: "inputModalities", set: "catalog", shape: "array", values: ["text", "image"] },
 	"limits-patch": { key: "limitsPatch", set: "catalog", shape: "object" },

package/src/compat/delegation.ts

@@ -0,0 +1,37 @@
+/**
+ * Delegation bias: how hard the coding agent's prompts push subagent
+ * delegation for a model lineage. Authored on the `delegation-bias` catalog
+ * axis in `rules/classes/*.kdl` so appetite corrections live beside the other
+ * lineage truths instead of as revision compares in TypeScript.
+ *
+ * Resolved through the cascade at prompt-build time (session start, model
+ * switch) rather than baked onto `Model`: bundled rows are frozen by the
+ * generator, and the bias is read once per prompt rebuild, not per request.
+ */
+import type { Model } from "../types";
+import { DELEGATION_BIASES } from "./axes";
+import { resolveCascade } from "./cascade";
+
+/** One of `DELEGATION_BIASES`; see that constant for the semantics of each tier. */
+export type DelegationBias = (typeof DELEGATION_BIASES)[number];
+
+function isDelegationBias(value: unknown): value is DelegationBias {
+	return typeof value === "string" && (DELEGATION_BIASES as readonly string[]).includes(value);
+}
+
+/**
+ * Delegation bias for a built model; `eager` when no rule assigns one.
+ * Callers: system-prompt and tool-description rendering in the coding agent.
+ */
+export function resolveDelegationBias(model: Model): DelegationBias {
+	const { identity } = model;
+	const bias = resolveCascade({
+		provider: model.provider,
+		class: identity.class,
+		model: model.id,
+		reasoning: Boolean(model.reasoning),
+		...(identity.family !== undefined && { family: identity.family }),
+		...(identity.revision !== undefined && { revision: identity.revision }),
+	}).catalog.delegationBias;
+	return isDelegationBias(bias) ? bias : "eager";
+}

package/src/compat/resolve.ts

@@ -714,6 +714,7 @@ function resolveOpenAIResponsesPolicy(
 		supportsImageDetailOriginal: !isXaiHost && !modelMatchesHost(hostModel, "githubCopilot"),
 		supportsReasoningSummary: !isXaiHost,
 		supportsAllTurnsReasoningContext: false,
+		supportsConfigurationUpdate: false,
 		requiresReasoningOffJuiceInstruction: false,
 		stripImageInput: false,
 		thinkingLoopGuard: undefined,
@@ -815,6 +816,7 @@ function pickResponsesOnly(compat: ResolvedOpenAIResponsesCompat): ResponsesOnly
 		supportsImageDetailOriginal: compat.supportsImageDetailOriginal,
 		supportsObfuscationOptOut: compat.supportsObfuscationOptOut,
 		supportsAllTurnsReasoningContext: compat.supportsAllTurnsReasoningContext,
+		supportsConfigurationUpdate: compat.supportsConfigurationUpdate,
 		officialEndpoint: compat.officialEndpoint,
 		harmonyLeakMitigation: compat.harmonyLeakMitigation,
 		cacheControlFormat: compat.cacheControlFormat,

package/src/compat/rules/README.md

@@ -8,7 +8,7 @@ There are three ownership strata:
 - `classes/*.kdl` defines model-lineage truths: behavior inherent to a model line, optionally scoped to the providers where the census established it.
 - `providers/*.kdl` defines deployment contracts: behavior imposed by a host, plus documented per-model residue that taxonomy cannot express exactly.
 - `runtime/behavior.kdl` defines heuristics used before or outside exact model lookup: responses routing, API routes, quota tiers, plan requirements, model limits, roster exclusions, hosted defaults, pricing peers.
-- `auth/<provider>.kdl` defines the provider's auth contract: display name, env-var fallback, credential storage/format, and the declarative login / refresh flow that `@oh-my-pi/pi-ai`'s registry engines interpret (see [Auth grammar](#auth-grammar)).
+- `auth/<provider>.kdl` defines the provider's auth contract: display name, env-var fallback, credential storage/format, and the declarative login / refresh flow that `@linxiraos/pi-ai`'s registry engines interpret (see [Auth grammar](#auth-grammar)).
 
 Do not move a statistically common provider behavior into a class file, or a lineage truth into a provider file. Absence is not evidence that a capability is stripped. Preserve comments that record census provenance, reviewed exceptions, and why a `models` residue remains.
 
@@ -257,7 +257,7 @@ Matcher properties on `route` / `exclude-models` / `tier` nodes are `exact=` / `
 
 ## Auth grammar
 
-Every provider has exactly one `auth "<id>" { … }` node under `auth/`; `auth/_order.kdl` holds a single `login-order "id" …` node pinning the `/login` roster order (every provider with a `login` and `show-in-login-list` unset/true must appear; providers without a login sort alphabetically after it). Runtime accessors live in `src/compat/auth.ts`; the id unions in the generated `src/compat/auth-ids.ts`. Every provider in `provider-models/descriptors.ts` needs an auth node (`@oh-my-pi/pi-ai` type-checks this).
+Every provider has exactly one `auth "<id>" { … }` node under `auth/`; `auth/_order.kdl` holds a single `login-order "id" …` node pinning the `/login` roster order (every provider with a `login` and `show-in-login-list` unset/true must appear; providers without a login sort alphabetically after it). Runtime accessors live in `src/compat/auth.ts`; the id unions in the generated `src/compat/auth-ids.ts`. Every provider in `provider-models/descriptors.ts` needs an auth node (`@linxiraos/pi-ai` type-checks this).
 
 ```kdl
 auth "anthropic" {
@@ -271,7 +271,7 @@ auth "anthropic" {
         state "hex"                              // hex | uuid | none
         authorize-params { code "true" }         // standard=#false drops client_id/response_type/redirect_uri/scope/PKCE/state
         instructions "Complete login in your browser…"
-        callback port=54545 path="/callback" hostname="localhost" redirect-uri="…" redirect-uri-env="VAR" port-fallback=#true manual-only=#false
+        callback port=54545 path="/callback" hostname="localhost" redirect-uri="…" redirect-uri-env="VAR" port-fallback=#true manual-only=#false native-scheme=#false
         token url="https://api.anthropic.com/v1/oauth/token" body="json" { params { state "{state}" } headers { X "y" } }
         credential {
             access "access_token"                // dot path; `claim="a|b"` reads JWT claims; `literal="…"` pins a value
@@ -306,9 +306,9 @@ Login kinds:
 - `login "api-key" { auth-url "…"; instructions "…"; prompt "…" placeholder="…"; empty-fallback "…"; normalize "strip-bearer"; validate … }` — `validate "chat-completions" base-url= model= tolerate-model-denied= max-tokens-field= max-tokens=`, `validate "anthropic-messages" base-url= model=`, or `validate "models-endpoint" url= base-url-env= headers-hook=`; all accept `label=` (error-message label, defaults to `name`) and `optional=#true` (only auth failures reject).
 - `login "oauth-code" { … }` as above; `token`/`refresh` `params` values may use `{code}`, `{state}`, `{redirect_uri}`, `{code_verifier}`, `{client_id}`, `{client_secret}`, `{refresh_token}`, `{scope}`; the standard grant parameters are sent unless `standard=#false`.
 - `login "device-code" { client-id …; base-url "…"; scopes …; headers-hook "…"; device url="{base}/…" body="form" { params {…} headers {…} }; token url="…" url-hook="…"; response user-code= device-code= verification-uri= verification-uri-complete= interval= expires-in=; instructions "Enter code: {user_code}"; credential {…}; userinfo …; after-exchange hook=… }`.
-- `login "custom" hook="name"` — the whole flow is a named `@oh-my-pi/pi-ai` hook (`src/registry/hooks/custom.ts`).
+- `login "custom" hook="name"` — the whole flow is a named `@linxiraos/pi-ai` hook (`src/registry/hooks/custom.ts`).
 
-Hook names are validated against the hook tables in `@oh-my-pi/pi-ai/src/registry/hooks` by that package's `auth-hooks-registry` test. Values marked `encoding="base64"` are public OAuth client ids stored obfuscated to keep secret scanners quiet; they are decoded at runtime.
+Hook names are validated against the hook tables in `@linxiraos/pi-ai/src/registry/hooks` by that package's `auth-hooks-registry` test. Values marked `encoding="base64"` are public OAuth client ids stored obfuscated to keep secret scanners quiet; they are decoded at runtime.
 
 ## Vendoring provenance
 

package/src/compat/rules/auth/openai-codex.kdl

@@ -8,7 +8,7 @@ auth "openai-codex" {
 		authorize-params {
 			id_token_add_organizations "true"
 			codex_cli_simplified_flow "true"
-			originator "pi"
+			originator "omp"
 		}
 		instructions "A browser window should open. Complete login to finish."
 		// OpenAI only allowlists this exact URI; a busy port must fail rather than fall back.

package/src/compat/rules/auth/zai-coding-plan.kdl

@@ -4,9 +4,13 @@ auth "zai-coding-plan" {
 		client-id "client_P8X5CMWmlaRO9gyO-KSqtg" env="ZAI_OAUTH_CLIENT_ID"
 		authorize-url "https://chat.z.ai/api/oauth/authorize" env="ZAI_OAUTH_AUTHORIZE_URL"
 		// No PKCE: matches ZCode's authorize request verbatim.
-		// ZCode registers this exact loopback URI; any other host/port is rejected (#10245).
-		callback port=9999 path="/callback" hostname="127.0.0.1" redirect-uri="http://127.0.0.1:9999/callback" port-fallback=#false
-		instructions "Complete Z.ai login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted."
+		// Z.AI's server-side allowlist now rejects every loopback redirect_uri for
+		// this client (#10745); only ZCode's desktop scheme still validates. On a
+		// supported local desktop, temporarily receive that scheme and restore its
+		// previous handler. Remote and unsupported sessions retain manual input.
+		// `redirect-uri-env` lets users adapt to further allowlist shifts without a release.
+		callback port=0 redirect-uri="zcode://zai-auth/callback" redirect-uri-env="ZAI_OAUTH_REDIRECT_URI" manual-only=#true native-scheme=#true
+		instructions "Complete Z.ai login in your browser. On supported local desktops, omp captures the zcode:// callback and restores its previous handler automatically. You can also paste the final redirect URL or authorization code when prompted."
 		token url="https://zcode.z.ai/api/v1/oauth/token" url-env="ZAI_OAUTH_TOKEN_URL" body="json" standard=#false {
 			params {
 				provider "zai"

package/src/compat/rules/classes/openai.kdl

@@ -30,6 +30,22 @@ class "openai" {
 		thinking-efforts "low" "medium" "high" "xhigh" "max"
 		requires-reasoning-off-juice-instruction #true
 	}
+	// Delegation appetite is a lineage trait. GPT-5.6 was trained on Codex's
+	// "no subagents unless asked" developer message; GPT-6 fans out on its own
+	// and over-delegates under Claude-calibrated prompts (reflexive scouts,
+	// single-agent babysitting), so it gets the restrained tier instead.
+	revision "=5.6" {
+		delegation-bias "gated"
+	}
+	revision ">=6" {
+		delegation-bias "restrained"
+	}
+	// GPT-6 Astra changes reasoning effort mid-conversation through a
+	// `configuration_update` input item so the request-level effort (and the
+	// cached prompt prefix) stays put; every other SKU 400s on the item type.
+	models "gpt-6-astra" {
+		supports-configuration-update #true
+	}
 	// Codex SKUs: the advertised 400K figure includes the output budget; the
 	// true prompt window is 272K. Spark budgets are its own family's.
 	family "codex" {

package/src/compat/rules/providers/openai-codex.kdl

@@ -69,9 +69,9 @@ provider "openai-codex" {
 				}
 			}
 		}
-		// First-party GPT-5 Responses SKUs support the freeform apply_patch
+		// First-party GPT-5/GPT-6 Responses SKUs support the freeform apply_patch
 		// custom tool with a Lark grammar.
-		revision ">=5 <6" {
+		revision ">=5 <7" {
 			apply-patch-tool-type "freeform"
 		}
 	}

package/src/compat/rules/providers/openai.kdl

@@ -40,7 +40,7 @@ provider "openai" {
 				reasoning-disable-mode "none-effort"
 			}
 		}
-		revision ">=5 <6" {
+		revision ">=5 <7" {
 			apply-patch-tool-type "freeform"
 		}
 	}

package/src/compat/rules.json

@@ -6224,7 +6224,46 @@
 				}
 			},
 			{
-				"source": "classes/openai.kdl:36",
+				"source": "classes/openai.kdl:37",
+				"class": "openai",
+				"revision": [
+					{
+						"op": "=",
+						"revision": "5.6.0"
+					}
+				],
+				"catalog": {
+					"delegationBias": "gated"
+				}
+			},
+			{
+				"source": "classes/openai.kdl:40",
+				"class": "openai",
+				"revision": [
+					{
+						"op": ">=",
+						"revision": "6.0.0"
+					}
+				],
+				"catalog": {
+					"delegationBias": "restrained"
+				}
+			},
+			{
+				"source": "classes/openai.kdl:46",
+				"class": "openai",
+				"models": [
+					{
+						"kind": "exact",
+						"value": "gpt-6-astra"
+					}
+				],
+				"wire": {
+					"supportsConfigurationUpdate": true
+				}
+			},
+			{
+				"source": "classes/openai.kdl:52",
 				"class": "openai",
 				"family": "codex",
 				"revision": [
@@ -10650,7 +10689,7 @@
 					},
 					{
 						"op": "<",
-						"revision": "6.0.0"
+						"revision": "7.0.0"
 					}
 				],
 				"catalog": {
@@ -10955,7 +10994,7 @@
 					},
 					{
 						"op": "<",
-						"revision": "6.0.0"
+						"revision": "7.0.0"
 					}
 				],
 				"catalog": {
@@ -14919,7 +14958,7 @@
 					"authorizeParams": {
 						"id_token_add_organizations": "true",
 						"codex_cli_simplified_flow": "true",
-						"originator": "pi"
+						"originator": "omp"
 					},
 					"clientId": {
 						"value": "app_EMoamEEZ73f0CkXaXp7hrann"
@@ -14934,6 +14973,7 @@
 						"hostname": "localhost",
 						"portFallback": false,
 						"manualOnly": false,
+						"nativeScheme": false,
 						"redirectUri": {
 							"value": "http://localhost:1455/auth/callback"
 						}
@@ -15031,7 +15071,8 @@
 						"path": "/callback",
 						"hostname": "localhost",
 						"portFallback": true,
-						"manualOnly": false
+						"manualOnly": false,
+						"nativeScheme": false
 					},
 					"token": {
 						"url": {
@@ -15153,16 +15194,20 @@
 						]
 					},
 					"callback": {
-						"port": 9999,
+						"port": 0,
 						"path": "/callback",
-						"hostname": "127.0.0.1",
-						"portFallback": false,
-						"manualOnly": false,
+						"hostname": "localhost",
+						"portFallback": true,
+						"manualOnly": true,
+						"nativeScheme": true,
 						"redirectUri": {
-							"value": "http://127.0.0.1:9999/callback"
+							"value": "zcode://zai-auth/callback",
+							"env": [
+								"ZAI_OAUTH_REDIRECT_URI"
+							]
 						}
 					},
-					"instructions": "Complete Z.ai login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted.",
+					"instructions": "Complete Z.ai login in your browser. On supported local desktops, omp captures the zcode:// callback and restores its previous handler automatically. You can also paste the final redirect URL or authorization code when prompted.",
 					"token": {
 						"url": {
 							"value": "https://zcode.z.ai/api/v1/oauth/token",
@@ -15203,7 +15248,7 @@
 				"refresh": {
 					"kind": "none"
 				},
-				"callbackPort": 9999,
+				"callbackPort": 0,
 				"pasteCode": true
 			},
 			{
@@ -15330,7 +15375,8 @@
 						"path": "/callback",
 						"hostname": "localhost",
 						"portFallback": true,
-						"manualOnly": false
+						"manualOnly": false,
+						"nativeScheme": false
 					},
 					"token": {
 						"url": {
@@ -15417,7 +15463,8 @@
 						"path": "/callback",
 						"hostname": "127.0.0.1",
 						"portFallback": true,
-						"manualOnly": false
+						"manualOnly": false,
+						"nativeScheme": false
 					},
 					"token": {
 						"url": {
@@ -15497,7 +15544,8 @@
 						"path": "/oauth-callback",
 						"hostname": "127.0.0.1",
 						"portFallback": true,
-						"manualOnly": false
+						"manualOnly": false,
+						"nativeScheme": false
 					},
 					"token": {
 						"url": {
@@ -15595,7 +15643,8 @@
 						"path": "/oauth2callback",
 						"hostname": "127.0.0.1",
 						"portFallback": true,
-						"manualOnly": false
+						"manualOnly": false,
+						"nativeScheme": false
 					},
 					"token": {
 						"url": {
@@ -15861,6 +15910,7 @@
 						"hostname": "localhost",
 						"portFallback": true,
 						"manualOnly": false,
+						"nativeScheme": false,
 						"redirectUri": {
 							"env": [
 								"GITLAB_REDIRECT_URI"
@@ -15955,6 +16005,7 @@
 						"hostname": "localhost",
 						"portFallback": true,
 						"manualOnly": true,
+						"nativeScheme": false,
 						"redirectUri": {
 							"value": "vscode://gitlab.gitlab-workflow/authentication"
 						}

package/src/compat/types.ts

@@ -422,7 +422,7 @@ export interface CompiledOAuthRequest {
 	timeoutMs?: number;
 }
 
-/** Loopback callback configuration for authorization-code logins. */
+/** Callback transport configuration for authorization-code logins. */
 export interface CompiledCallback {
 	port: number;
 	path: string;
@@ -430,9 +430,11 @@ export interface CompiledCallback {
 	redirectUri?: CompiledAuthValue;
 	portFallback: boolean;
 	manualOnly: boolean;
+	/** Temporarily receive a custom-scheme redirect through the native OS handler. */
+	nativeScheme: boolean;
 }
 
-/** Authorization-code login through the loopback callback server. */
+/** Authorization-code login through a loopback, native-scheme, or manual callback. */
 export interface CompiledOAuthCodeLogin {
 	kind: "oauth-code";
 	clientId?: CompiledAuthValue;