@linxiraos/pi-catalog 1.2.0 → 1.3.0

package/src/compat/catalog-endpoint.ts

@@ -0,0 +1,43 @@
+import { getBundledModels, isGeneratedProvider } from "../models";
+import type { Model } from "../types";
+import { resolveCatalogPolicy } from "./catalog-policy";
+
+const bundledHosts = new Map<string, string | null>();
+
+/** Hostname of the provider's bundled base URL; every provider bundles one origin. */
+function bundledHost(provider: string): string | null {
+	let host = bundledHosts.get(provider);
+	if (host !== undefined) return host;
+	host = null;
+	if (isGeneratedProvider(provider)) {
+		for (const row of getBundledModels(provider)) {
+			try {
+				host = new URL(row.baseUrl).hostname;
+				break;
+			} catch {}
+		}
+	}
+	bundledHosts.set(provider, host);
+	return host;
+}
+
+/**
+ * Whether {@link url} is HTTPS to {@link model}'s provider's own endpoint: the
+ * host of its bundled base URL or one of its `endpoint-hosts`. A custom model
+ * or provider override that keeps a catalog provider id but points `baseUrl`
+ * at a gateway, proxy, or local server is not.
+ */
+export function isCatalogEndpointUrl(model: Model, url: string | undefined): boolean {
+	if (!url) return false;
+	let parsed: URL;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return false;
+	}
+	if (parsed.protocol !== "https:") return false;
+	if (parsed.hostname === bundledHost(model.provider)) return true;
+	// The rule compiler validates `endpoint-hosts` as an array of strings.
+	const hosts = resolveCatalogPolicy(model).endpointHosts as readonly string[] | undefined;
+	return hosts?.includes(parsed.hostname) === true;
+}

package/src/compat/image-tokenization.ts

@@ -37,12 +37,16 @@ export interface OpenAiPatchTokenization {
 }
 
 /** One model line's image billing rule: the vendor formula and its per-model numbers. */
-export type ImageTokenization =
+export type ImageTokenization = (
 	| OpenAiPatchTokenization
 	/** Anthropic 28px patches, resized to fit a padded-edge limit and a visual-token budget. */
 	| { regime: "anthropic-patch"; maxEdge: number; maxTokens: number }
 	/** A fixed per-image budget regardless of pixels (Gemini 3 `media_resolution`). */
-	| { regime: "fixed"; tokens: number };
+	| { regime: "fixed"; tokens: number }
+) & {
+	/** Provider billing was measured to match this rule; unset for docs-only rules and wire fallbacks. */
+	verified?: boolean;
+};
 
 /** A `class: "unknown"` identity for targets resolved by wire API alone. */
 const UNCLASSIFIED: Pick<ModelIdentity, "class"> = { class: "unknown" };
@@ -62,17 +66,13 @@ export interface ImageTokenizationTarget {
 	identity?: Pick<ModelIdentity, "class" | "family" | "revision">;
 }
 
-/**
- * The reader's image billing rule: its lineage rule, else its wire API's
- * fallback; undefined when neither covers it (an unclassified model on an
- * unregistered API).
- */
-export function resolveImageTokenization(target: ImageTokenizationTarget): ImageTokenization | undefined {
+/** Catalog axes for `target`'s identity on its host and wire API. */
+function resolveImageAxes(target: ImageTokenizationTarget): Record<string, unknown> {
 	const provider = target.provider ?? "";
 	const model = target.id ?? "";
 	const identity: Pick<ModelIdentity, "class" | "family" | "revision"> =
 		target.identity ?? (model ? classifyModel(provider, model, { lenient: true }) : UNCLASSIFIED);
-	const rule = resolveCascade({
+	return resolveCascade({
 		provider,
 		api: target.api ?? "",
 		class: identity.class,
@@ -80,10 +80,28 @@ export function resolveImageTokenization(target: ImageTokenizationTarget): Image
 		reasoning: false,
 		...(identity.family !== undefined && { family: identity.family }),
 		...(identity.revision !== undefined && { revision: identity.revision }),
-	}).catalog.imageTokenization;
+	}).catalog;
+}
+
+/**
+ * The reader's image billing rule: its lineage rule, else its wire API's
+ * fallback; undefined when neither covers it (an unclassified model on an
+ * unregistered API).
+ */
+export function resolveImageTokenization(target: ImageTokenizationTarget): ImageTokenization | undefined {
+	const rule = resolveImageAxes(target).imageTokenization;
 	return isImageTokenization(rule) ? rule : undefined;
 }
 
+/**
+ * Longest image edge the reader's host passes to the model (`image-max-edge`),
+ * or undefined when the host keeps the image's size.
+ */
+export function resolveImageMaxEdge(target: ImageTokenizationTarget): number | undefined {
+	const edge = resolveImageAxes(target).imageMaxEdge;
+	return typeof edge === "number" && edge > 0 ? edge : undefined;
+}
+
 /** Scale `size` down (never up) so its longest side is at most `maxEdge`. */
 function fitLongEdge(size: ImageSize, maxEdge: number): ImageSize {
 	const longest = Math.max(size.width, size.height);

package/src/compat/judgment-images.ts

@@ -0,0 +1,83 @@
+import { isRecord } from "../utils";
+import type { Model } from "../types";
+import { resolveCatalogPolicy } from "./catalog-policy";
+
+/** Bounds a judgment model applies to image inputs. */
+export interface JudgmentImageInput {
+	/** Accepted lowercase MIME types; unset adds no model-specific format restriction. */
+	mimeTypes?: readonly string[];
+	/** Images per request. */
+	maxCount?: number;
+	/** Decoded bytes per image. */
+	maxBytes?: number;
+	/** Decoded bytes across all images. */
+	maxTotalBytes?: number;
+	/** Pixels per image, when the image header reports dimensions. */
+	maxPixels?: number;
+	/** Minimum pixels per image, when the image header reports dimensions. */
+	minPixels?: number;
+	/** Inclusive bounds on each side, when the image header reports dimensions. */
+	minSide?: number;
+	maxSide?: number;
+}
+
+type NumericField = "maxCount" | "maxBytes" | "maxTotalBytes" | "maxPixels" | "minPixels" | "minSide" | "maxSide";
+
+const NUMERIC_FIELDS: readonly NumericField[] = [
+	"maxCount",
+	"maxBytes",
+	"maxTotalBytes",
+	"maxPixels",
+	"minPixels",
+	"minSide",
+	"maxSide",
+];
+const POLICY_FIELDS: Record<string, true> = {
+	mimeTypes: true,
+	maxCount: true,
+	maxBytes: true,
+	maxTotalBytes: true,
+	maxPixels: true,
+	minPixels: true,
+	minSide: true,
+	maxSide: true,
+};
+const MIME_TYPE = /^[A-Za-z0-9!#$&^_.+-]+\/[A-Za-z0-9!#$&^_.+-]+$/;
+
+function positiveInteger(value: unknown): value is number {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+
+/**
+ * Resolve image bounds assigned to this model by the catalog cascade. KDL
+ * object payloads have scalar children, so `mime-types` is authored as a
+ * comma-separated string and normalized here to the public array type.
+ */
+export function resolveJudgmentImageInput(model: Model): JudgmentImageInput | undefined {
+	const value = resolveCatalogPolicy(model).judgmentImageInput;
+	if (!isRecord(value) || Object.keys(value).some(key => !Object.hasOwn(POLICY_FIELDS, key))) return undefined;
+
+	let mimeTypes: readonly string[] | undefined;
+	if (value.mimeTypes !== undefined) {
+		if (typeof value.mimeTypes !== "string") return undefined;
+		const parsed = value.mimeTypes.split(",");
+		if (parsed.some(mimeType => !MIME_TYPE.test(mimeType))) return undefined;
+		mimeTypes = Object.freeze(parsed);
+	}
+
+	const numeric: Partial<Record<NumericField, number>> = {};
+	for (const field of NUMERIC_FIELDS) {
+		const bound = value[field];
+		if (bound === undefined) continue;
+		if (!positiveInteger(bound)) return undefined;
+		numeric[field] = bound;
+	}
+	if (
+		(numeric.minPixels !== undefined && numeric.maxPixels !== undefined && numeric.minPixels > numeric.maxPixels) ||
+		(numeric.minSide !== undefined && numeric.maxSide !== undefined && numeric.minSide > numeric.maxSide)
+	) {
+		return undefined;
+	}
+
+	return { ...(mimeTypes !== undefined && { mimeTypes }), ...numeric };
+}

package/src/compat/provider-ids.d.ts

@@ -1,2 +1,2 @@
 /** Every chat-model provider with a catalog entry (`default-model` in its provider rules). */
-export type KnownProvider = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "apple" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "cloudflare-workers-ai" | "commandcode" | "coralbricks" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "factory-droid" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "helmcode" | "huggingface" | "kilo" | "kimi-code" | "litellm" | "lm-studio" | "local" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "opencode-go" | "opencode-zen" | "openrouter" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "snowflake" | "stepfun" | "synthetic" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "web" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zenmux" | "zhipu-coding-plan";
+export type KnownProvider = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "apple" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "cloudflare-workers-ai" | "commandcode" | "coralbricks" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "factory-droid" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "helmcode" | "huggingface" | "kilo" | "kimi-code" | "litellm" | "lm-studio" | "local" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "opencode-go" | "opencode-zen" | "openrouter" | "qianfan" | "qwen-portal" | "sakana" | "sambanova" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "snowflake" | "stepfun" | "synthetic" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "web" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zenmux" | "zhipu-coding-plan";

package/src/compat/provider-ids.ts

@@ -64,6 +64,7 @@ export type KnownProvider =
 	| "qianfan"
 	| "qwen-portal"
 	| "sakana"
+	| "sambanova"
 	| "siliconflow"
 	| "siliconflow-cn"
 	| "singularityapi-dev"

package/src/compat/request-compression.ts

@@ -0,0 +1,43 @@
+import type { Model } from "../types";
+import { isCatalogEndpointUrl } from "./catalog-endpoint";
+import { resolveCatalogPolicy } from "./catalog-policy";
+
+/** `Content-Encoding` values a host may accept on request bodies. */
+export type RequestBodyEncoding = "zstd" | "gzip";
+
+/** Request-body compression contract for one request. */
+export interface RequestCompressionPolicy {
+	/** Accepted encodings, most preferred first. */
+	readonly encodings: readonly RequestBodyEncoding[];
+	/**
+	 * Pattern of a JSON 400/415 error body that rejects the encoding;
+	 * `undefined` treats every JSON 400/415 as a possible rejection. A
+	 * 400/403/415 whose body is not JSON (presumed a proxy's answer, not the
+	 * host's) is a possible rejection either way.
+	 */
+	readonly rejection: RegExp | undefined;
+}
+
+const rejectionPatterns = new Map<string, RegExp>();
+
+/**
+ * Compression contract for a request from {@link model} to {@link url}, or
+ * `undefined` when the body must go uncompressed. The `request-encodings` axis
+ * applies only while the URL reaches the provider's own endpoint
+ * ({@link isCatalogEndpointUrl}): a proxy, relay, or rerouted base URL never
+ * receives bytes it cannot read.
+ */
+export function resolveRequestCompression(model: Model, url: string): RequestCompressionPolicy | undefined {
+	const policy = resolveCatalogPolicy(model);
+	// The rule compiler validates encodings against the axis vocabulary.
+	const encodings = policy.requestEncodings as readonly RequestBodyEncoding[] | undefined;
+	if (!encodings?.length || !isCatalogEndpointUrl(model, url)) return undefined;
+	const source = policy.requestEncodingRejection;
+	if (typeof source !== "string") return { encodings, rejection: undefined };
+	let rejection = rejectionPatterns.get(source);
+	if (!rejection) {
+		rejection = new RegExp(source);
+		rejectionPatterns.set(source, rejection);
+	}
+	return { encodings, rejection };
+}

package/src/compat/request-size.ts

@@ -1,5 +1,6 @@
 import { toModelSpec } from "../provider-models/bundled-references";
 import type { Model } from "../types";
+import { resolveCatalogPolicy } from "./catalog-policy";
 import { resolveCatalogAxes } from "./resolve";
 
 const imageBudgetCache = new Map<string, number | null>();
@@ -7,12 +8,12 @@ const IMAGE_BUDGET_CACHE_MAX = 8192;
 
 /**
  * Maximum encoded inline-image bytes retained per request for a deployment with a documented body-size limit.
- * The axis is a host contract: a rerouted `baseUrl` (proxy, gateway) imposes its own limit, so the budget
- * applies only while the model targets its official endpoint.
+ * The axis is a host contract: a rerouted endpoint (proxy, gateway) imposes its own limit, so the budget applies
+ * only when `officialEndpoint` says the request reaches the model's official endpoint. `compat.officialEndpoint`
+ * classifies only the configured `baseUrl`; pi-ai's `reachesOfficialEndpoint` also follows request-time reroutes.
  */
-export function resolveInlineImageByteBudget(model: Model): number | undefined {
-	const compat = model.compat;
-	if (!compat || !("officialEndpoint" in compat) || !compat.officialEndpoint) return undefined;
+export function resolveInlineImageByteBudget(model: Model, officialEndpoint: boolean): number | undefined {
+	if (!officialEndpoint) return undefined;
 	const key = `${model.provider} ${model.id} ${model.api}`;
 	let budget = imageBudgetCache.get(key);
 	if (budget === undefined) {
@@ -23,3 +24,17 @@ export function resolveInlineImageByteBudget(model: Model): number | undefined {
 	}
 	return budget ?? undefined;
 }
+
+/**
+ * Most images one request to this deployment may carry, or `undefined` when no rule names the host. A configured
+ * `model.imageCountBudget` wins: the user knows the host behind a custom gateway. Otherwise the
+ * `official-image-count-budget` axis replaces `image-count-budget` only when `officialEndpoint` says the request
+ * reaches the model's official endpoint (see {@link resolveInlineImageByteBudget}); a rerouted endpoint keeps the
+ * provider's generic budget.
+ */
+export function resolveImageCountBudget(model: Model, officialEndpoint: boolean): number | undefined {
+	if (model.imageCountBudget !== undefined) return model.imageCountBudget;
+	const policy = resolveCatalogPolicy(model);
+	const value = (officialEndpoint && policy.officialImageCountBudget) || policy.imageCountBudget;
+	return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : undefined;
+}

package/src/compat/resolve.ts

@@ -17,6 +17,7 @@
  */
 import { Effort, THINKING_EFFORTS } from "../effort";
 import { hostMatchesUrl, modelMatchesHost } from "../hosts";
+import { withoutUnverifiedThinking } from "../model-thinking";
 import type {
 	Api,
 	CompatOf,
@@ -26,11 +27,13 @@ import type {
 	ResolvedBedrockCompat,
 	ResolvedDevinCompat,
 	ResolvedGoogleCompat,
+	ResolvedOllamaCompat,
 	ResolvedOpenAICompat,
 	ResolvedOpenAIResponsesCompat,
 	ResolvedOpenAISharedCompat,
 	ThinkingConfig,
 } from "../types";
+import { isOfficialCodexApiUrl } from "../wire/codex";
 import {
 	isAnthropicSigningProxyUrl,
 	isAzureAnthropicRoute,
@@ -117,11 +120,24 @@ class IdentityFacts {
 	}
 }
 
+/**
+ * The id a spec resolves identity and rules under: its own, unless that names
+ * no model and the row sends a model that does on the wire. A Devin Fusion
+ * pairing runs only its lead, so the lead's reviewed rules (cache-write rate,
+ * long-context tier) apply to it at build time.
+ */
+function policyModelId<TApi extends Api>(spec: ModelSpec<TApi>): string {
+	const wireId = spec.requestModelId;
+	if (wireId === undefined || wireId === spec.id) return spec.id;
+	if (classifyModel(spec.provider, spec.id).class !== "unknown") return spec.id;
+	return classifyModel(spec.provider, wireId).class === "unknown" ? spec.id : wireId;
+}
+
 function resolveIdentity<TApi extends Api>(spec: ModelSpec<TApi>): ModelIdentity {
 	// Strict on purpose: ambiguous identity is a rule-authoring defect surfaced
 	// at build/CI time, never silently degraded to `unknown`. Discovery
 	// normalization opts into leniency through `classifyModel` directly.
-	return classifyModel(spec.provider, spec.id);
+	return classifyModel(spec.provider, policyModelId(spec));
 }
 
 // ---------------------------------------------------------------------------
@@ -261,6 +277,7 @@ function hasLocalLoopbackBaseUrl(baseUrl: string | undefined): boolean {
 	let hostname: string;
 	try {
 		hostname = new URL(baseUrl).hostname.toLowerCase();
+		if (hostname.endsWith(".")) hostname = hostname.slice(0, -1);
 	} catch {
 		return false;
 	}
@@ -313,7 +330,6 @@ function isOfficialOpenAIEndpoint(provider: string, baseUrl: string): boolean {
 
 interface OpenAIDetection {
 	facts: IdentityFacts;
-	isClinePass: boolean;
 	isZai: boolean;
 	isZhipu: boolean;
 	isMoonshotNative: boolean;
@@ -351,7 +367,6 @@ function detectOpenAI(
 		(LOCAL_OPENAI_COMPAT_PROVIDERS[backendProvider] === true || hasLocalLoopbackBaseUrl(baseUrl));
 	return {
 		facts,
-		isClinePass: provider === "cline-pass",
 		isZai,
 		isZhipu,
 		isMoonshotNative,
@@ -457,7 +472,9 @@ function detectOpenAICompat(
 			provider === "github-copilot" ||
 			provider === "zenmux");
 
-	// Endpoint-only watchdogs remain here; provider and lineage policy lives in KDL.
+	// URL-keyed watchdogs: they also cover custom provider ids pointed at these
+	// hosts, which provider-keyed rules (`stream-idle-timeout-ms` in
+	// classes/{glm,kimi,mimo}.kdl) cannot match. KDL rules override them.
 	const streamIdleTimeoutMs =
 		facts.is("glm") &&
 		facts.revGte("5") &&
@@ -504,21 +521,17 @@ function detectOpenAICompat(
 		supportsMultipleSystemMessages: supportsMultipleSystemMessagesDefault,
 		supportsReasoningEffort: !isGrok && !d.isXiaomiMimo && (!(d.isZai || d.isZhipu) || supportsZaiReasoningEffort),
 		trustExplicitThinkingOnly: undefined,
-		// API-conditional: this completions-only Copilot exclusion cannot be a
-		// provider rule without changing Copilot Responses rows.
-		supportsReasoningParams: provider !== "github-copilot",
+		supportsReasoningParams: true,
 		supportsSamplingParams: true,
 		supportsPenaltyAndStopParams: !(isGrok && reasoningCapable),
 		reasoningEffortMap: {},
 		supportsUsageInStreaming: !isCerebrasHost,
 		alwaysSendMaxTokens: facts.is("kimi"),
-		disableReasoningOnForcedToolChoice:
-			!d.isClinePass && ((facts.is("kimi") && !isMoonshotKimiK3) || isAnthropicModel),
-		disableReasoningOnToolChoice: !d.isClinePass && isDeepseekFamily && reasoningCapable && !d.isOpenRouter,
+		disableReasoningOnForcedToolChoice: (facts.is("kimi") && !isMoonshotKimiK3) || isAnthropicModel,
+		disableReasoningOnToolChoice: isDeepseekFamily && reasoningCapable && !d.isOpenRouter,
 		disableReasoningWithTools: false,
-		supportsToolChoice: d.isClinePass || !d.isDirectDeepseekReasoning,
-		supportsForcedToolChoice:
-			!d.requiresEnabledThinking && !(d.isOpenCodeHost && d.isDeepseekReasoning) && !(d.isClinePass && isQwen),
+		supportsToolChoice: !d.isDirectDeepseekReasoning,
+		supportsForcedToolChoice: !d.requiresEnabledThinking && !(d.isOpenCodeHost && d.isDeepseekReasoning),
 		supportsNamedToolChoice: true,
 		maxTokensField: useMaxTokens ? "max_tokens" : "max_completion_tokens",
 		requiresToolResultName: isMistral,
@@ -527,16 +540,12 @@ function detectOpenAICompat(
 		requiresMistralToolIds: isMistral,
 		thinkingFormat,
 		kimiApiFormat: undefined,
-		reasoningDisableMode: d.isClinePass
-			? "cline-enabled-false"
-			: d.isVenice
-				? "venice-disable-thinking"
-				: resolveReasoningDisableMode(thinkingFormat),
+		reasoningDisableMode: d.isVenice ? "venice-disable-thinking" : resolveReasoningDisableMode(thinkingFormat),
 		omitReasoningEffort: false,
 		includeEncryptedReasoning: true,
 		filterReasoningHistory: d.isOpenRouter && isAnthropicModel,
 		thinkingKeep: usesMoonshotKimiPreservedThinking ? "all" : undefined,
-		reasoningContentField: d.isClinePass ? "reasoning" : "reasoning_content",
+		reasoningContentField: "reasoning_content",
 		mistralReasoningContentParts: undefined,
 		requiresReasoningContentForToolCalls:
 			(facts.is("kimi") && !d.isOpenCodeProvider) ||
@@ -554,10 +563,7 @@ function detectOpenAICompat(
 		// Template effort support is a reviewed backend × model contract in KDL.
 		qwenTemplateReasoningEffort: false,
 		requiresAssistantContentForToolCalls: facts.is("kimi") || d.isDirectDeepseekReasoning,
-		cacheControlFormat:
-			(d.isClinePass && (isQwen || isAnthropicModel)) || (d.isOpenRouter && isAnthropicModel)
-				? "anthropic"
-				: undefined,
+		cacheControlFormat: d.isOpenRouter && isAnthropicModel ? "anthropic" : undefined,
 		supportsPromptCacheBreakpoints,
 		promptCacheBreakpointTtl: supportsPromptCacheBreakpoints ? "30m" : undefined,
 		openRouterRouting: undefined,
@@ -582,7 +588,11 @@ function detectOpenAICompat(
 					: undefined,
 		streamFirstEventTimeoutMs: d.isLocalServingBackend ? 0 : undefined,
 		streamIdleTimeoutMs,
-		stripDeepseekSpecialTokens: facts.is("deepseek") && (provider === "nvidia" || provider === "deepseek"),
+		stripDeepseekSpecialTokens: false,
+		// Present as a key so models.yml `compat` can set it; unset unless a rule assigns it.
+		stripThinkingHistory: undefined,
+		// URL-derived like the Responses field; unset off the official OpenAI API.
+		officialEndpoint: isOfficialOpenAIEndpoint(spec.provider, baseUrl) || undefined,
 		streamMarkupHealingPattern: detectStreamMarkupHealing(spec.provider, facts, baseUrl),
 		reasoningDeltasMayBeCumulative: false,
 		emptyLengthFinishIsContextError: false,
@@ -640,15 +650,13 @@ function fixupOpenAICompat(
 		compat.extraBody = Object.keys(extraBody).length > 0 ? extraBody : undefined;
 	}
 	if (spec.compat?.reasoningDisableMode === undefined && !("reasoningDisableMode" in axes.wire)) {
-		compat.reasoningDisableMode = d.isClinePass
-			? "cline-enabled-false"
-			: d.requiresEnabledThinking
-				? "omit"
-				: d.isDirectDeepseekReasoning
-					? "zai-thinking-disabled"
-					: d.isVenice
-						? "venice-disable-thinking"
-						: resolveReasoningDisableMode(compat.thinkingFormat);
+		compat.reasoningDisableMode = d.requiresEnabledThinking
+			? "omit"
+			: d.isDirectDeepseekReasoning
+				? "zai-thinking-disabled"
+				: d.isVenice
+					? "venice-disable-thinking"
+					: resolveReasoningDisableMode(compat.thinkingFormat);
 	}
 	if (
 		spec.compat?.omitReasoningEffort === undefined &&
@@ -737,7 +745,8 @@ function resolveOpenAIResponsesPolicy(
 		supportsLongPromptCacheRetention: isOpenAIUrl,
 		supportsPromptCacheBreakpoints,
 		promptCacheBreakpointTtl: supportsPromptCacheBreakpoints ? "30m" : undefined,
-		strictResponsesPairing: isAzure || provider === "github-copilot",
+		// Provider ids are rule-owned; the URL arm keeps custom Azure endpoints paired.
+		strictResponsesPairing: hostMatchesUrl(baseUrl, "azureOpenAI"),
 		// Azure's provider id alone only implies support while its endpoint is
 		// resolved at runtime; an explicit non-Azure baseUrl is a proxy, like Codex.
 		supportsImageDetailOriginal:
@@ -766,7 +775,7 @@ function resolveOpenAIResponsesPolicy(
 		disableReasoningOnToolChoice: isDeepseekFamily && reasoningCapable && !isOpenRouter,
 		disableReasoningWithTools: false,
 		supportsToolChoice: true,
-		supportsForcedToolChoice: provider !== "opencode-go" && provider !== "opencode-zen",
+		supportsForcedToolChoice: true,
 		supportsNamedToolChoice: true,
 		reasoningContentField: "reasoning_content",
 		requiresReasoningContentForToolCalls:
@@ -796,12 +805,16 @@ function resolveOpenAIResponsesPolicy(
 		supportsObfuscationOptOut: isOpenAIUrl || provider === "openai",
 		storeResponses: false,
 		connectionBoundNativeHistory: false,
-		officialEndpoint: isOfficialOpenAIEndpoint(provider, baseUrl),
+		// The Codex backend is official at the URL its requests default to when `baseUrl` is unset, and at paths
+		// under it such as `/codex` and `/codex/responses`, which its requests resolve to the same endpoint.
+		officialEndpoint:
+			isOfficialOpenAIEndpoint(provider, baseUrl) ||
+			(api === "openai-codex-responses" && isOfficialCodexApiUrl(baseUrl)),
 		harmonyLeakMitigation: false,
 		rejectRootObjectUnion: false,
 		retryWithoutStrictOnGrammarError: false,
 		cacheControlFormat: isOpenRouter && isAnthropicModel ? "anthropic" : undefined,
-		stripDeepseekSpecialTokens: facts.is("deepseek") && (provider === "nvidia" || provider === "deepseek"),
+		stripDeepseekSpecialTokens: false,
 		streamMarkupHealingPattern: detectStreamMarkupHealing(provider, facts, baseUrl),
 		reasoningDeltasMayBeCumulative: false,
 		emptyLengthFinishIsContextError: false,
@@ -892,6 +905,7 @@ function resolveAnthropicPolicy(
 		supportsContextManagement: true,
 		supportsServerCompaction: false,
 		firstPartyProvider: false,
+		honorsClaudeCodeBetaKillSwitch: false,
 		supportsOutputEffort: true,
 		disableStrictTools: rejectsStrictTools,
 		// Present as a key so models.yml `compat` can set it; unset unless detected.
@@ -953,9 +967,17 @@ function resolveBedrockPolicy(spec: ModelSpec<"bedrock-converse-stream">, axes:
 	return compat;
 }
 
+function resolveOllamaPolicy(spec: ModelSpec<"ollama-chat">, axes: ResolvedAxes): ResolvedOllamaCompat {
+	const compat: ResolvedOllamaCompat = { stripThinkingHistory: false };
+	applyWireAxes(compat, axes.wire, "ollama-chat");
+	applyCompatOverrides(compat, spec.compat);
+	return compat;
+}
+
 function resolveDevinPolicy(spec: ModelSpec<"devin-agent">, axes: ResolvedAxes): ResolvedDevinCompat {
 	const compat: ResolvedDevinCompat = {
-		trustExplicitThinkingOnly: true,
+		// Rule-owned: `on-api "devin-agent"` in providers/devin.kdl opts in.
+		trustExplicitThinkingOnly: false,
 		modelRouter: false,
 		supportsParallelToolCalls: false,
 	};
@@ -979,6 +1001,10 @@ function resolveGooglePolicy(
 		claudeThinkingBetaHeader: false,
 		antigravityClaudeToolMode: false,
 		stripImageInput: false,
+		// Unset means "no image contract": images go out as sent. Keys exist so
+		// a KDL rule or a user `compat` block can declare one.
+		maxImageDimension: undefined,
+		maxImagePayloadBytes: undefined,
 	};
 	applyWireAxes(compat, axes.wire, spec.api);
 	applyCompatOverrides(compat, spec.compat);
@@ -1004,7 +1030,11 @@ function readCompatEffortMap(compat: CompatOf<Api>): Partial<Record<Effort, stri
 	const map = compat.reasoningEffortMap;
 	return map && Object.keys(map).length > 0 ? map : undefined;
 }
-/** Host-quirk effort remaps detected outside the rules (URL/API compounds). */
+/**
+ * URL-keyed Fireworks effort remap: covers custom provider ids pointed at the
+ * Fireworks host, which the `fireworks`/`firepass` `thinking-effort-map`
+ * rules cannot match. Rule and configured maps override it.
+ */
 const FIREWORKS_THINKING_EFFORT_MAP: Readonly<Partial<Record<Effort, string>>> = {
 	[Effort.Minimal]: "none",
 };
@@ -1015,12 +1045,9 @@ function defaultThinkingMode<TApi extends Api>(spec: ModelSpec<TApi>, facts: Ide
 		case "google-generative-ai":
 		case "google-gemini-cli":
 		case "google-vertex":
-			return facts.is("gemini") && facts.revMajor() === 3 ? "google-level" : "budget";
+			// Gemini 3+ `google-level` is a `thinking-mode` rule in classes/gemini.kdl.
+			return "budget";
 		case "anthropic-messages":
-			if (facts.is("minimax") && facts.family("m2", "m3")) return "anthropic-adaptive";
-			if (facts.is("glm") && facts.revGte("5.2") && (spec.provider === "umans" || spec.provider === "zai")) {
-				return "anthropic-budget-effort";
-			}
 			if (facts.is("anthropic")) {
 				// Haiku stays on budget thinking until 5.5, its first adaptive generation.
 				if (facts.revGte(facts.family("haiku") ? "5.5" : "4.6")) return "anthropic-adaptive";
@@ -1088,6 +1115,7 @@ interface RuleThinking {
 	supportsDisplay?: boolean;
 	prefixBinding?: boolean;
 	upgradeNeutral?: boolean;
+	unverified?: boolean;
 }
 
 function readRuleThinking(axes: ResolvedAxes): RuleThinking {
@@ -1108,6 +1136,7 @@ function readRuleThinking(axes: ResolvedAxes): RuleThinking {
 	if (typeof raw.supportsDisplay === "boolean") out.supportsDisplay = raw.supportsDisplay;
 	if (typeof raw.prefixBinding === "boolean") out.prefixBinding = raw.prefixBinding;
 	if (typeof raw.upgradeNeutral === "boolean") out.upgradeNeutral = raw.upgradeNeutral;
+	if (typeof raw.unverified === "boolean") out.unverified = raw.unverified;
 	return out;
 }
 
@@ -1155,13 +1184,13 @@ function resolveThinkingPolicy<TApi extends Api>(
 	// not re-expand it into an unadvertised ladder. Absent metadata is
 	// repaired only where KDL opts in with `thinking-upgrade-neutral`
 	// alongside a reviewed `thinking-efforts` ladder (the cascade upgrade for
-	// stale source capability data); otherwise the neutral default holds.
-	if (!spec.reasoning && (explicitThinking !== undefined || rule.upgradeNeutral !== true)) return undefined;
+	// stale source capability data). On deployments whose discovery reports no
+	// capabilities (`thinking-unverified`), an unclassified neutral spec — nothing
+	// says whether it reasons — gets an unverified ladder the user may opt into.
+	const unverified = !compatReasoning(spec, axes);
 	if (
-		spec.provider === "cline-pass" &&
-		compat !== undefined &&
-		"supportsReasoningEffort" in compat &&
-		compat.supportsReasoningEffort === false
+		unverified &&
+		(explicitThinking !== undefined || facts.identity.class !== "unknown" || rule.unverified !== true)
 	) {
 		return undefined;
 	}
@@ -1180,9 +1209,14 @@ function resolveThinkingPolicy<TApi extends Api>(
 	if (config.efforts.length === 0) {
 		throw new Error(`Model ${spec.provider}/${spec.id} resolved to an empty thinking range`);
 	}
-	if (rule.defaultLevel !== undefined) config.defaultLevel = rule.defaultLevel;
 	const effortMap = mergeEffortMap(spec, rule.effortMap, compat, config.efforts);
 	if (effortMap !== undefined) config.effortMap = effortMap;
+	if (unverified) {
+		// Off-by-default opt-in: no default level, mandatory effort, or wire off-switch.
+		config.unverified = true;
+		return config;
+	}
+	if (rule.defaultLevel !== undefined) config.defaultLevel = rule.defaultLevel;
 	if (rule.effortBudgets !== undefined) config.effortBudgets = rule.effortBudgets;
 	const supportsDisplay = rule.supportsDisplay ?? defaultSupportsDisplay(spec, facts);
 	if (supportsDisplay) config.supportsDisplay = true;
@@ -1279,7 +1313,7 @@ function buildResolveTarget<TApi extends Api>(
 		provider: providerType,
 		api: spec.api,
 		class: identity.class,
-		model: spec.id,
+		model: policyModelId(spec),
 		reasoning: Boolean(spec.reasoning),
 	};
 	if (identity.family !== undefined) target.family = identity.family;
@@ -1315,7 +1349,8 @@ export function resolveModelPolicy<TApi extends Api>(
 	spec: ModelSpec<TApi>,
 	route?: ResolveRoute,
 ): ResolvedModelPolicy<TApi>;
-export function resolveModelPolicy(spec: ModelSpec<Api>, route?: ResolveRoute): ResolvedModelPolicy<Api> {
+export function resolveModelPolicy(input: ModelSpec<Api>, route?: ResolveRoute): ResolvedModelPolicy<Api> {
+	const spec = withoutUnverifiedThinking(input);
 	const identity = resolveIdentity(spec);
 	const facts = new IdentityFacts(identity);
 	const target = buildResolveTarget(spec, identity);
@@ -1338,6 +1373,8 @@ export function resolveModelPolicy(spec: ModelSpec<Api>, route?: ResolveRoute):
 		compat = resolveAnthropicPolicy(spec, facts, axes);
 	} else if (specUsesApi(spec, "bedrock-converse-stream")) {
 		compat = resolveBedrockPolicy(spec, axes);
+	} else if (specUsesApi(spec, "ollama-chat")) {
+		compat = resolveOllamaPolicy(spec, axes);
 	} else if (specUsesApi(spec, "devin-agent")) {
 		compat = resolveDevinPolicy(spec, axes);
 	} else if (