@oh-my-pi/pi-catalog 18.1.8 → 18.1.9

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## [Unreleased]
 
+## [18.1.9] - 2026-09-04
+
+### Added
+
+- Added the `delegation-bias` capability for tuning how agents delegate work to subagents.
+
+### Changed
+
+- Adjusted subagent delegation for GPT-6 and newer OpenAI models to reduce unnecessary delegation.
+
+### Fixed
+
+- Fixed `/login zai` for Z.AI GLM Coding Plan by supporting the provider’s updated authentication flow, including local desktop sign-in, remote paste-code completion, and the configurable `ZAI_OAUTH_REDIRECT_URI`.
+
 ## [18.1.8] - 2026-09-03
 
 ### Added

package/dist/types/compat/axes.d.ts

@@ -36,6 +36,14 @@ export interface AxisDef {
 }
 /** Effort tiers accepted by taxonomy collapse/override vocabulary (`Effort` ∪ `"off"`). */
 export declare const EFFORT_TIERS: readonly string[];
+/**
+ * How hard agent prompts push subagent delegation for a model lineage
+ * (`delegation-bias` axis). `eager` is the unassigned default: the prompt
+ * actively pushes fan-out. `restrained` keeps fan-out for genuinely parallel
+ * slices but forbids reflexive scouts and single-agent babysitting. `gated`
+ * forbids subagents unless the user or a skill asks.
+ */
+export declare const DELEGATION_BIASES: readonly ["eager", "restrained", "gated"];
 /** Narrow a KDL string to an effort tier (`Effort` ∪ `"off"`). */
 export declare function isEffortTier(value: string): value is Effort | "off";
 /** Narrow a KDL string to a thinking control mode. */

package/dist/types/compat/delegation.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Delegation bias: how hard the coding agent's prompts push subagent
+ * delegation for a model lineage. Authored on the `delegation-bias` catalog
+ * axis in `rules/classes/*.kdl` so appetite corrections live beside the other
+ * lineage truths instead of as revision compares in TypeScript.
+ *
+ * Resolved through the cascade at prompt-build time (session start, model
+ * switch) rather than baked onto `Model`: bundled rows are frozen by the
+ * generator, and the bias is read once per prompt rebuild, not per request.
+ */
+import type { Model } from "../types.js";
+import { DELEGATION_BIASES } from "./axes.js";
+/** One of `DELEGATION_BIASES`; see that constant for the semantics of each tier. */
+export type DelegationBias = (typeof DELEGATION_BIASES)[number];
+/**
+ * Delegation bias for a built model; `eager` when no rule assigns one.
+ * Callers: system-prompt and tool-description rendering in the coding agent.
+ */
+export declare function resolveDelegationBias(model: Model): DelegationBias;

package/dist/types/compat/types.d.ts

@@ -407,7 +407,7 @@ export interface CompiledOAuthRequest {
     headers: Record<string, string>;
     timeoutMs?: number;
 }
-/** Loopback callback configuration for authorization-code logins. */
+/** Callback transport configuration for authorization-code logins. */
 export interface CompiledCallback {
     port: number;
     path: string;
@@ -415,8 +415,10 @@ export interface CompiledCallback {
     redirectUri?: CompiledAuthValue;
     portFallback: boolean;
     manualOnly: boolean;
+    /** Temporarily receive a custom-scheme redirect through the native OS handler. */
+    nativeScheme: boolean;
 }
-/** Authorization-code login through the loopback callback server. */
+/** Authorization-code login through a loopback, native-scheme, or manual callback. */
 export interface CompiledOAuthCodeLogin {
     kind: "oauth-code";
     clientId?: CompiledAuthValue;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-catalog",
-	"version": "18.1.8",
+	"version": "18.1.9",
 	"description": "Model catalog for omp: bundled model database, provider discovery descriptors, model identity, classification, and equivalence",
 	"homepage": "https://omp.sh",
 	"author": "Stencil Labs, Inc.",
@@ -35,12 +35,12 @@
 		"gen:proto": "bun scripts/generate-protocols.ts"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.1.8",
-		"@oh-my-pi/pi-utils": "18.1.8"
+		"@oh-my-pi/omptype": "18.1.9",
+		"@oh-my-pi/pi-utils": "18.1.9"
 	},
 	"devDependencies": {
 		"@bgotink/kdl": "0.4.0",
-		"@oh-my-pi/pi-ai": "18.1.8",
+		"@oh-my-pi/pi-ai": "18.1.9",
 		"@types/bun": "^1.3.14"
 	},
 	"engines": {

package/src/compat/axes.ts

@@ -44,6 +44,15 @@ const EFFORTS = ["minimal", "low", "medium", "high", "xhigh", "max"] as const;
 
 /** Effort tiers accepted by taxonomy collapse/override vocabulary (`Effort` ∪ `"off"`). */
 export const EFFORT_TIERS: readonly string[] = [...EFFORTS, "off"];
+
+/**
+ * How hard agent prompts push subagent delegation for a model lineage
+ * (`delegation-bias` axis). `eager` is the unassigned default: the prompt
+ * actively pushes fan-out. `restrained` keeps fan-out for genuinely parallel
+ * slices but forbids reflexive scouts and single-agent babysitting. `gated`
+ * forbids subagents unless the user or a skill asks.
+ */
+export const DELEGATION_BIASES = ["eager", "restrained", "gated"] as const;
 const THINKING_MODES = [
 	"effort",
 	"budget",
@@ -261,6 +270,7 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"context-promotion-target": { key: "contextPromotionTarget", set: "catalog", shape: "scalar" },
 	"context-window-floor": { key: "contextWindowFloor", set: "catalog", shape: "scalar" },
 	"cost-patch": { key: "costPatch", set: "catalog", shape: "object" },
+	"delegation-bias": { key: "delegationBias", set: "catalog", shape: "scalar", values: DELEGATION_BIASES },
 	"edit-revision": { key: "editRevision", set: "catalog", shape: "scalar" },
 	"input-modalities": { key: "inputModalities", set: "catalog", shape: "array", values: ["text", "image"] },
 	"limits-patch": { key: "limitsPatch", set: "catalog", shape: "object" },

package/src/compat/delegation.ts

@@ -0,0 +1,37 @@
+/**
+ * Delegation bias: how hard the coding agent's prompts push subagent
+ * delegation for a model lineage. Authored on the `delegation-bias` catalog
+ * axis in `rules/classes/*.kdl` so appetite corrections live beside the other
+ * lineage truths instead of as revision compares in TypeScript.
+ *
+ * Resolved through the cascade at prompt-build time (session start, model
+ * switch) rather than baked onto `Model`: bundled rows are frozen by the
+ * generator, and the bias is read once per prompt rebuild, not per request.
+ */
+import type { Model } from "../types";
+import { DELEGATION_BIASES } from "./axes";
+import { resolveCascade } from "./cascade";
+
+/** One of `DELEGATION_BIASES`; see that constant for the semantics of each tier. */
+export type DelegationBias = (typeof DELEGATION_BIASES)[number];
+
+function isDelegationBias(value: unknown): value is DelegationBias {
+	return typeof value === "string" && (DELEGATION_BIASES as readonly string[]).includes(value);
+}
+
+/**
+ * Delegation bias for a built model; `eager` when no rule assigns one.
+ * Callers: system-prompt and tool-description rendering in the coding agent.
+ */
+export function resolveDelegationBias(model: Model): DelegationBias {
+	const { identity } = model;
+	const bias = resolveCascade({
+		provider: model.provider,
+		class: identity.class,
+		model: model.id,
+		reasoning: Boolean(model.reasoning),
+		...(identity.family !== undefined && { family: identity.family }),
+		...(identity.revision !== undefined && { revision: identity.revision }),
+	}).catalog.delegationBias;
+	return isDelegationBias(bias) ? bias : "eager";
+}

package/src/compat/rules/README.md

@@ -271,7 +271,7 @@ auth "anthropic" {
         state "hex"                              // hex | uuid | none
         authorize-params { code "true" }         // standard=#false drops client_id/response_type/redirect_uri/scope/PKCE/state
         instructions "Complete login in your browser…"
-        callback port=54545 path="/callback" hostname="localhost" redirect-uri="…" redirect-uri-env="VAR" port-fallback=#true manual-only=#false
+        callback port=54545 path="/callback" hostname="localhost" redirect-uri="…" redirect-uri-env="VAR" port-fallback=#true manual-only=#false native-scheme=#false
         token url="https://api.anthropic.com/v1/oauth/token" body="json" { params { state "{state}" } headers { X "y" } }
         credential {
             access "access_token"                // dot path; `claim="a|b"` reads JWT claims; `literal="…"` pins a value

package/src/compat/rules/auth/zai-coding-plan.kdl

@@ -4,9 +4,13 @@ auth "zai-coding-plan" {
 		client-id "client_P8X5CMWmlaRO9gyO-KSqtg" env="ZAI_OAUTH_CLIENT_ID"
 		authorize-url "https://chat.z.ai/api/oauth/authorize" env="ZAI_OAUTH_AUTHORIZE_URL"
 		// No PKCE: matches ZCode's authorize request verbatim.
-		// ZCode registers this exact loopback URI; any other host/port is rejected (#10245).
-		callback port=9999 path="/callback" hostname="127.0.0.1" redirect-uri="http://127.0.0.1:9999/callback" port-fallback=#false
-		instructions "Complete Z.ai login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted."
+		// Z.AI's server-side allowlist now rejects every loopback redirect_uri for
+		// this client (#10745); only ZCode's desktop scheme still validates. On a
+		// supported local desktop, temporarily receive that scheme and restore its
+		// previous handler. Remote and unsupported sessions retain manual input.
+		// `redirect-uri-env` lets users adapt to further allowlist shifts without a release.
+		callback port=0 redirect-uri="zcode://zai-auth/callback" redirect-uri-env="ZAI_OAUTH_REDIRECT_URI" manual-only=#true native-scheme=#true
+		instructions "Complete Z.ai login in your browser. On supported local desktops, omp captures the zcode:// callback and restores its previous handler automatically. You can also paste the final redirect URL or authorization code when prompted."
 		token url="https://zcode.z.ai/api/v1/oauth/token" url-env="ZAI_OAUTH_TOKEN_URL" body="json" standard=#false {
 			params {
 				provider "zai"

package/src/compat/rules/classes/openai.kdl

@@ -30,6 +30,16 @@ class "openai" {
 		thinking-efforts "low" "medium" "high" "xhigh" "max"
 		requires-reasoning-off-juice-instruction #true
 	}
+	// Delegation appetite is a lineage trait. GPT-5.6 was trained on Codex's
+	// "no subagents unless asked" developer message; GPT-6 fans out on its own
+	// and over-delegates under Claude-calibrated prompts (reflexive scouts,
+	// single-agent babysitting), so it gets the restrained tier instead.
+	revision "=5.6" {
+		delegation-bias "gated"
+	}
+	revision ">=6" {
+		delegation-bias "restrained"
+	}
 	// GPT-6 Astra changes reasoning effort mid-conversation through a
 	// `configuration_update` input item so the request-level effort (and the
 	// cached prompt prefix) stays put; every other SKU 400s on the item type.

package/src/compat/rules.json

@@ -6224,7 +6224,33 @@
 				}
 			},
 			{
-				"source": "classes/openai.kdl:36",
+				"source": "classes/openai.kdl:37",
+				"class": "openai",
+				"revision": [
+					{
+						"op": "=",
+						"revision": "5.6.0"
+					}
+				],
+				"catalog": {
+					"delegationBias": "gated"
+				}
+			},
+			{
+				"source": "classes/openai.kdl:40",
+				"class": "openai",
+				"revision": [
+					{
+						"op": ">=",
+						"revision": "6.0.0"
+					}
+				],
+				"catalog": {
+					"delegationBias": "restrained"
+				}
+			},
+			{
+				"source": "classes/openai.kdl:46",
 				"class": "openai",
 				"models": [
 					{
@@ -6237,7 +6263,7 @@
 				}
 			},
 			{
-				"source": "classes/openai.kdl:42",
+				"source": "classes/openai.kdl:52",
 				"class": "openai",
 				"family": "codex",
 				"revision": [
@@ -14947,6 +14973,7 @@
 						"hostname": "localhost",
 						"portFallback": false,
 						"manualOnly": false,
+						"nativeScheme": false,
 						"redirectUri": {
 							"value": "http://localhost:1455/auth/callback"
 						}
@@ -15044,7 +15071,8 @@
 						"path": "/callback",
 						"hostname": "localhost",
 						"portFallback": true,
-						"manualOnly": false
+						"manualOnly": false,
+						"nativeScheme": false
 					},
 					"token": {
 						"url": {
@@ -15166,16 +15194,20 @@
 						]
 					},
 					"callback": {
-						"port": 9999,
+						"port": 0,
 						"path": "/callback",
-						"hostname": "127.0.0.1",
-						"portFallback": false,
-						"manualOnly": false,
+						"hostname": "localhost",
+						"portFallback": true,
+						"manualOnly": true,
+						"nativeScheme": true,
 						"redirectUri": {
-							"value": "http://127.0.0.1:9999/callback"
+							"value": "zcode://zai-auth/callback",
+							"env": [
+								"ZAI_OAUTH_REDIRECT_URI"
+							]
 						}
 					},
-					"instructions": "Complete Z.ai login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted.",
+					"instructions": "Complete Z.ai login in your browser. On supported local desktops, omp captures the zcode:// callback and restores its previous handler automatically. You can also paste the final redirect URL or authorization code when prompted.",
 					"token": {
 						"url": {
 							"value": "https://zcode.z.ai/api/v1/oauth/token",
@@ -15216,7 +15248,7 @@
 				"refresh": {
 					"kind": "none"
 				},
-				"callbackPort": 9999,
+				"callbackPort": 0,
 				"pasteCode": true
 			},
 			{
@@ -15343,7 +15375,8 @@
 						"path": "/callback",
 						"hostname": "localhost",
 						"portFallback": true,
-						"manualOnly": false
+						"manualOnly": false,
+						"nativeScheme": false
 					},
 					"token": {
 						"url": {
@@ -15430,7 +15463,8 @@
 						"path": "/callback",
 						"hostname": "127.0.0.1",
 						"portFallback": true,
-						"manualOnly": false
+						"manualOnly": false,
+						"nativeScheme": false
 					},
 					"token": {
 						"url": {
@@ -15510,7 +15544,8 @@
 						"path": "/oauth-callback",
 						"hostname": "127.0.0.1",
 						"portFallback": true,
-						"manualOnly": false
+						"manualOnly": false,
+						"nativeScheme": false
 					},
 					"token": {
 						"url": {
@@ -15608,7 +15643,8 @@
 						"path": "/oauth2callback",
 						"hostname": "127.0.0.1",
 						"portFallback": true,
-						"manualOnly": false
+						"manualOnly": false,
+						"nativeScheme": false
 					},
 					"token": {
 						"url": {
@@ -15874,6 +15910,7 @@
 						"hostname": "localhost",
 						"portFallback": true,
 						"manualOnly": false,
+						"nativeScheme": false,
 						"redirectUri": {
 							"env": [
 								"GITLAB_REDIRECT_URI"
@@ -15968,6 +16005,7 @@
 						"hostname": "localhost",
 						"portFallback": true,
 						"manualOnly": true,
+						"nativeScheme": false,
 						"redirectUri": {
 							"value": "vscode://gitlab.gitlab-workflow/authentication"
 						}

package/src/compat/types.ts

@@ -422,7 +422,7 @@ export interface CompiledOAuthRequest {
 	timeoutMs?: number;
 }
 
-/** Loopback callback configuration for authorization-code logins. */
+/** Callback transport configuration for authorization-code logins. */
 export interface CompiledCallback {
 	port: number;
 	path: string;
@@ -430,9 +430,11 @@ export interface CompiledCallback {
 	redirectUri?: CompiledAuthValue;
 	portFallback: boolean;
 	manualOnly: boolean;
+	/** Temporarily receive a custom-scheme redirect through the native OS handler. */
+	nativeScheme: boolean;
 }
 
-/** Authorization-code login through the loopback callback server. */
+/** Authorization-code login through a loopback, native-scheme, or manual callback. */
 export interface CompiledOAuthCodeLogin {
 	kind: "oauth-code";
 	clientId?: CompiledAuthValue;