@oh-my-pi/pi-catalog 18.10.1 → 18.10.3

package/CHANGELOG.md

@@ -2,6 +2,44 @@
 
 ## [Unreleased]
 
+## [18.10.3] - 2026-10-12
+
+### Breaking Changes
+
+- `resolveInlineImageByteBudget(model, officialEndpoint)` and `resolveImageCountBudget(model, officialEndpoint)` take whether the request reaches the official endpoint instead of reading `compat.officialEndpoint`, which misses request-time reroutes such as `ANTHROPIC_BASE_URL`; pass pi-ai's `reachesOfficialEndpoint(model)` ([#15434](https://github.com/can1357/oh-my-pi/pull/15434) by [@will-bogusz](https://github.com/will-bogusz))
+
+### Added
+
+- Added Muse Wonder (`muse-wonder-1.0`) to Meta and Muse Code with its `minimal`–`max` effort ladder and pricing
+- Added the `thinking-unverified` rule axis: on hosts whose model list carries no capability metadata (Meta, Muse Code), unrecognized models now offer an opt-in thinking ladder (`ThinkingConfig.unverified`) instead of none
+- Added `thinking-unverified` axis for offering reasoning ladders on unclassified model IDs
+- Added `Muse Wonder 1.0` model definition to Meta provider
+- Added the opt-in `snapcompact-image-reads` axis: snapcompact images a fresh `read` result only for readers whose rule sets it; Claude Opus 5.5 and later opt in ([#14249](https://github.com/can1357/oh-my-pi/pull/14249) by [@will-bogusz](https://github.com/will-bogusz))
+- Added the `image-count-budget` rule for how many images one request may carry (Anthropic 90, Codex 200, other hosts unchanged) and the `official-image-count-budget` override that applies only on the official endpoint: Anthropic 600 (100 on 200k-window Claude models), Codex 2,000 ([#15434](https://github.com/can1357/oh-my-pi/pull/15434) by [@will-bogusz](https://github.com/will-bogusz))
+- Added a 24 MB inline-image byte budget for the Codex backend, which now counts as its official endpoint at its default URL and at paths under it such as `/codex/responses` ([#15434](https://github.com/can1357/oh-my-pi/pull/15434) by [@will-bogusz](https://github.com/will-bogusz))
+- Added `isOfficialCodexApiUrl` to `wire/codex`, moved from pi-ai ([#15434](https://github.com/can1357/oh-my-pi/pull/15434) by [@will-bogusz](https://github.com/will-bogusz))
+- Added `verified` to `image-tokenization` rules, marking the Claude 4.7+ high-res tier and the GPT-5.5 to 6.1 and gpt-6-astra rules as matching measured provider billing ([#15442](https://github.com/can1357/oh-my-pi/pull/15442) by [@will-bogusz](https://github.com/will-bogusz))
+- Added the `image-max-edge` axis and `resolveImageMaxEdge()` for hosts that shrink images before the model reads them; Cursor's Claude and GPT models and its `default` (Auto) route fit 1024×1024 ([#15448](https://github.com/can1357/oh-my-pi/pull/15448) by [@will-bogusz](https://github.com/will-bogusz))
+- Added the `thinking-replay-tokens` axis; Claude lines set it to `output` on every host, since a replayed signed thinking block bills the turn's full reasoning, not the signature's bytes ([#15446](https://github.com/can1357/oh-my-pi/pull/15446) by [@will-bogusz](https://github.com/will-bogusz))
+- Added a KDL opt-in for sibling subagent prompt-cache sharing, enabled for Muse Code's Spark 1.3, Wonder 1.0, and Wonder Full 1.0 variants over the Responses API ([#15467](https://github.com/can1357/oh-my-pi/pull/15467) by [@iliaal](https://github.com/iliaal))
+
+### Changed
+
+- Updated model definitions and compatibility rules for provider metadata
+- Google Antigravity, xAI and Cursor requests keep up to 60 images, 20 for Claude on Antigravity and Cursor, up from 5; this counts snapcompact frames and live screenshots together ([#15449](https://github.com/can1357/oh-my-pi/pull/15449) by [@will-bogusz](https://github.com/will-bogusz))
+- Snapcompact sizes archives at the frame prices measured for Antigravity Gemini (a fixed 1,089 tokens), Grok 4.6 to 4.20, and Claude Sonnet 4.6's standard tier ([#15449](https://github.com/can1357/oh-my-pi/pull/15449) by [@will-bogusz](https://github.com/will-bogusz))
+
+### Fixed
+
+- Applied `max-image-dimension` and `max-image-payload-bytes` to Google API models, and declared the 5 MiB per-image limit of Claude on Google Antigravity ([#15444](https://github.com/can1357/oh-my-pi/pull/15444) by [@will-bogusz](https://github.com/will-bogusz))
+- Fixed local token counts for OpenAI GPT-5 and later models (Codex, OpenAI, Azure, OpenRouter, Copilot and other hosts) reading about 12% low: their text is now counted with o200k_base instead of a bytes/4 estimate ([#15447](https://github.com/can1357/oh-my-pi/pull/15447) by [@will-bogusz](https://github.com/will-bogusz))
+
+## [18.10.2] - 2026-10-12
+
+### Added
+
+- Added the `honors-claude-code-beta-kill-switch` axis (`compat.honorsClaudeCodeBetaKillSwitch`), on for the `anthropic` provider, so a rule or `models.yml` override decides which providers honor `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS` ([#15458](https://github.com/can1357/oh-my-pi/pull/15458) by [@H4vC](https://github.com/H4vC))
+
 ## [18.10.0] - 2026-10-12
 
 ### Changed

package/THIRD-PARTY-NOTICES.txt

@@ -79,9 +79,9 @@ uutils coreutils (https://github.com/uutils/coreutils), MIT
 --------------------------------------------------------------------------------
 Covers: base32, base64, basename, cat, cksum (shared checksum machinery),
 b2sum, md5sum, sha1sum, sha224sum, sha256sum, sha384sum, sha512sum, comm, cp,
-cut, date, dirname, head, hostname, ln, ls, mkdir, mktemp, mv, nproc, paste,
-printenv, readlink, realpath, rm, seq, sort, stat, tac, tail, tee, touch, tr,
-truncate, uname, uniq, wc, whoami, yes.
+cut, date, dirname, head, hostname, ln, ls, mkdir, mktemp, mv, nl, nproc,
+paste, printenv, readlink, realpath, rm, seq, sort, stat, tac, tail, tee,
+touch, tr, truncate, uname, uniq, wc, whoami, yes.
 
   Copyright (c) uutils developers
 

package/dist/types/compat/image-tokenization.d.ts

@@ -23,7 +23,7 @@ export interface OpenAiPatchTokenization {
     auto: "high" | "original";
 }
 /** One model line's image billing rule: the vendor formula and its per-model numbers. */
-export type ImageTokenization = OpenAiPatchTokenization
+export type ImageTokenization = (OpenAiPatchTokenization
 /** Anthropic 28px patches, resized to fit a padded-edge limit and a visual-token budget. */
  | {
     regime: "anthropic-patch";
@@ -34,6 +34,9 @@ export type ImageTokenization = OpenAiPatchTokenization
  | {
     regime: "fixed";
     tokens: number;
+}) & {
+    /** Provider billing was measured to match this rule; unset for docs-only rules and wire fallbacks. */
+    verified?: boolean;
 };
 /** What reads the image: a built model, any `{ id }` with optional host and identity, or just a wire `{ api }`. */
 export interface ImageTokenizationTarget {
@@ -48,5 +51,10 @@ export interface ImageTokenizationTarget {
  * unregistered API).
  */
 export declare function resolveImageTokenization(target: ImageTokenizationTarget): ImageTokenization | undefined;
+/**
+ * Longest image edge the reader's host passes to the model (`image-max-edge`),
+ * or undefined when the host keeps the image's size.
+ */
+export declare function resolveImageMaxEdge(target: ImageTokenizationTarget): number | undefined;
 /** Billed input tokens for one image of `size` under `rule`; only `openai-patch` reads `detail`. */
 export declare function imageTokens(rule: ImageTokenization, size: ImageSize, detail?: ImageDetail): number;

package/dist/types/compat/request-size.d.ts

@@ -1,7 +1,15 @@
 import type { Model } from "../types.js";
 /**
  * Maximum encoded inline-image bytes retained per request for a deployment with a documented body-size limit.
- * The axis is a host contract: a rerouted `baseUrl` (proxy, gateway) imposes its own limit, so the budget
- * applies only while the model targets its official endpoint.
+ * The axis is a host contract: a rerouted endpoint (proxy, gateway) imposes its own limit, so the budget applies
+ * only when `officialEndpoint` says the request reaches the model's official endpoint. `compat.officialEndpoint`
+ * classifies only the configured `baseUrl`; pi-ai's `reachesOfficialEndpoint` also follows request-time reroutes.
  */
-export declare function resolveInlineImageByteBudget(model: Model): number | undefined;
+export declare function resolveInlineImageByteBudget(model: Model, officialEndpoint: boolean): number | undefined;
+/**
+ * Most images one request to this deployment may carry, or `undefined` when no rule names the host. The
+ * `official-image-count-budget` axis replaces `image-count-budget` only when `officialEndpoint` says the request
+ * reaches the model's official endpoint (see {@link resolveInlineImageByteBudget}); a rerouted endpoint keeps the
+ * provider's generic budget.
+ */
+export declare function resolveImageCountBudget(model: Model, officialEndpoint: boolean): number | undefined;

package/dist/types/compat/thinking-replay.d.ts

@@ -0,0 +1,9 @@
+import type { ImageTokenizationTarget } from "./image-tokenization.js";
+/**
+ * `output`: the reasoning the signature carries, at the size its turn billed
+ * as output; the signature's own bytes are free. `signature`: the signature's
+ * bytes stand in for that reasoning.
+ */
+export type ThinkingReplayTokens = "output" | "signature";
+/** How `reader` bills replayed thinking; `signature` unless its lineage declares otherwise. */
+export declare function resolveThinkingReplayTokens(reader: ImageTokenizationTarget): ThinkingReplayTokens;

package/dist/types/model-thinking.d.ts

@@ -7,7 +7,7 @@
  * id parsing, no host matching, no compat detection per request.
  */
 import { Effort } from "./effort.js";
-import type { Api, Model, ModelSpec } from "./types.js";
+import type { Api, Model, ModelSpec, ThinkingConfig } from "./types.js";
 /**
  * Runtime helpers read baked metadata only, so they accept both pre-build
  * specs and built models.
@@ -19,6 +19,16 @@ type ApiModel<TApi extends Api = Api> = ModelSpec<TApi> | Model<TApi>;
  * controllable effort surface (`thinking: undefined`).
  */
 export declare function getSupportedEfforts<TApi extends Api>(model: ApiModel<TApi>): readonly Effort[];
+/**
+ * Neutral view of a model whose thinking ladder is unverified: `reasoning: false`
+ * and no ladder. Re-entering policy resolution starts from it (the ladder is
+ * derived output, not authored input), and requests without an effort send it so
+ * no reasoning or disable fields reach an upstream that may reject them.
+ */
+export declare function withoutUnverifiedThinking<T extends {
+    reasoning: boolean;
+    thinking?: ThinkingConfig;
+}>(model: T): T;
 /**
  * Clamps a requested thinking level against explicit model metadata.
  *

package/dist/types/types.d.ts

@@ -93,6 +93,14 @@ export interface ThinkingConfig {
      * provides an explicit wire off-path.
      */
     requiresEffort?: boolean;
+    /**
+     * The catalog has no evidence this model reasons (unclassified id, no
+     * capability metadata). The ladder is offered for the user to opt into:
+     * sessions leave thinking unset until the user picks an effort, and a
+     * request without an effort goes out as non-reasoning (see
+     * `withoutUnverifiedThinking`).
+     */
+    unverified?: boolean;
 }
 export type Provider = string;
 /** Token budgets for each thinking level (token-based providers only) */
@@ -492,6 +500,14 @@ export interface AnthropicCompat {
      * contract instead. Default: false.
      */
     firstPartyProvider?: boolean;
+    /**
+     * Whether the provider honors Claude Code's `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS`
+     * kill switch, which withholds pre-release fields (`context_management`, beta
+     * tool fields, task budgets, structured-output format, `thinking.block_binding`,
+     * server compaction) with their betas. Rule-owned on the
+     * provider whose `ANTHROPIC_*` env routing Claude Code shares. Default: false.
+     */
+    honorsClaudeCodeBetaKillSwitch?: boolean;
     /**
      * Whether requests may carry `output_config.effort` (and its effort beta
      * header). Vertex AI rejects the field/header. Default: true.
@@ -928,9 +944,11 @@ export interface ResolvedOpenAIResponsesCompat extends ResolvedOpenAISharedCompa
     isVercelGatewayHost: boolean;
     /**
      * The configured endpoint is first-party OpenAI (`provider === "openai"` on
-     * an `api.openai.com` or unset baseUrl). Gates official-only Responses
-     * behavior: default-on stateful `previous_response_id` chaining and the
-     * `text.verbosity` field.
+     * an `api.openai.com` or unset baseUrl), or the Codex backend
+     * (`openai-codex-responses` on the default Codex baseUrl). Gates platform
+     * OpenAI's official-only Responses behavior (default-on stateful
+     * `previous_response_id` chaining and the `text.verbosity` field; the Codex
+     * adapter is not governed by either gate) and host request-size budgets.
      */
     officialEndpoint: boolean;
     /** Run Harmony-protocol leak detection/mitigation on streamed output. */
@@ -1055,18 +1073,32 @@ export interface GoogleCompat {
     antigravityUsageLabel?: string;
     /** Strip image inputs before encoding (text-only serving of a multimodal id). */
     stripImageInput?: boolean;
+    /**
+     * Largest width or height a single image may carry for a Claude reader on
+     * this host (see {@link AnthropicCompat.maxImageDimension}). Setting this or
+     * {@link maxImagePayloadBytes} turns on Claude's image clamp, many-image
+     * cap included; unset leaves images as sent.
+     */
+    maxImageDimension?: number;
+    /**
+     * Largest base64 payload a single image may carry, in bytes (see
+     * {@link AnthropicCompat.maxImagePayloadBytes}).
+     */
+    maxImagePayloadBytes?: number;
     /** Thinking-loop watchdog guard family applied to streamed reasoning. */
     thinkingLoopGuard?: "gemini" | "deepseek" | "xai";
     /** See {@link BedrockCompat.supportsSamplingParams}. */
     supportsSamplingParams?: boolean;
 }
 /** Fully-resolved google-API compat view, materialized once by `buildModel`. */
-export type ResolvedGoogleCompat = Required<Omit<GoogleCompat, "streamFirstEventTimeoutMs" | "streamIdleTimeoutMs" | "thinkingLoopGuard" | "antigravityUsageLabel" | "supportsSamplingParams">> & {
+export type ResolvedGoogleCompat = Required<Omit<GoogleCompat, "streamFirstEventTimeoutMs" | "streamIdleTimeoutMs" | "thinkingLoopGuard" | "antigravityUsageLabel" | "supportsSamplingParams" | "maxImageDimension" | "maxImagePayloadBytes">> & {
     streamFirstEventTimeoutMs?: number;
     streamIdleTimeoutMs?: number;
     thinkingLoopGuard?: GoogleCompat["thinkingLoopGuard"];
     antigravityUsageLabel?: string;
     supportsSamplingParams?: boolean;
+    maxImageDimension?: number;
+    maxImagePayloadBytes?: number;
 };
 /** Sparse, user-authored compat overrides for a given API (models.json / config vocabulary). */
 export type CompatConfigOf<TApi extends Api> = TApi extends "openai-completions" | "openrouter" | "openai-responses" | "azure-openai-responses" | "openai-codex-responses" ? OpenAICompat : TApi extends "anthropic-messages" ? AnthropicCompat : TApi extends "bedrock-converse-stream" ? BedrockCompat : TApi extends "devin-agent" ? DevinCompat : TApi extends "google-generative-ai" | "google-vertex" | "google-gemini-cli" ? GoogleCompat : undefined;
@@ -1145,7 +1177,7 @@ export interface ModelCost extends TokenCost {
  * generations rather than providers: DeepSeek V3 through V4 share
  * `"deepseek-v3"`; Kimi K2 through K3 share `"kimi-k2"`.
  */
-export type ModelTokenizer = "claude-v3" | "claude-v47" | "claude-v5" | "claude-v5-sonnet" | "qwen3" | "deepseek-v3" | "kimi-k2" | "glm5";
+export type ModelTokenizer = "claude-v3" | "claude-v47" | "claude-v5" | "claude-v5-sonnet" | "qwen3" | "deepseek-v3" | "kimi-k2" | "glm5" | "o200k";
 /** One account's discovered entitlements on a model; see {@link Model.accountAccess}. */
 export interface ModelAccountAccess {
     /**

package/dist/types/wire/codex.d.ts

@@ -2,6 +2,8 @@
  * Constants for OpenAI Codex (ChatGPT OAuth) backend
  */
 export declare const CODEX_BASE_URL = "https://chatgpt.com/backend-api";
+/** Strict official-Codex endpoint check; exact origin or a path boundary after {@link CODEX_BASE_URL}. */
+export declare function isOfficialCodexApiUrl(baseUrl: string | undefined): boolean;
 /**
  * Pinned OpenAI Codex client version (corresponds to @openai/codex package version).
  * Updated from npm by `bun run check-spoofed-versions --update`.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-catalog",
-	"version": "18.10.1",
+	"version": "18.10.3",
 	"description": "Model catalog for omp: bundled model database, provider discovery descriptors, model identity, classification, and equivalence",
 	"keywords": [
 		"ai",
@@ -93,12 +93,12 @@
 		"gen:proto": "bun scripts/generate-protocols.ts"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.10.1",
-		"@oh-my-pi/pi-utils": "18.10.1"
+		"@oh-my-pi/omptype": "18.10.3",
+		"@oh-my-pi/pi-utils": "18.10.3"
 	},
 	"devDependencies": {
 		"@bgotink/kdl": "0.4.0",
-		"@oh-my-pi/pi-ai": "18.10.1",
+		"@oh-my-pi/pi-ai": "18.10.3",
 		"@types/bun": "^1.3.14"
 	},
 	"engines": {

package/src/build.ts

@@ -351,8 +351,9 @@ export function buildModel<TApi extends Api>(spec: ModelSpec<TApi>): Model<TApi>
 	const model: Model<TApi> = {
 		...spec,
 		// A reviewed `thinking-upgrade-neutral` policy can repair a stale
-		// `reasoning: false` discovery default (see `resolveThinkingPolicy`);
-		// materialize the correction for transports and the picker.
+		// `reasoning: false` discovery default, and an unclassified neutral spec
+		// gets an unverified ladder (see `resolveThinkingPolicy`); materialize
+		// either for transports and the picker.
 		reasoning: spec.reasoning || policy.thinking !== undefined,
 		name: cleanModelName(spec.name),
 		identity: policy.identity,

package/src/compat/axes.ts

@@ -242,9 +242,10 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"escape-builtin-tool-names": wire("escapeBuiltinToolNames", ["anthropic"]),
 	"fast-mode": wire("fastMode", ["anthropic"]),
 	"first-party-provider": wire("firstPartyProvider", ["anthropic"]),
+	"honors-claude-code-beta-kill-switch": wire("honorsClaudeCodeBetaKillSwitch", ["anthropic"]),
 	"inject-claude-code-instruction": wire("injectClaudeCodeInstruction", ["anthropic"]),
-	"max-image-dimension": wire("maxImageDimension", ["anthropic"]),
-	"max-image-payload-bytes": wire("maxImagePayloadBytes", ["anthropic"]),
+	"max-image-dimension": wire("maxImageDimension", ["anthropic", "google"]),
+	"max-image-payload-bytes": wire("maxImagePayloadBytes", ["anthropic", "google"]),
 	"official-endpoint": wire("officialEndpoint", ["anthropic", "openai-responses"]),
 	"replay-unsigned-thinking": wire("replayUnsignedThinking", ["anthropic"]),
 	"requires-thinking-enabled": wire("requiresThinkingEnabled", ["anthropic"]),
@@ -328,6 +329,8 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"thinking-suppress-when-off": { key: "suppressWhenOff", set: "thinking", shape: "scalar" },
 	"thinking-supports-display": { key: "supportsDisplay", set: "thinking", shape: "scalar" },
 	"thinking-upgrade-neutral": { key: "upgradeNeutral", set: "thinking", shape: "scalar" },
+	/** Unclassified neutral ids here are capability-unknown: offer the ladder as opt-in. */
+	"thinking-unverified": { key: "unverified", set: "thinking", shape: "scalar" },
 
 	// ── catalog metadata ──
 	"apply-patch-tool-type": {
@@ -388,6 +391,18 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 		shape: "scalar",
 		values: [true, false],
 	},
+	/**
+	 * How the model line bills a replayed signed thinking block as input:
+	 * `output` bills the reasoning its signature carries, at the size the turn
+	 * billed as output, and not the signature's bytes. Unassigned: estimated
+	 * from the signature's bytes. Read through `./thinking-replay`.
+	 */
+	"thinking-replay-tokens": {
+		key: "thinkingReplayTokens",
+		set: "catalog",
+		shape: "scalar",
+		values: ["output", "signature"],
+	},
 	"delegation-bias": { key: "delegationBias", set: "catalog", shape: "scalar", values: DELEGATION_BIASES },
 	"discovery-api": { key: "discoveryApi", set: "catalog", shape: "scalar" },
 	"edit-prompt-variant": { key: "editPromptVariant", set: "catalog", shape: "scalar", values: ["full", "compact"] },
@@ -404,7 +419,28 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"hosted-image": { key: "hostedImage", set: "catalog", shape: "scalar", values: [true, false] },
 	/** How the model line bills an input image; shape and formulas in `./image-tokenization`. */
 	"image-tokenization": { key: "imageTokenization", set: "catalog", shape: "object" },
+	/**
+	 * Most images one request may carry, documents included where the host
+	 * counts them. Unassigned: unknown host, held to a conservative floor.
+	 */
+	"image-count-budget": { key: "imageCountBudget", set: "catalog", shape: "scalar" },
+	/**
+	 * Replaces `image-count-budget` while the request reaches the official
+	 * endpoint (pi-ai `reachesOfficialEndpoint`): a limit measured or documented
+	 * for the host's own endpoint, which a custom `baseUrl` or an
+	 * `ANTHROPIC_BASE_URL`/`FOUNDRY_BASE_URL` reroute (proxy, gateway) need not share.
+	 */
+	"official-image-count-budget": { key: "officialImageCountBudget", set: "catalog", shape: "scalar" },
+	/**
+	 * Opt-in: the reader may get a fresh `read` result as snapcompact frames
+	 * (`snapcompact.toolResults`), because it edits as exactly from frames as
+	 * from text. Unassigned: `read` results stay text, since a reader that
+	 * misreads indentation in frames makes inexact edits.
+	 */
+	"snapcompact-image-reads": { key: "snapcompactImageReads", set: "catalog", shape: "scalar", values: [true, false] },
 	"image-model": { key: "imageModel", set: "catalog", shape: "scalar" },
+	/** Longest image edge the host passes to the model: it downscales larger images to fit first. */
+	"image-max-edge": { key: "imageMaxEdge", set: "catalog", shape: "scalar" },
 	"inline-image-byte-budget": { key: "inlineImageByteBudget", set: "catalog", shape: "scalar" },
 	/**
 	 * Most questions one System One judgment request may carry; the judge
@@ -414,6 +450,12 @@ export const AXES: Readonly<Record<string, AxisDef>> = {
 	"limits-patch": { key: "limitsPatch", set: "catalog", shape: "object" },
 	"long-context-cost": { key: "longContext", set: "catalog", shape: "object" },
 	"prompt-cache": { key: "promptCache", set: "catalog", shape: "object" },
+	"task-sibling-prompt-cache": {
+		key: "taskSiblingPromptCache",
+		set: "catalog",
+		shape: "scalar",
+		values: [true, false],
+	},
 	/**
 	 * Prompt-cache lookback in block positions: how far back from a cache
 	 * breakpoint the provider looks for an earlier request's cache entry.

package/src/compat/cascade.ts

@@ -409,13 +409,16 @@ function resolveOverIndex(index: RuleIndex, target: ResolveTarget): ResolvedAxes
 			reasoning = true;
 		}
 	}
+	// Unclassified targets get their provider's ladder too: it is offered as
+	// unverified thinking (`resolveThinkingPolicy`), never as reasoning capability.
+	const offersThinking = reasoning || target.class === "unknown";
 	const wire: WinnerTable = {};
 	const thinking: WinnerTable = {};
 	const catalog: WinnerTable = {};
 	for (const { rule, rank } of ranked) {
 		contest(wire, rule.compiled.wire, rank, rule, target);
 		contest(catalog, rule.compiled.catalog, rank, rule, target);
-		if (reasoning) contest(thinking, rule.compiled.thinking, rank, rule, target);
+		if (offersThinking) contest(thinking, rule.compiled.thinking, rank, rule, target);
 	}
 	return {
 		wire: collect(wire, rule => rule.wire),

package/src/compat/image-tokenization.ts

@@ -37,12 +37,16 @@ export interface OpenAiPatchTokenization {
 }
 
 /** One model line's image billing rule: the vendor formula and its per-model numbers. */
-export type ImageTokenization =
+export type ImageTokenization = (
 	| OpenAiPatchTokenization
 	/** Anthropic 28px patches, resized to fit a padded-edge limit and a visual-token budget. */
 	| { regime: "anthropic-patch"; maxEdge: number; maxTokens: number }
 	/** A fixed per-image budget regardless of pixels (Gemini 3 `media_resolution`). */
-	| { regime: "fixed"; tokens: number };
+	| { regime: "fixed"; tokens: number }
+) & {
+	/** Provider billing was measured to match this rule; unset for docs-only rules and wire fallbacks. */
+	verified?: boolean;
+};
 
 /** A `class: "unknown"` identity for targets resolved by wire API alone. */
 const UNCLASSIFIED: Pick<ModelIdentity, "class"> = { class: "unknown" };
@@ -62,17 +66,13 @@ export interface ImageTokenizationTarget {
 	identity?: Pick<ModelIdentity, "class" | "family" | "revision">;
 }
 
-/**
- * The reader's image billing rule: its lineage rule, else its wire API's
- * fallback; undefined when neither covers it (an unclassified model on an
- * unregistered API).
- */
-export function resolveImageTokenization(target: ImageTokenizationTarget): ImageTokenization | undefined {
+/** Catalog axes for `target`'s identity on its host and wire API. */
+function resolveImageAxes(target: ImageTokenizationTarget): Record<string, unknown> {
 	const provider = target.provider ?? "";
 	const model = target.id ?? "";
 	const identity: Pick<ModelIdentity, "class" | "family" | "revision"> =
 		target.identity ?? (model ? classifyModel(provider, model, { lenient: true }) : UNCLASSIFIED);
-	const rule = resolveCascade({
+	return resolveCascade({
 		provider,
 		api: target.api ?? "",
 		class: identity.class,
@@ -80,10 +80,28 @@ export function resolveImageTokenization(target: ImageTokenizationTarget): Image
 		reasoning: false,
 		...(identity.family !== undefined && { family: identity.family }),
 		...(identity.revision !== undefined && { revision: identity.revision }),
-	}).catalog.imageTokenization;
+	}).catalog;
+}
+
+/**
+ * The reader's image billing rule: its lineage rule, else its wire API's
+ * fallback; undefined when neither covers it (an unclassified model on an
+ * unregistered API).
+ */
+export function resolveImageTokenization(target: ImageTokenizationTarget): ImageTokenization | undefined {
+	const rule = resolveImageAxes(target).imageTokenization;
 	return isImageTokenization(rule) ? rule : undefined;
 }
 
+/**
+ * Longest image edge the reader's host passes to the model (`image-max-edge`),
+ * or undefined when the host keeps the image's size.
+ */
+export function resolveImageMaxEdge(target: ImageTokenizationTarget): number | undefined {
+	const edge = resolveImageAxes(target).imageMaxEdge;
+	return typeof edge === "number" && edge > 0 ? edge : undefined;
+}
+
 /** Scale `size` down (never up) so its longest side is at most `maxEdge`. */
 function fitLongEdge(size: ImageSize, maxEdge: number): ImageSize {
 	const longest = Math.max(size.width, size.height);

package/src/compat/request-size.ts

@@ -1,5 +1,6 @@
 import { toModelSpec } from "../provider-models/bundled-references";
 import type { Model } from "../types";
+import { resolveCatalogPolicy } from "./catalog-policy";
 import { resolveCatalogAxes } from "./resolve";
 
 const imageBudgetCache = new Map<string, number | null>();
@@ -7,12 +8,12 @@ const IMAGE_BUDGET_CACHE_MAX = 8192;
 
 /**
  * Maximum encoded inline-image bytes retained per request for a deployment with a documented body-size limit.
- * The axis is a host contract: a rerouted `baseUrl` (proxy, gateway) imposes its own limit, so the budget
- * applies only while the model targets its official endpoint.
+ * The axis is a host contract: a rerouted endpoint (proxy, gateway) imposes its own limit, so the budget applies
+ * only when `officialEndpoint` says the request reaches the model's official endpoint. `compat.officialEndpoint`
+ * classifies only the configured `baseUrl`; pi-ai's `reachesOfficialEndpoint` also follows request-time reroutes.
  */
-export function resolveInlineImageByteBudget(model: Model): number | undefined {
-	const compat = model.compat;
-	if (!compat || !("officialEndpoint" in compat) || !compat.officialEndpoint) return undefined;
+export function resolveInlineImageByteBudget(model: Model, officialEndpoint: boolean): number | undefined {
+	if (!officialEndpoint) return undefined;
 	const key = `${model.provider} ${model.id} ${model.api}`;
 	let budget = imageBudgetCache.get(key);
 	if (budget === undefined) {
@@ -23,3 +24,15 @@ export function resolveInlineImageByteBudget(model: Model): number | undefined {
 	}
 	return budget ?? undefined;
 }
+
+/**
+ * Most images one request to this deployment may carry, or `undefined` when no rule names the host. The
+ * `official-image-count-budget` axis replaces `image-count-budget` only when `officialEndpoint` says the request
+ * reaches the model's official endpoint (see {@link resolveInlineImageByteBudget}); a rerouted endpoint keeps the
+ * provider's generic budget.
+ */
+export function resolveImageCountBudget(model: Model, officialEndpoint: boolean): number | undefined {
+	const policy = resolveCatalogPolicy(model);
+	const value = (officialEndpoint && policy.officialImageCountBudget) || policy.imageCountBudget;
+	return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : undefined;
+}

package/src/compat/resolve.ts

@@ -17,6 +17,7 @@
  */
 import { Effort, THINKING_EFFORTS } from "../effort";
 import { hostMatchesUrl, modelMatchesHost } from "../hosts";
+import { withoutUnverifiedThinking } from "../model-thinking";
 import type {
 	Api,
 	CompatOf,
@@ -31,6 +32,7 @@ import type {
 	ResolvedOpenAISharedCompat,
 	ThinkingConfig,
 } from "../types";
+import { isOfficialCodexApiUrl } from "../wire/codex";
 import {
 	isAnthropicSigningProxyUrl,
 	isAzureAnthropicRoute,
@@ -796,7 +798,11 @@ function resolveOpenAIResponsesPolicy(
 		supportsObfuscationOptOut: isOpenAIUrl || provider === "openai",
 		storeResponses: false,
 		connectionBoundNativeHistory: false,
-		officialEndpoint: isOfficialOpenAIEndpoint(provider, baseUrl),
+		// The Codex backend is official at the URL its requests default to when `baseUrl` is unset, and at paths
+		// under it such as `/codex` and `/codex/responses`, which its requests resolve to the same endpoint.
+		officialEndpoint:
+			isOfficialOpenAIEndpoint(provider, baseUrl) ||
+			(api === "openai-codex-responses" && isOfficialCodexApiUrl(baseUrl)),
 		harmonyLeakMitigation: false,
 		rejectRootObjectUnion: false,
 		retryWithoutStrictOnGrammarError: false,
@@ -892,6 +898,7 @@ function resolveAnthropicPolicy(
 		supportsContextManagement: true,
 		supportsServerCompaction: false,
 		firstPartyProvider: false,
+		honorsClaudeCodeBetaKillSwitch: false,
 		supportsOutputEffort: true,
 		disableStrictTools: rejectsStrictTools,
 		// Present as a key so models.yml `compat` can set it; unset unless detected.
@@ -979,6 +986,10 @@ function resolveGooglePolicy(
 		claudeThinkingBetaHeader: false,
 		antigravityClaudeToolMode: false,
 		stripImageInput: false,
+		// Unset means "no image contract": images go out as sent. Keys exist so
+		// a KDL rule or a user `compat` block can declare one.
+		maxImageDimension: undefined,
+		maxImagePayloadBytes: undefined,
 	};
 	applyWireAxes(compat, axes.wire, spec.api);
 	applyCompatOverrides(compat, spec.compat);
@@ -1088,6 +1099,7 @@ interface RuleThinking {
 	supportsDisplay?: boolean;
 	prefixBinding?: boolean;
 	upgradeNeutral?: boolean;
+	unverified?: boolean;
 }
 
 function readRuleThinking(axes: ResolvedAxes): RuleThinking {
@@ -1108,6 +1120,7 @@ function readRuleThinking(axes: ResolvedAxes): RuleThinking {
 	if (typeof raw.supportsDisplay === "boolean") out.supportsDisplay = raw.supportsDisplay;
 	if (typeof raw.prefixBinding === "boolean") out.prefixBinding = raw.prefixBinding;
 	if (typeof raw.upgradeNeutral === "boolean") out.upgradeNeutral = raw.upgradeNeutral;
+	if (typeof raw.unverified === "boolean") out.unverified = raw.unverified;
 	return out;
 }
 
@@ -1155,8 +1168,16 @@ function resolveThinkingPolicy<TApi extends Api>(
 	// not re-expand it into an unadvertised ladder. Absent metadata is
 	// repaired only where KDL opts in with `thinking-upgrade-neutral`
 	// alongside a reviewed `thinking-efforts` ladder (the cascade upgrade for
-	// stale source capability data); otherwise the neutral default holds.
-	if (!spec.reasoning && (explicitThinking !== undefined || rule.upgradeNeutral !== true)) return undefined;
+	// stale source capability data). On deployments whose discovery reports no
+	// capabilities (`thinking-unverified`), an unclassified neutral spec — nothing
+	// says whether it reasons — gets an unverified ladder the user may opt into.
+	const unverified = !compatReasoning(spec, axes);
+	if (
+		unverified &&
+		(explicitThinking !== undefined || facts.identity.class !== "unknown" || rule.unverified !== true)
+	) {
+		return undefined;
+	}
 	if (
 		spec.provider === "cline-pass" &&
 		compat !== undefined &&
@@ -1180,9 +1201,14 @@ function resolveThinkingPolicy<TApi extends Api>(
 	if (config.efforts.length === 0) {
 		throw new Error(`Model ${spec.provider}/${spec.id} resolved to an empty thinking range`);
 	}
-	if (rule.defaultLevel !== undefined) config.defaultLevel = rule.defaultLevel;
 	const effortMap = mergeEffortMap(spec, rule.effortMap, compat, config.efforts);
 	if (effortMap !== undefined) config.effortMap = effortMap;
+	if (unverified) {
+		// Off-by-default opt-in: no default level, mandatory effort, or wire off-switch.
+		config.unverified = true;
+		return config;
+	}
+	if (rule.defaultLevel !== undefined) config.defaultLevel = rule.defaultLevel;
 	if (rule.effortBudgets !== undefined) config.effortBudgets = rule.effortBudgets;
 	const supportsDisplay = rule.supportsDisplay ?? defaultSupportsDisplay(spec, facts);
 	if (supportsDisplay) config.supportsDisplay = true;
@@ -1315,7 +1341,8 @@ export function resolveModelPolicy<TApi extends Api>(
 	spec: ModelSpec<TApi>,
 	route?: ResolveRoute,
 ): ResolvedModelPolicy<TApi>;
-export function resolveModelPolicy(spec: ModelSpec<Api>, route?: ResolveRoute): ResolvedModelPolicy<Api> {
+export function resolveModelPolicy(input: ModelSpec<Api>, route?: ResolveRoute): ResolvedModelPolicy<Api> {
+	const spec = withoutUnverifiedThinking(input);
 	const identity = resolveIdentity(spec);
 	const facts = new IdentityFacts(identity);
 	const target = buildResolveTarget(spec, identity);