@oh-my-pi/pi-catalog 18.2.1 → 18.2.2

package/src/discovery/devin.ts

@@ -76,6 +76,8 @@ function supportsDevinThinking(config: ClientModelConfig): boolean {
 const DEVIN_COST_LABEL_INPUT = "input";
 const DEVIN_COST_LABEL_CACHE_READ = "cached input";
 const DEVIN_COST_LABEL_OUTPUT = "output";
+/** Normalized label of the marker dimension separating composite rate cards. */
+const DEVIN_SIDEKICK_LABEL = "sidekick";
 
 /** Leading token count of a cost denominator ("1M tokens", "1K tokens"). */
 const DEVIN_COST_DENOMINATOR_PATTERN = /(\d+(?:\.\d+)?)\s*([kmb])?/i;
@@ -104,10 +106,20 @@ function devinCostDenominatorTokens(denominator: string): number {
  * an estimated rate, not a different unit, so both kinds are read. `cacheWrite`
  * has no Cascade dimension — Devin bills cache writes at the input rate — and
  * stays 0.
+ *
+ * Composite configs (`fusion`) flatten their own rate card plus every
+ * dispatched component's card into one `modelDimensions` list. A `Sidekick`
+ * marker dimension separates the composite's own card from the component
+ * cards, so reading stops there: a headline card may omit dimensions a
+ * component includes, which makes repeated-label detection unreliable.
  */
 function devinModelCost(config: ClientModelConfig): ModelCost {
 	const cost: ModelCost = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
 	for (const dimension of config.modelDimensions) {
+		const label = dimension.label.trim().toLowerCase();
+		if (label === DEVIN_SIDEKICK_LABEL) {
+			break;
+		}
 		if (dimension.kind !== ModelDimensionKind.COST && dimension.kind !== ModelDimensionKind.COST_FUZZY) {
 			continue;
 		}
@@ -115,7 +127,7 @@ function devinModelCost(config: ClientModelConfig): ModelCost {
 		// (0.1 decodes as 0.10000000149011612) at sub-cent precision.
 		const perMillion =
 			Math.round(((dimension.value * 1_000_000) / devinCostDenominatorTokens(dimension.denominator)) * 1e6) / 1e6;
-		switch (dimension.label.trim().toLowerCase()) {
+		switch (label) {
 			case DEVIN_COST_LABEL_INPUT:
 				cost.input = perMillion;
 				break;
@@ -379,14 +391,14 @@ function devinModelSpec(
 	config: ClientModelConfig,
 	uid: string,
 	baseUrl: string,
-	isRouter: boolean,
+	isAssignModelRouter: boolean,
 ): ModelSpec<"devin-agent"> {
 	const features = config.modelInfo?.modelFeatures;
 	const supportsImages =
 		(features !== undefined ? features.supportsImages : config.supportsImages) && !DEVIN_IMAGE_BLIND_UIDS.has(uid);
 	const input: ("text" | "image")[] = supportsImages ? ["text", "image"] : ["text"];
 	const compat: DevinCompat = {};
-	if (isRouter) compat.modelRouter = true;
+	if (isAssignModelRouter) compat.modelRouter = true;
 	if (features?.supportsParallelToolCalls === true) compat.supportsParallelToolCalls = true;
 	const maxOutputTokens = config.modelInfo?.maxOutputTokens ?? 0;
 	const spec: ModelSpec<"devin-agent"> = {
@@ -439,7 +451,13 @@ function normalizeDevinModels(
 		}
 		seen.add(uid);
 		const isRouter = displayOption === DisplayOption.MODEL_ROUTER || config.modelInfo?.isModelRouter === true;
-		specs.push(devinModelSpec(config, uid, baseUrl, isRouter));
+		// `isModelRouter` marks two different things: harness-less routing slots
+		// (`adaptive`, `subagent-default`) that `AssignModel` resolves into a
+		// concrete model, and harness-backed composites (`fusion`,
+		// `fusion-sidekick-*`) that are themselves valid chat uids. Only the
+		// former take the `AssignModel` path — sending a composite uid there 404s.
+		const isAssignModelRouter = isRouter && (config.modelInfo?.harnessUids.length ?? 0) === 0;
+		specs.push(devinModelSpec(config, uid, baseUrl, isAssignModelRouter));
 		// A router is a server-side dispatcher, not an effort tier: it stays a
 		// standalone model even when upstream files it under a family.
 		if (!isRouter) {

package/src/model-cache.ts

@@ -2,9 +2,8 @@
  * SQLite-backed model cache for atomic cross-process access.
  * Replaces per-provider JSON files with a single cache.db.
  */
-import { Database } from "bun:sqlite";
-import { renameSync } from "node:fs";
-import { getModelDbPath, isEnoent, isSqliteCorruptionError, logger, VERSION } from "@oh-my-pi/pi-utils";
+import type { Database } from "bun:sqlite";
+import { getModelDbPath, isSqliteCorruptionError, openSqliteDatabaseSync, VERSION } from "@oh-my-pi/pi-utils";
 import RULES from "./compat/rules.json" with { type: "json" };
 import type { Api, Model } from "./types";
 
@@ -135,14 +134,10 @@ function invalidateReadPath(resolvedPath: string): void {
 	}
 }
 
-function openDb(resolvedPath: string): Database {
-	const db = new Database(resolvedPath, { create: true });
-	// Install the busy handler BEFORE any lock-taking statement. See
-	// https://github.com/can1357/oh-my-pi/issues/2421.
-	db.run("PRAGMA busy_timeout = 3000");
-	// Schema invalidation can delete rows containing credentials written by old
-	// versions. Overwrite deleted SQLite cells instead of leaving their bytes in
-	// free pages where a raw scan of models.db can still recover them (#5780).
+function initializeDb(db: Database): void {
+	// The shared opener installs the busy handler before any lock-taking
+	// statement. Schema invalidation can delete rows containing credentials
+	// written by old versions, so scrub deleted cells (#5780).
 	db.run("PRAGMA secure_delete = ON");
 	db.run("PRAGMA journal_mode = WAL");
 	db.run(`
@@ -160,92 +155,53 @@ function openDb(resolvedPath: string): Database {
 		)
 	`);
 	migrateCacheSchema(db);
-	return db;
 }
 
-function getSharedDb(resolvedPath: string): Database {
-	if (sharedDb && sharedDbPath === resolvedPath) {
-		return sharedDb;
-	}
-	if (sharedDb) {
-		sharedDb.close();
-		sharedDb = null;
-		sharedDbPath = null;
-	}
-	const db = openDb(resolvedPath);
-	sharedDb = db;
-	sharedDbPath = resolvedPath;
-	return db;
+function closeSharedDb(): void {
+	if (!sharedDb) return;
+	sharedDb.close();
+	sharedDb = null;
+	sharedDbPath = null;
 }
 
 function runModelCacheDb<T>(resolvedPath: string, shared: boolean, useDb: (db: Database) => T): T {
-	if (shared) return useDb(getSharedDb(resolvedPath));
-	const db = openDb(resolvedPath);
-	try {
-		return useDb(db);
-	} finally {
-		db.close();
-	}
-}
-
-// Paths already reported corrupt this process: the first unrecoverable failure
-// is logged at `error`, later heals at `debug`, so a dying disk cannot spam.
-const reportedCorruptPaths = new Set<string>();
-
-/**
- * Move a physically corrupt `models.db` (plus its `-wal`/`-shm` sidecars) aside
- * so {@link openDb} can recreate a fresh cache at the original path. Renames are
- * best-effort: a vanished sidecar (already healed by a peer process) is fine,
- * and any other rename failure is left for {@link openDb} to surface.
- */
-function quarantineCorruptModelCache(resolvedPath: string): void {
-	const stamp = Date.now();
-	for (const suffix of ["", "-wal", "-shm"]) {
+	if (shared && sharedDb && sharedDbPath !== resolvedPath) closeSharedDb();
+	if (shared && sharedDb) {
 		try {
-			renameSync(`${resolvedPath}${suffix}`, `${resolvedPath}.corrupt-${stamp}${suffix}`);
-		} catch (err) {
-			if (!isEnoent(err)) {
-				logger.debug("model cache: could not quarantine corrupt file", { path: `${resolvedPath}${suffix}` });
-			}
+			return useDb(sharedDb);
+		} catch (error) {
+			if (!isSqliteCorruptionError(error)) throw error;
+			// The opener owns recovery for new handles. Drop this stale handle
+			// first so its WAL cannot remain attached to the replacement.
+			closeSharedDb();
+			invalidateReadPath(resolvedPath);
+			return runModelCacheDb(resolvedPath, shared, useDb);
 		}
 	}
-}
 
-/**
- * Recover from unrecoverable `models.db` corruption: drop the cached handle,
- * quarantine the broken files, and let the next open recreate the cache. A
- * corrupt cache would otherwise be re-queried on every read/write forever,
- * permanently masking a successful live catalog (issue #8867). Only
- * {@link isSqliteCorruptionError} codes reach here; BUSY/permission errors keep
- * their existing best-effort paths.
- */
-function healCorruptModelCache(resolvedPath: string, shared: boolean, err: unknown): void {
-	if (shared && sharedDb) {
-		sharedDb.close();
-		sharedDb = null;
-		sharedDbPath = null;
-	}
-	invalidateReadPath(resolvedPath);
-	quarantineCorruptModelCache(resolvedPath);
-	const code = err && typeof err === "object" && "code" in err ? err.code : undefined;
-	if (reportedCorruptPaths.has(resolvedPath)) {
-		logger.debug("model cache: re-healed corrupt database", { path: resolvedPath, code });
-	} else {
-		reportedCorruptPaths.add(resolvedPath);
-		logger.error("model cache corrupt; quarantined and recreated a fresh cache", { path: resolvedPath, code });
-	}
+	return openSqliteDatabaseSync(
+		resolvedPath,
+		db => {
+			initializeDb(db);
+			const result = useDb(db);
+			if (shared) {
+				sharedDb = db;
+				sharedDbPath = resolvedPath;
+			} else {
+				db.close();
+			}
+			return result;
+		},
+		{
+			recoverCorruption: true,
+			onCorruptionPreserved: () => invalidateReadPath(resolvedPath),
+		},
+	);
 }
 
 function withModelCacheDb<T>(dbPath: string | undefined, useDb: (db: Database) => T): T {
 	const resolvedPath = dbPath ?? getModelDbPath();
-	const shared = dbPath === undefined;
-	try {
-		return runModelCacheDb(resolvedPath, shared, useDb);
-	} catch (err) {
-		if (!isSqliteCorruptionError(err)) throw err;
-		healCorruptModelCache(resolvedPath, shared, err);
-		return runModelCacheDb(resolvedPath, shared, useDb);
-	}
+	return runModelCacheDb(resolvedPath, dbPath === undefined, useDb);
 }
 
 function migrateCacheSchema(db: Database): void {

package/src/provider-models/openai-compat.ts

@@ -12,7 +12,7 @@ import {
 	pricingPeerFor,
 } from "../compat/behavior";
 import { xaiResponsesReasoningEffortMap } from "../compat/openai";
-import { resolveModelPolicy } from "../compat/resolve";
+import { hasModelScopedEffortLadder, resolveModelPolicy } from "../compat/resolve";
 import { compareRevision, parseRevision } from "../compat/revision";
 import { seedModels } from "../compat/providers";
 import { billingVariantPlain, classifyModel, discoveryVocabulary } from "../compat/taxonomy";
@@ -241,6 +241,192 @@ async function fetchCatalogPayload(
 	return payload;
 }
 
+/**
+ * The wire effort tiers the catalog publishes for a model, in canonical order.
+ * Undefined when the row has no effort-addressed thinking, or names no tier
+ * omp knows.
+ */
+function publishedEffortLadder(model: ModelsDevModel): Effort[] | undefined {
+	const values = model.reasoning_options?.find(option => option?.type === "effort")?.values;
+	if (!Array.isArray(values)) return undefined;
+	const ladder = THINKING_EFFORTS.filter(effort => values.includes(effort));
+	return ladder.length > 0 ? ladder : undefined;
+}
+
+/**
+ * Published ladders, addressable both by the host that published them and by
+ * bare id.
+ *
+ * `byHost` (keyed `provider\0id`) is authoritative: a ladder is only valid for
+ * the deployment that published it, so the endpoint's own catalog identity is
+ * consulted first. `byId` answers when the host is unknown — a gateway id with
+ * no catalog provider of its own — and only while every host publishing that
+ * id agrees that it takes an effort dial and on which tiers; an id whose hosts
+ * disagree, or that any host publishes with no dial at all, is dropped from
+ * it, so the ladder stays unknown instead of borrowing an arbitrary host's.
+ *
+ * `withoutLadder` carries the same `provider\0id` key for a row the catalog
+ * does publish but with no effort dial on it. The host serving an id outranks
+ * every other host on the question of what that deployment accepts, so its
+ * silence blocks the bare-id fallback for that id rather than letting a
+ * foreign ladder answer in its place. When the serving host is unknown that
+ * per-host veto cannot fire, which is why a dialless row also disqualifies the
+ * bare id outright.
+ */
+interface PublishedEffortLadders {
+	byHost: ReadonlyMap<string, readonly Effort[]>;
+	byId: ReadonlyMap<string, readonly Effort[]>;
+	withoutLadder: ReadonlySet<string>;
+}
+
+const EMPTY_PUBLISHED_EFFORT_LADDERS: PublishedEffortLadders = {
+	byHost: new Map(),
+	byId: new Map(),
+	withoutLadder: new Set(),
+};
+
+function indexPublishedEffortLadders(payload: unknown): PublishedEffortLadders {
+	const byHost = new Map<string, readonly Effort[]>();
+	const byId = new Map<string, readonly Effort[]>();
+	const withoutLadder = new Set<string>();
+	const index: PublishedEffortLadders = { byHost, byId, withoutLadder };
+	const unshareable = new Set<string>();
+	if (!isRecord(payload)) return index;
+	for (const [providerKey, provider] of Object.entries(payload)) {
+		if (!isRecord(provider) || !isRecord(provider.models)) continue;
+		for (const [modelId, rawModel] of Object.entries(provider.models)) {
+			if (!isRecord(rawModel)) continue;
+			const key = `${providerKey}\u0000${modelId}`;
+			const ladder = publishedEffortLadder(rawModel as ModelsDevModel);
+			if (!ladder) {
+				withoutLadder.add(key);
+				// Some deployment of this id rejects an effort dial; without
+				// knowing which host serves a bare id, none may claim one.
+				byId.delete(modelId);
+				unshareable.add(modelId);
+				continue;
+			}
+			byHost.set(key, ladder);
+			if (unshareable.has(modelId)) continue;
+			const shared = byId.get(modelId);
+			if (shared === undefined) {
+				byId.set(modelId, ladder);
+			} else if (shared.length !== ladder.length || shared.some((effort, index) => effort !== ladder[index])) {
+				byId.delete(modelId);
+				unshareable.add(modelId);
+			}
+		}
+	}
+	return index;
+}
+
+/**
+ * The index is tagged onto the catalog payload it was built from, so each
+ * catalog version is indexed once. {@link fetchWellKnownModels} already scopes
+ * payloads by fetch context, coalesces concurrent requests, answers a `304`
+ * with the same object, and hands back the last good payload when a refresh
+ * fails, so the tag inherits all of that lifetime behaviour for free.
+ */
+const kPublishedEffortLadders = Symbol("catalog.publishedEffortLadders");
+
+interface IndexedCatalogPayload {
+	[kPublishedEffortLadders]?: PublishedEffortLadders;
+}
+
+async function loadPublishedEffortLadders(fetchImpl?: FetchImpl): Promise<PublishedEffortLadders> {
+	const payload = await fetchWellKnownModels(fetchImpl);
+	if (!isRecord(payload)) return EMPTY_PUBLISHED_EFFORT_LADDERS;
+	const tagged = payload as IndexedCatalogPayload;
+	return (tagged[kPublishedEffortLadders] ??= indexPublishedEffortLadders(payload));
+}
+
+/**
+ * The catalog provider keys this endpoint publishes under. A provider whose
+ * catalog identity differs from its omp id (`moonshot` → `moonshotai`) is
+ * resolved through its descriptors; the omp id stays as a candidate for
+ * providers the descriptors do not cover.
+ */
+function catalogProviderKeys(providerId: string): readonly string[] {
+	const keys = new Set<string>();
+	for (const descriptor of MODELS_DEV_DESCRIPTORS_BY_PROVIDER[providerId] ?? []) keys.add(descriptor.modelsDevKey);
+	keys.add(providerId);
+	return [...keys];
+}
+
+/**
+ * The ladder published for a discovered id, preferring the host that serves it.
+ *
+ * Gateway prefixes are peeled (`deepseek/deepseek-v4` → `deepseek-v4`), and
+ * each peeled segment joins the host candidates ahead of the endpoint's own
+ * keys: on an aggregator the prefix names the real upstream. All host-scoped
+ * candidates are checked before accepting any shared-id fallback.
+ * A bare id is only accepted from {@link PublishedEffortLadders.byId}, which
+ * holds it only while every publishing host agrees that it takes an effort
+ * dial and on which tiers. A host serving the id that published it without a
+ * dial is this deployment's own answer and outranks any other host's ladder,
+ * so it vetoes the candidate here; a dialless host omp cannot recognize as the
+ * server already kept the id out of `byId` when the index was built.
+ */
+function lookupPublishedEffortLadder(
+	ladders: PublishedEffortLadders,
+	providerKeys: readonly string[],
+	modelId: string,
+): readonly Effort[] | undefined {
+	const hosts = [...providerKeys];
+	let shared: readonly Effort[] | undefined;
+	for (let candidate = modelId; ;) {
+		let dialless = false;
+		for (const host of hosts) {
+			const key = `${host}\u0000${candidate}`;
+			const scoped = ladders.byHost.get(key);
+			if (scoped) return scoped;
+			dialless ||= ladders.withoutLadder.has(key);
+		}
+		if (dialless) return undefined;
+		shared ??= ladders.byId.get(candidate);
+		const slash = candidate.indexOf("/");
+		if (slash < 0) return shared;
+		hosts.unshift(candidate.slice(0, slash));
+		candidate = candidate.slice(slash + 1);
+	}
+}
+
+/**
+ * Fill the effort ladder of discovered reasoning models whose tiers omp would
+ * otherwise guess from the neutral wire or provider-wide unknown-class default.
+ *
+ * Source precedence is unchanged: a provider that reports its own thinking
+ * surface, and any model whose ladder reviewed rules declare, are left exactly
+ * as they are. Only the guess is corrected, and only for ids the catalog
+ * actually publishes for this endpoint (or publishes unambiguously), so no
+ * request is made when every discovered model is already covered.
+ */
+async function applyPublishedEffortLadders<TApi extends Api>(
+	models: readonly ModelSpec<TApi>[] | null,
+	providerId: string,
+	fetchImpl?: FetchImpl,
+): Promise<readonly ModelSpec<TApi>[] | null> {
+	if (models === null) return null;
+	const guessed = new Set(
+		models
+			.filter(
+				model => model.reasoning === true && model.thinking === undefined && !hasModelScopedEffortLadder(model),
+			)
+			.map(model => model.id),
+	);
+	if (guessed.size === 0) return models;
+	// An unreachable catalog with no prior payload is not a discovery failure:
+	// the endpoint's own listing stands and the guess stays in place.
+	const ladders = await loadPublishedEffortLadders(fetchImpl).catch(() => EMPTY_PUBLISHED_EFFORT_LADDERS);
+	if (ladders.byHost.size === 0) return models;
+	const providerKeys = catalogProviderKeys(providerId);
+	return models.map(model => {
+		if (!guessed.has(model.id)) return model;
+		const efforts = lookupPublishedEffortLadder(ladders, providerKeys, model.id);
+		return efforts ? { ...model, thinking: { mode: "effort" as const, efforts } } : model;
+	});
+}
+
 function mapAnthropicModelsDev(payload: unknown, baseUrl: string): ModelSpec<"anthropic-messages">[] {
 	if (!isRecord(payload)) {
 		return [];
@@ -609,19 +795,23 @@ function createOpenAICompatibleModelManagerOptions<TApi extends Api>(
 			dropCachedModelIdsOnStaticMismatch: options.dropCachedModelIdsOnStaticMismatch,
 		}),
 		...((!options.requireApiKey || apiKey) && {
-			fetchDynamicModels: () =>
-				fetchOpenAICompatibleModels({
-					api: options.api,
-					provider: options.providerId,
-					baseUrl,
-					apiKey,
-					...(options.headers && { headers: resolveSimpleProviderHeaders(options.headers) }),
-					...(filterModel && {
-						filterModel: (entry, model) => filterModel(entry, model, references),
+			fetchDynamicModels: async () =>
+				applyPublishedEffortLadders(
+					await fetchOpenAICompatibleModels({
+						api: options.api,
+						provider: options.providerId,
+						baseUrl,
+						apiKey,
+						...(options.headers && { headers: resolveSimpleProviderHeaders(options.headers) }),
+						...(filterModel && {
+							filterModel: (entry, model) => filterModel(entry, model, references),
+						}),
+						mapModel: (entry, defaults) => options.mapModel(entry, defaults, references.get(defaults.id)),
+						fetch: options.config?.fetch,
 					}),
-					mapModel: (entry, defaults) => options.mapModel(entry, defaults, references.get(defaults.id)),
-					fetch: options.config?.fetch,
-				}),
+					options.providerId,
+					options.config?.fetch,
+				),
 		}),
 	};
 }

package/src/types.ts

@@ -1196,6 +1196,16 @@ export interface Model<TApi extends Api = Api> {
 	gitlabDuoWorkflowRootNamespaceId?: string;
 	/** Cursor `max_mode` request flag returned by `GetUsableModels` for premium models that require max mode. */
 	cursorMaxMode?: boolean;
+	/**
+	 * Per-wire-id `max_mode` markers for the members a collapsed Cursor row
+	 * routes to, recorded by `collapseVariants` from live `GetUsableModels`
+	 * rows. {@link cursorMaxMode} on a collapsed row is an OR across members,
+	 * so it cannot tell a `-low` route that needs no max mode from an Opus
+	 * `-fast` route that does; transports look the routed wire id up here
+	 * first. Absent on raw rows (their own `cursorMaxMode` already describes
+	 * their single wire id) and on bundled snapshots that predate discovery.
+	 */
+	cursorMaxModeRoutes?: Readonly<Record<string, boolean>>;
 	cost: ModelCost;
 	/** Premium Copilot requests charged per user-initiated request (defaults to 1). */
 	premiumMultiplier?: number;