@oh-my-pi/pi-catalog 18.2.10 → 18.3.0

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 ## [Unreleased]
 
+## [18.3.0] - 2026-09-24
+
+### Added
+
+- Added compaction support for the `claude-mythos-preview` model.
+- Added provider and authentication rule definitions for on-device Apple Foundation Models.
+- Added per-account discovery of Codex cyber access entitlements.
+- Added `org-scoped-identity` and `oauth-token-env` authentication rules for providers.
+
+## [18.2.11] - 2026-09-23
+
+### Added
+
+- Added built-in StepFun provider support for the step-5-preview model, including live model discovery.
+
+### Fixed
+
+- Fixed cost estimation for OpenAI Codex GPT-6 Sol and Luna models across standard and worker routes.
+- Fixed GitHub Copilot Grok 4.x models failing to make requests.
+
 ## [18.2.10] - 2026-09-22
 
 ### Changed

package/README.md

@@ -1,6 +1,6 @@
 # @oh-my-pi/pi-catalog
 
-Model catalog for [oh-my-pi](https://github.com/can1357/oh-my-pi): bundled model database, provider discovery, model identity, classification, and equivalence.
+Model catalog for [omp](https://github.com/can1357/oh-my-pi): bundled model database, provider discovery, model identity, classification, and equivalence.
 
 ## What's inside
 

package/THIRD-PARTY-NOTICES.txt

@@ -293,7 +293,7 @@ MIT License
 Copyright (c) 2026 Sander Land
   (measured tokenizer vocabulary data, reconstruction model, and reference
   implementation: https://github.com/sanderland/ctok)
-Copyright (c) 2026 Can Bölük and the Oh My Pi contributors
+Copyright (c) 2026 Can Bölük and the omp contributors
 Copyright (c) 2026 Stencil Labs, Inc.
   (Rust implementation and the compact binary vocabulary encoding in
   crates/pi-natives/src/utok/claude)

package/dist/types/compat/auth-ids.d.ts

@@ -1,4 +1,4 @@
 /** Every provider with an `auth/<id>.kdl` policy. */
-export type AuthProviderId = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "local" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "stencil" | "synthetic" | "tavily" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "web" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";
+export type AuthProviderId = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "apple" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "local" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "stencil" | "stepfun" | "synthetic" | "tavily" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "web" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";
 /** Providers whose policy declares a `login` flow (the `/login` roster). */
-export type LoginProviderId = "abliteration" | "aiand" | "alibaba-coding-plan" | "alibaba-token-plan" | "anthropic" | "baseten" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google-antigravity" | "google-gemini-cli" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "meta" | "minimax-code" | "minimax-code-cn" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "stencil" | "synthetic" | "tavily" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";
+export type LoginProviderId = "abliteration" | "aiand" | "alibaba-coding-plan" | "alibaba-token-plan" | "anthropic" | "baseten" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google-antigravity" | "google-gemini-cli" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "meta" | "minimax-code" | "minimax-code-cn" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "stencil" | "stepfun" | "synthetic" | "tavily" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";

package/dist/types/compat/provider-ids.d.ts

@@ -1,2 +1,2 @@
 /** Every chat-model provider with a catalog entry (`default-model` in its provider rules). */
-export type KnownProvider = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "huggingface" | "kilo" | "kimi-code" | "litellm" | "lm-studio" | "local" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "opencode-go" | "opencode-zen" | "openrouter" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "synthetic" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "web" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zenmux" | "zhipu-coding-plan";
+export type KnownProvider = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "apple" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "huggingface" | "kilo" | "kimi-code" | "litellm" | "lm-studio" | "local" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "opencode-go" | "opencode-zen" | "openrouter" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "singularityapi-dev" | "singularityapi-tech" | "stepfun" | "synthetic" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "web" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zenmux" | "zhipu-coding-plan";

package/dist/types/compat/types.d.ts

@@ -530,6 +530,10 @@ export interface CompiledAuthProvider {
         hook: string;
     };
     allowsMissingApiKey?: boolean;
+    /** Qualify credential and usage-report identity by org when an email may have multiple subscriptions. */
+    orgScopedIdentity?: boolean;
+    /** Environment variables carrying this provider's own OAuth bearer, excluding borrowed API-key aliases. */
+    oauthTokenEnv?: string[];
     /** APIs whose provider transport resolves credentials without a stored account. */
     nativeAuthApis?: string[];
     available?: boolean;

package/dist/types/discovery/cursor-proto.d.ts

@@ -1,5 +1,5 @@
 /**
- * Cursor agent protocol declarations used by Oh My Pi.
+ * Cursor agent protocol declarations used by omp.
  *
  * Each declaration retains only fields consumed by the client or its protocol tests.
  */

package/dist/types/discovery/devin-proto.d.ts

@@ -1,5 +1,5 @@
 /**
- * Devin protocol declarations used by Oh My Pi.
+ * Devin protocol declarations used by omp.
  *
  * Each declaration retains only fields consumed by the client or its protocol tests.
  */

package/dist/types/provider-models/openai-compat.d.ts

@@ -476,6 +476,31 @@ export interface YoloAutoModelManagerConfig {
  * code change.
  */
 export declare function yoloAutoModelManagerOptions(config?: YoloAutoModelManagerConfig): ModelManagerOptions<"openai-completions">;
+/**
+ * StepFun discovery configuration: the API key plus optional base-URL and
+ * fetch overrides. Consumed by {@link stepfunModelManagerOptions}, and exported
+ * for extensions and tests that construct the manager directly.
+ */
+export interface StepfunModelManagerConfig {
+    apiKey?: string;
+    baseUrl?: string;
+    fetch?: FetchImpl;
+}
+/**
+ * Whether a StepFun `/v1/models` id is a chat model omp can route. StepFun's
+ * roster interleaves its audio and image SKUs with the chat models; the
+ * exclusion policy itself lives in `runtime/behavior.kdl` (`exclude-models
+ * provider="stepfun"`), not here.
+ */
+export declare function isStepfunChatModelId(id: string): boolean;
+/**
+ * StepFun model manager: plain OpenAI-compatible chat completions at
+ * `api.stepfun.ai/v1`. A successful `/v1/models` snapshot is authoritative over
+ * the bundled seed rows (`providers/stepfun.kdl`), so a model StepFun retires
+ * leaves the picker instead of lingering as a dead seed row, while models added
+ * later become selectable without an omp release.
+ */
+export declare function stepfunModelManagerOptions(config?: StepfunModelManagerConfig): ModelManagerOptions<"openai-completions">;
 export interface QwenPortalModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;

package/dist/types/types.d.ts

@@ -2,7 +2,7 @@ import type { ModelIdentity } from "./compat/types.js";
 import type { Effort } from "./effort.js";
 export type { FetchImpl } from "@oh-my-pi/pi-utils";
 export type { KnownProvider } from "./provider-models/descriptors.js";
-export type KnownApi = "openai-completions" | "openai-responses" | "openrouter" | "openai-codex-responses" | "azure-openai-responses" | "anthropic-messages" | "bedrock-converse-stream" | "google-generative-ai" | "google-gemini-cli" | "google-vertex" | "ollama-chat" | "cursor-agent" | "gitlab-duo-agent" | "devin-agent";
+export type KnownApi = "openai-completions" | "openai-responses" | "openrouter" | "openai-codex-responses" | "azure-openai-responses" | "anthropic-messages" | "bedrock-converse-stream" | "google-generative-ai" | "google-gemini-cli" | "google-vertex" | "ollama-chat" | "cursor-agent" | "gitlab-duo-agent" | "devin-agent" | "apple-foundation-models";
 export type Api = KnownApi | (string & {});
 /** Catalog kinds used to isolate role-specific runners from session chat models. */
 export declare const MODEL_KINDS: readonly ["chat", "tiny", "image", "tts", "stt", "search", "judge", "embedding", "rerank", "video"];
@@ -441,17 +441,17 @@ export interface AnthropicCompat {
     /** Whether thinking requests may include `context_management` and its beta header. Default: true. */
     supportsContextManagement?: boolean;
     /**
-     * Whether the model lineage supports Anthropic server-side compaction
-     * (`compact-2026-01-12`: the `compact_20260112` edit and replayed
-     * `compaction` blocks). Rule-owned per model line; the beta covers the
-     * adaptive-thinking generation onward and rejects older lines. Default: false.
+     * Whether the model and host support Anthropic on-demand compaction
+     * (`compact-2026-09-04` requests and signed replay). Enabled on Opus 4.6+,
+     * Sonnet 4.6+, Fable/Mythos 5+ on supported hosts. Default: false.
      */
     supportsServerCompaction?: boolean;
     /**
      * Whether the model is served by the first-party Anthropic provider (its
      * default route is the official API). Rule-owned on the provider; the
      * compaction transport pairs it with a per-request effective-URL check
-     * because reroutes leave it stale-true. Default: false.
+     * because reroutes leave it stale-true. Vertex is selected by its provider
+     * contract instead. Default: false.
      */
     firstPartyProvider?: boolean;
     /**
@@ -953,6 +953,15 @@ export interface ModelCost extends TokenCost {
  * `"deepseek-v3"`; Kimi K2 through K3 share `"kimi-k2"`.
  */
 export type ModelTokenizer = "claude-v3" | "claude-v47" | "claude-v5" | "claude-v5-sonnet" | "qwen3" | "deepseek-v3" | "kimi-k2" | "glm5";
+/** One account's discovered entitlements on a model; see {@link Model.accountAccess}. */
+export interface ModelAccountAccess {
+    /**
+     * Codex `available_access_programs.cyber`: cyber access programs this account
+     * may request on the model (`standard`, `daybreak_blue`, `daybreak_red`).
+     * Absent when the backend reported no program metadata.
+     */
+    cyberPrograms?: readonly string[];
+}
 export interface Model<TApi extends Api = Api> {
     id: string;
     /** Role-specific runner capability; omitted for ordinary chat models. */
@@ -1046,6 +1055,15 @@ export interface Model<TApi extends Api = Api> {
      * their single wire id) and on bundled snapshots that predate discovery.
      */
     cursorMaxModeRoutes?: Readonly<Record<string, boolean>>;
+    /**
+     * Per-account availability recorded by multi-account discovery: provider
+     * account id (Codex: ChatGPT `chatgpt_account_id`) → that account's
+     * entitlements on this model. An account appears only when its own catalog
+     * lists the model, so credential selection can route account-gated models
+     * (e.g. `gpt-daybreak-blue-latest`) straight to eligible accounts. Absent on
+     * bundled/config rows and on single-account discovery.
+     */
+    accountAccess?: Readonly<Record<string, ModelAccountAccess>>;
     cost: ModelCost;
     /** Premium Copilot requests charged per user-initiated request (defaults to 1). */
     premiumMultiplier?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-catalog",
-	"version": "18.2.10",
+	"version": "18.3.0",
 	"description": "Model catalog for omp: bundled model database, provider discovery descriptors, model identity, classification, and equivalence",
 	"keywords": [
 		"ai",
@@ -14,7 +14,10 @@
 		"url": "https://github.com/can1357/oh-my-pi/issues"
 	},
 	"license": "MIT",
-	"author": "Stencil Labs, Inc.",
+	"author": {
+		"name": "Stencil Labs, Inc.",
+		"url": "https://stencil.so"
+	},
 	"repository": {
 		"type": "git",
 		"url": "git+https://github.com/can1357/oh-my-pi.git",
@@ -90,12 +93,12 @@
 		"gen:proto": "bun scripts/generate-protocols.ts"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.2.10",
-		"@oh-my-pi/pi-utils": "18.2.10"
+		"@oh-my-pi/omptype": "18.3.0",
+		"@oh-my-pi/pi-utils": "18.3.0"
 	},
 	"devDependencies": {
 		"@bgotink/kdl": "0.4.0",
-		"@oh-my-pi/pi-ai": "18.2.10",
+		"@oh-my-pi/pi-ai": "18.3.0",
 		"@types/bun": "^1.3.14"
 	},
 	"engines": {

package/src/compat/auth-ids.ts

@@ -9,6 +9,7 @@ export type AuthProviderId =
 	| "alibaba-token-plan"
 	| "amazon-bedrock"
 	| "anthropic"
+	| "apple"
 	| "azure"
 	| "baseten"
 	| "bedrock-mantle"
@@ -70,6 +71,7 @@ export type AuthProviderId =
 	| "singularityapi-dev"
 	| "singularityapi-tech"
 	| "stencil"
+	| "stepfun"
 	| "synthetic"
 	| "tavily"
 	| "together"
@@ -151,6 +153,7 @@ export type LoginProviderId =
 	| "singularityapi-dev"
 	| "singularityapi-tech"
 	| "stencil"
+	| "stepfun"
 	| "synthetic"
 	| "tavily"
 	| "together"

package/src/compat/provider-ids.ts

@@ -9,6 +9,7 @@ export type KnownProvider =
 	| "alibaba-token-plan"
 	| "amazon-bedrock"
 	| "anthropic"
+	| "apple"
 	| "azure"
 	| "baseten"
 	| "bedrock-mantle"
@@ -63,6 +64,7 @@ export type KnownProvider =
 	| "siliconflow-cn"
 	| "singularityapi-dev"
 	| "singularityapi-tech"
+	| "stepfun"
 	| "synthetic"
 	| "together"
 	| "typesafe"

package/src/compat/rules/README.md

@@ -346,12 +346,16 @@ auth "anthropic" {
     expiry "jwt-or-never"                        // session-JWT expiry policy
     result "api-key"                             // OAuth login persists only credentials.access as a plain API key
     allows-missing-api-key #true
+    org-scoped-identity #true                   // qualify credential/report identity by org (one email can have multiple subscriptions)
+    oauth-token-env "PROVIDER_OAUTH_TOKEN"      // dedicated OAuth bearer env vars, excluding borrowed API-key aliases in provider env
     native-auth-api "bedrock-converse-stream"     // provider transport resolves auth; scan plans pin this API without secrets
     available #false
     show-in-login-list #false
 }
 ```
 
+`org-scoped-identity #true` keeps credentials and usage reports for different organizations separate even when they share an email; absent or `#false` uses ordinary account identity. `oauth-token-env` takes one or more ordered, non-empty env names carrying this provider's own OAuth bearer. When present, availability ignores other provider-env aliases, and usage probes accept only stored OAuth credentials or the first set bearer from that list; absent providers keep the ordinary API-key env behavior.
+
 Login kinds:
 
 - `login "api-key" { auth-url "…"; instructions "…"; prompt "…" placeholder="…"; empty-fallback "…"; normalize "strip-bearer"; validate … }` — `validate "chat-completions" base-url= model= tolerate-model-denied= max-tokens-field= max-tokens=`, `validate "anthropic-messages" base-url= model=`, or `validate "models-endpoint" url= base-url-env= headers-hook=`; all accept `label=` (error-message label, defaults to `name`) and `optional=#true` (only auth failures reject).

package/src/compat/rules/auth/_order.kdl

@@ -5,7 +5,7 @@ login-order "openai-codex" "anthropic" "zai" "zai-coding-plan" "kimi-code" "open
 	"cursor" "devin" "google-antigravity" "google-gemini-cli" "openai-codex-device" "xai" "xai-oauth" \
 	"gitlab-duo" "gitlab-duo-agent" "alibaba-coding-plan" "alibaba-token-plan" "aiand" "abliteration" "zhipu-coding-plan" \
 	"umans" "qwen-portal" "sakana" "minimax-code" "minimax-code-cn" "xiaomi" "xiaomi-token-plan-sgp" \
-	"xiaomi-token-plan-ams" "xiaomi-token-plan-cn" "firepass" "cline-pass" "commandcode" "charm-hyper" "deepseek" "muse-code" "meta" "moonshot" \
+	"xiaomi-token-plan-ams" "xiaomi-token-plan-cn" "firepass" "cline-pass" "commandcode" "charm-hyper" "deepseek" "stepfun" "muse-code" "meta" "moonshot" \
 	"cerebras" "baseten" "fireworks" "together" "nvidia" "novita" "deepinfra" "huggingface" "perplexity" \
 	"qianfan" "venice" "siliconflow" "siliconflow-cn" "synthetic" "nanogpt" "wafer-serverless" "coreweave" \
 	"vercel-ai-gateway" "cloudflare-ai-gateway" "litellm" "kilo" "zenmux" "opencode-zen" "opencode-go" \

package/src/compat/rules/auth/anthropic.kdl

@@ -1,5 +1,6 @@
 auth "anthropic" {
 	name "Anthropic (Claude Pro/Max)"
+	org-scoped-identity #true
 	// Foundry mode optionally switches Anthropic auth to enterprise gateway credentials.
 	env hook="anthropic-foundry"
 	login "oauth-code" {

package/src/compat/rules/auth/apple.kdl

@@ -0,0 +1,4 @@
+auth "apple" {
+	name "Apple Foundation Models (on-device)"
+	allows-missing-api-key #true
+}

package/src/compat/rules/auth/openai-codex.kdl

@@ -1,5 +1,6 @@
 auth "openai-codex" {
 	name "ChatGPT Plus/Pro (Codex Subscription)"
+	org-scoped-identity #true
 	login "oauth-code" {
 		client-id "app_EMoamEEZ73f0CkXaXp7hrann"
 		authorize-url "https://auth.openai.com/oauth/authorize"

package/src/compat/rules/auth/stepfun.kdl

@@ -0,0 +1,13 @@
+auth "stepfun" {
+	name "StepFun"
+	login "api-key" {
+		auth-url "https://platform.stepfun.ai/interface-key"
+		instructions "Copy your API key from the StepFun Open Platform"
+		// StepFun keys are unprefixed opaque strings (no `sk-` prefix), so the
+		// placeholder must not teach a credential shape the console never issues.
+		prompt "Paste your StepFun API key" placeholder="..."
+		// A real auth rejection (401/403) is fatal; any other validation-endpoint
+		// failure is non-fatal — skip validation and trust the supplied key.
+		validate "chat-completions" label="StepFun" base-url="https://api.stepfun.ai/v1" model="step-5-preview" optional=#true
+	}
+}

package/src/compat/rules/auth/xai-oauth.kdl

@@ -1,6 +1,7 @@
 // Device authorization and token refresh adapted from NousResearch/hermes-agent (MIT).
 auth "xai-oauth" {
     name "xAI Grok OAuth (SuperGrok or X Premium+)"
+    oauth-token-env "XAI_OAUTH_TOKEN"
     login "device-code" {
         client-id "b1a00492-073a-47ea-816f-4c329264a828"
         scopes "openid" "profile" "email" "offline_access" "grok-cli:access" "api:access"

package/src/compat/rules/classes/anthropic.kdl

@@ -7,27 +7,32 @@ class "anthropic" {
 			thinking-prefix-binding #true
 		}
 	}
-	// Server-side compaction (compact-2026-01-12) is a lineage capability: the
-	// documented model list is the adaptive-thinking generation onward (Opus
-	// 4.6+, Sonnet 4.6+, Fable/Mythos 5+). Whether a host delivers the beta is
-	// decided at request time from the effective endpoint, not here.
-	family "fable" {
-		revision ">=5" {
-			supports-server-compaction #true
+	// On-demand compaction (compact-2026-09-04) is available on the Claude
+	// API and Vertex, not Amazon Bedrock or unverified gateway deployments.
+	// Foundry / Claude Platform on AWS are first-party Anthropic routes whose
+	// effective URLs are checked at request time.
+	on "anthropic" "google-vertex" {
+		family "fable" {
+			revision ">=5" {
+				supports-server-compaction #true
+			}
 		}
-	}
-	family "mythos" {
-		revision ">=5" {
-			supports-server-compaction #true
+		family "mythos" {
+			revision ">=5" {
+				supports-server-compaction #true
+			}
 		}
-	}
-	family "opus" {
-		revision ">=4.6" {
-			supports-server-compaction #true
+		family "opus" {
+			revision ">=4.6" {
+				supports-server-compaction #true
+			}
 		}
-	}
-	family "sonnet" {
-		revision ">=4.6" {
+		family "sonnet" {
+			revision ">=4.6" {
+				supports-server-compaction #true
+			}
+		}
+		models "claude-mythos-preview" {
 			supports-server-compaction #true
 		}
 	}

package/src/compat/rules/providers/apple.kdl

@@ -0,0 +1,8 @@
+// Apple Foundation Models: the on-device system language model (macOS 27+,
+// Apple silicon), bridged in-process by pi-natives. Models are discovered at
+// runtime from the model's availability; nothing is bundled.
+
+provider "apple" {
+	default-model "on-device"
+	allow-unauthenticated #true
+}

package/src/compat/rules/providers/openai-codex.kdl

@@ -80,6 +80,22 @@ provider "openai-codex" {
 		}
 		max-context-window 922000
 	}
+	models "gpt-6-sol" "gpt-6-sol-wm" {
+		cost-patch {
+			input 2.0
+			output 10.0
+			cache-read 0.2
+			cache-write 0
+		}
+	}
+	models "gpt-6-luna" "gpt-6-luna-wm" {
+		cost-patch {
+			input 0.1
+			output 0.5
+			cache-read 0.01
+			cache-write 0
+		}
+	}
 	class "openai" {
 		revision ">=5.3 <5.7" {
 			thinking-mode "effort"

package/src/compat/rules/providers/stepfun.kdl

@@ -0,0 +1,95 @@
+// Provider-wire compat for "stepfun" (StepFun Open Platform, api.stepfun.ai).
+
+provider "stepfun" {
+	default-model "step-5-preview"
+	env "STEPFUN_API_KEY"
+	// A successful `/v1/models` snapshot is the deployment truth, so it replaces
+	// the bundled seed rather than merging: StepFun retiring an id must remove
+	// it from the picker instead of leaving a dead seed row selectable.
+	dynamic-models-authoritative #true
+	// StepFun's own endpoint is the deployment truth: relay hosts serve the same
+	// ids with stray output ceilings and broader ladders, so the generator must
+	// not backfill limits or capabilities from same-id rows elsewhere.
+	skip-cross-provider-reference-fills #true
+	discovery label="StepFun"
+
+	// StepFun's OpenAI-compatible chat roster, bundled so the provider is
+	// selectable without a generation-time API key. The provider is not
+	// authoritative, so runtime `/v1/models` discovery merges additively; that
+	// endpoint also serves non-chat SKUs (StepAudio TTS/ASR, image models),
+	// which runtime/behavior.kdl excludes from the chat picker.
+	// Limits and per-model facts follow StepFun's published model cards, as
+	// catalogued on models.dev (`providers/stepfun-ai` + `models/stepfun`). The
+	// API accepts `max_tokens` far above any real cap (2M probes return 200), so
+	// a live probe cannot establish the ceiling, and the docs page's "64k max
+	// output" prose is not a limit the endpoint enforces either.
+	// Pricing is StepFun's published list price:
+	// https://platform.stepfun.ai/docs/en/guides/pricing/details
+	// (models.dev still carries the pre-June step-3.7-flash rates).
+	// A cache miss already covers writing the prefix into the cache ("the
+	// cache-miss input price includes writing new content to the cache"), so
+	// there is no separate cache-write tariff.
+	seed api="openai-completions" base-url="https://api.stepfun.ai/v1" bundle="always" {
+		// 1M context, input, and output. Input is text/image/video; video has no
+		// catalog representation, so the multimodal row declares text + image.
+		model "step-5-preview" name="Step 5 Preview" {
+			reasoning #true
+			input "text" "image"
+			cost input=1.0 output=2.7 cache-read=0.05 cache-write=0
+			limits context=1000000 max-tokens=1000000
+			thinking-mode "effort"
+			thinking-efforts "low" "medium" "high"
+		}
+		// Multimodal agent/coding SKU.
+		model "step-3.7-flash" name="Step 3.7 Flash" {
+			reasoning #true
+			input "text" "image"
+			cost input=0.2 output=1.15 cache-read=0.04 cache-write=0
+			limits context=256000 max-tokens=256000
+			thinking-mode "effort"
+			thinking-efforts "low" "medium" "high"
+		}
+		model "step-3.5-flash" name="Step 3.5 Flash" {
+			reasoning #true
+			input "text"
+			cost input=0.1 output=0.3 cache-read=0.02 cache-write=0
+			limits context=256000 max-tokens=256000
+			thinking-mode "effort"
+			thinking-efforts "low" "medium" "high"
+		}
+		model "step-3.5-flash-2603" name="Step 3.5 Flash 2603" {
+			reasoning #true
+			input "text"
+			cost input=0.1 output=0.3 cache-read=0.02 cache-write=0
+			limits context=256000 max-tokens=256000
+			thinking-mode "effort"
+			thinking-efforts "low" "medium" "high"
+		}
+	}
+
+	// StepFun's Chat Completions API documents `max_tokens` (default INF) and
+	// never the `max_completion_tokens` spelling the OpenAI baseline assumes.
+	max-tokens-field "max_tokens"
+
+	// StepFun's own API exposes the three-tier `reasoning_effort` ladder, while
+	// the shared stepfun class ladder (minimal…xhigh) documents relay hosts
+	// (OpenRouter, NanoGPT, NVIDIA, …). The provider scope therefore owns the
+	// exact set for models discovered at runtime, where no seed row declares
+	// thinking explicitly. Scoped by family, not revision: the stepfun taxonomy
+	// extracts no revision, and a family-scoped rule still cannot reach the
+	// class rule's `on` host list.
+	// Verified 2026-09-23 against
+	// `POST https://api.stepfun.ai/v1/chat/completions`: low/medium/high all
+	// return 200 on every model above, and `/v1/models` reports
+	// `reasoning_effort_support_list: ["low","medium","high"]` — the docs page
+	// still claims `step-3.5-flash-2603` accepts low/high only.
+	// Only reasoning models resolve a ladder (`resolveOverIndex` gates thinking
+	// on the target's reasoning fact), so a future non-reasoning StepFun SKU
+	// stays unaffected.
+	class "stepfun" {
+		family "step" {
+			thinking-mode "effort"
+			thinking-efforts "low" "medium" "high"
+		}
+	}
+}

package/src/compat/rules/runtime/behavior.kdl

@@ -138,6 +138,9 @@ behavior {
 	exclude-models provider="xiaomi-token-plan-ams" substring="-tts" substring="-asr"
 	exclude-models provider="xiaomi-token-plan-cn" substring="-tts" substring="-asr"
 	exclude-models provider="xiaomi-token-plan-sgp" substring="-tts" substring="-asr"
+	// Text-chat transports cannot serve StepFun's audio-only and image-editing
+	// SKUs, which its /v1/models roster interleaves with the chat models.
+	exclude-models provider="stepfun" prefix="stepaudio-" prefix="step-image-" prefix="step-tts-" prefix="step-2x-large"
 	// SuperGrok's roster interleaves media models the chat picker cannot
 	// serve; the dedicated tool surfaces route them instead.
 	exclude-models provider="xai-oauth" exact="grok-imagine-image-quality" exact="grok-imagine-image-2.0" \
@@ -169,11 +172,16 @@ behavior {
 		prefix="qwen-audio-" prefix="qwen-image-" prefix="text-embedding-" prefix="wan2.7-"
 	// Copilot's /models listing carries no transport field; route Claude ids
 	// to Anthropic Messages, the reviewed Responses roster to Responses, and
-	// everything else to chat completions.
+	// everything else to chat completions. Every Grok Copilot has served since
+	// 4.5 is Responses-only (chat completions answers 400
+	// unsupported_api_for_model), so the line is matched by prefix — including
+	// the synthesized `-1m` long-context siblings — instead of one exact id per
+	// revision (#7096, #8807, #12901). grok-code-fast-1 carries no 4.x revision
+	// and stays on chat completions.
 	api-routes provider="github-copilot" default="openai-completions" {
 		route "anthropic-messages" glob="claude-haiku-*" glob="claude-sonnet-*" glob="claude-opus-*" \
 			glob="claude-fable-*" glob="claude-mythos-*"
-		route "openai-responses" exact="grok-4.5" exact="grok-4.6" prefix="gpt-5" prefix="gpt-6" prefix="oswe" prefix="mai-"
+		route "openai-responses" prefix="grok-4." prefix="gpt-5" prefix="gpt-6" prefix="oswe" prefix="mai-"
 	}
 	// Command Code serves Claude models through its Anthropic-compatible
 	// Messages endpoint and every other model through chat completions.