@oh-my-pi/pi-catalog 18.2.3 → 18.2.5

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+## [18.2.5] - 2026-09-17
+
+### Added
+
+- Added the `stencil` authentication provider for `omp stream`, supporting OAuth code + PKCE sign-in with `auth.stencil.so`, configurable via `STENCIL_API_KEY`, `STENCIL_AUTH_URL`, and `STENCIL_BASE_URL`. This is an authentication-only provider, not a model provider; OAuth-code login configuration also supports `base-url` and `auth-url` nodes with `{base}` and `{auth}` URL placeholders.
+
+### Fixed
+
+- Corrected Yolo-Auto metadata for Qwen Flash: `qwen3.8-flash` and the paid `yolo` route now report the documented 256K context window and use the Qwen chat-template reasoning dialect, with `qwen3.8-flash` as the provider default.
+
+## [18.2.4] - 2026-09-17
+
+### Added
+
+- Added `typesafe` authentication for TypeSafe System One judgments via the `TYPESAFE_API_KEY` configuration and API-key validation against the TypeSafe models endpoint.
+
 ## [18.2.3] - 2026-09-17
 
 ### Added

package/dist/types/compat/auth-ids.d.ts

@@ -1,4 +1,4 @@
 /** Every provider with an `auth/<id>.kdl` policy. */
-export type AuthProviderId = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "synthetic" | "tavily" | "together" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";
+export type AuthProviderId = "abliteration" | "aiand" | "aimlapi" | "alibaba-coding-plan" | "alibaba-token-plan" | "amazon-bedrock" | "anthropic" | "azure" | "baseten" | "bedrock-mantle" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google" | "google-antigravity" | "google-gemini-cli" | "google-vertex" | "groq" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "meta" | "minimax" | "minimax-code" | "minimax-code-cn" | "mistral" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "stencil" | "synthetic" | "tavily" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";
 /** Providers whose policy declares a `login` flow (the `/login` roster). */
-export type LoginProviderId = "abliteration" | "aiand" | "alibaba-coding-plan" | "alibaba-token-plan" | "anthropic" | "baseten" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google-antigravity" | "google-gemini-cli" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "meta" | "minimax-code" | "minimax-code-cn" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "synthetic" | "tavily" | "together" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";
+export type LoginProviderId = "abliteration" | "aiand" | "alibaba-coding-plan" | "alibaba-token-plan" | "anthropic" | "baseten" | "cerebras" | "charm-hyper" | "cline-pass" | "cloudflare-ai-gateway" | "commandcode" | "coreweave" | "cursor" | "deepinfra" | "deepseek" | "devin" | "exa" | "firepass" | "fireworks" | "github-copilot" | "gitlab-duo" | "gitlab-duo-agent" | "gmi-cloud" | "google-antigravity" | "google-gemini-cli" | "huggingface" | "kagi" | "kilo" | "kimi-code" | "litellm" | "llama.cpp" | "lm-studio" | "meta" | "minimax-code" | "minimax-code-cn" | "moonshot" | "muse-code" | "nanogpt" | "novita" | "nvidia" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "openrouter" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "sakana" | "siliconflow" | "siliconflow-cn" | "stencil" | "synthetic" | "tavily" | "together" | "typesafe" | "umans" | "venice" | "vercel-ai-gateway" | "vllm" | "wafer-serverless" | "xai" | "xai-oauth" | "xiaomi" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-sgp" | "yolo-auto" | "zai" | "zai-coding-plan" | "zenmux" | "zhipu-coding-plan";

package/dist/types/compat/cascade.d.ts

@@ -12,10 +12,6 @@ export declare class AmbiguousOverlapError extends Error {
     readonly second: string;
     constructor(provider: string, model: string, axis: string, first: string, second: string);
 }
-/**
- * Anchored `*`-wildcard match; both sides must be pre-lowercased. `*` spans
- * any substring; non-wildcard text stays anchored in order.
- */
 export declare function globMatch(pattern: string, value: string): boolean;
 /**
  * Resolve wire, thinking, and catalog assignments for one structured target.

package/dist/types/compat/taxonomy.d.ts

@@ -52,13 +52,6 @@ export declare function collapseVariantId(provider: string, model: string): Coll
  * `non-thinking` and `no-thinking` are not variants.
  */
 export declare function stripThinkingVariantSuffix(model: string): string | undefined;
-/**
- * Classifies a model into its structured identity: reviewed override first,
- * then suffix collapse, then class/family/revision ranks over the logical id.
- *
- * @throws AmbiguousIdentityError on equal-rank cross-class or cross-family
- * matches unless `opts.lenient`.
- */
 export declare function classifyModel(provider: string, modelId: string, opts?: ClassifyOptions): ModelIdentity;
 /**
  * Strips a declared billing-variant suffix (`-free`, `-contributor`) from a

package/dist/types/compat/types.d.ts

@@ -439,6 +439,10 @@ export interface CompiledOAuthCodeLogin {
     kind: "oauth-code";
     clientId?: CompiledAuthValue;
     clientSecret?: CompiledAuthValue;
+    /** `{base}` placeholder source (the provider's API origin). */
+    baseUrl?: CompiledAuthValue;
+    /** `{auth}` placeholder source for the authorize, token, and userinfo URLs when the issuer is a separate host. */
+    authUrl?: CompiledAuthValue;
     authorizeUrl: CompiledAuthValue;
     scopes: string[];
     scopeSeparator: string;

package/dist/types/model-tokenizer.d.ts

@@ -5,4 +5,4 @@ import type { ModelTokenizer } from "./types.js";
  * This is catalog policy, not a runtime caller heuristic: [`buildModel`](./build.ts)
  * materializes the result as `Model.tokenizer`; consumers read that property.
  */
-export declare function resolveModelTokenizer(modelId: string): ModelTokenizer | undefined;
+export declare function resolveModelTokenizer(modelId: string, provider?: string): ModelTokenizer | undefined;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-catalog",
-	"version": "18.2.3",
+	"version": "18.2.5",
 	"description": "Model catalog for omp: bundled model database, provider discovery descriptors, model identity, classification, and equivalence",
 	"homepage": "https://omp.sh",
 	"author": "Stencil Labs, Inc.",
@@ -35,12 +35,12 @@
 		"gen:proto": "bun scripts/generate-protocols.ts"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.2.3",
-		"@oh-my-pi/pi-utils": "18.2.3"
+		"@oh-my-pi/omptype": "18.2.5",
+		"@oh-my-pi/pi-utils": "18.2.5"
 	},
 	"devDependencies": {
 		"@bgotink/kdl": "0.4.0",
-		"@oh-my-pi/pi-ai": "18.2.3",
+		"@oh-my-pi/pi-ai": "18.2.5",
 		"@types/bun": "^1.3.14"
 	},
 	"engines": {

package/src/build.ts

@@ -290,7 +290,7 @@ export function buildModel<TApi extends Api>(spec: ModelSpec<TApi>): Model<TApi>
 		name: cleanModelName(spec.name),
 		identity: policy.identity,
 		requiresGlyphTokenization: policy.identity.class === "anthropic",
-		tokenizer: spec.tokenizer ?? resolveModelTokenizer(spec.requestModelId ?? spec.id),
+		tokenizer: spec.tokenizer ?? resolveModelTokenizer(spec.requestModelId ?? spec.id, spec.provider),
 		thinking: policy.thinking,
 		supportsComputerUse: supportsOpenAIGAComputerUse(spec, policy.identity, supportsComputerUseConfig),
 		supportsComputerUseConfig,

package/src/compat/auth-ids.ts

@@ -66,9 +66,11 @@ export type AuthProviderId =
 	| "sakana"
 	| "siliconflow"
 	| "siliconflow-cn"
+	| "stencil"
 	| "synthetic"
 	| "tavily"
 	| "together"
+	| "typesafe"
 	| "umans"
 	| "venice"
 	| "vercel-ai-gateway"
@@ -142,9 +144,11 @@ export type LoginProviderId =
 	| "sakana"
 	| "siliconflow"
 	| "siliconflow-cn"
+	| "stencil"
 	| "synthetic"
 	| "tavily"
 	| "together"
+	| "typesafe"
 	| "umans"
 	| "venice"
 	| "vercel-ai-gateway"

package/src/compat/cascade.ts

@@ -38,21 +38,36 @@ export class AmbiguousOverlapError extends Error {
 /**
  * Anchored `*`-wildcard match; both sides must be pre-lowercased. `*` spans
  * any substring; non-wildcard text stays anchored in order.
+ *
+ * Rule-owned patterns are static after index build, so the split is memoized
+ * per pattern string; derived/live patterns share the same bounded cache.
  */
-export function globMatch(pattern: string, value: string): boolean {
+const globSegmentsCache = new Map<string, readonly string[]>();
+const GLOB_SEGMENTS_MAX = 4096;
+
+function globSegments(pattern: string): readonly string[] {
+	const cached = globSegmentsCache.get(pattern);
+	if (cached !== undefined) return cached;
 	const segments = pattern.split("*");
+	if (globSegmentsCache.size >= GLOB_SEGMENTS_MAX) globSegmentsCache.clear();
+	globSegmentsCache.set(pattern, segments);
+	return segments;
+}
+
+export function globMatch(pattern: string, value: string): boolean {
+	const segments = globSegments(pattern);
 	if (segments.length === 1) return value === pattern;
-	const head = segments[0];
+	const head = segments[0] ?? "";
 	if (!value.startsWith(head)) return false;
 	let remainder = value.slice(head.length);
 	for (let i = 1; i < segments.length - 1; i++) {
-		const segment = segments[i];
+		const segment = segments[i] ?? "";
 		if (!segment) continue;
 		const found = remainder.indexOf(segment);
 		if (found === -1) return false;
 		remainder = remainder.slice(found + segment.length);
 	}
-	const last = segments[segments.length - 1];
+	const last = segments[segments.length - 1] ?? "";
 	return last === "" || remainder.endsWith(last);
 }
 

package/src/compat/rules/README.md

@@ -310,6 +310,8 @@ auth "anthropic" {
     env hook="anthropic-foundry"                 // or: env "ANTHROPIC_OAUTH_TOKEN" "ANTHROPIC_API_KEY"
     login "oauth-code" {
         client-id "OWQxYzI1…" encoding="base64"  // env="VAR" adds an override; child `env "A" "B"` an ordered list
+        base-url "https://api.example" { env "X_BASE_URL" }      // optional; `{base}` placeholder (API origin)
+        auth-url "https://auth.example" { env "X_AUTH_URL" }     // optional; `{auth}` placeholder for authorize/token/userinfo
         authorize-url "https://claude.ai/oauth/authorize"
         scopes "org:create_api_key" "user:profile"      // separator=" " default
         pkce #true

package/src/compat/rules/auth/_order.kdl

@@ -9,5 +9,5 @@ login-order "openai-codex" "anthropic" "zai" "zai-coding-plan" "kimi-code" "open
 	"cerebras" "baseten" "fireworks" "together" "nvidia" "novita" "deepinfra" "huggingface" "perplexity" \
 	"qianfan" "venice" "siliconflow" "siliconflow-cn" "synthetic" "nanogpt" "wafer-serverless" "coreweave" \
 	"vercel-ai-gateway" "cloudflare-ai-gateway" "litellm" "kilo" "zenmux" "opencode-zen" "opencode-go" \
-	"yolo-auto" "tavily" "kagi" "exa" "parallel" "ollama" "ollama-cloud" "lm-studio" "llama.cpp" "vllm" \
-	"gmi-cloud"
+	"yolo-auto" "tavily" "kagi" "exa" "parallel" "typesafe" "ollama" "ollama-cloud" "lm-studio" "llama.cpp" "vllm" \
+	"gmi-cloud" "stencil"

package/src/compat/rules/auth/stencil.kdl

@@ -0,0 +1,36 @@
+// stencil.so account. Not a model provider: the credential authorizes
+// omp-hosted Stencil services such as `omp stream` (live.omp.sh).
+//
+// Two hosts: the Stencil API at api.stencil.so (`{base}`, STENCIL_BASE_URL)
+// and the OIDC issuer at auth.stencil.so (`{auth}`, STENCIL_AUTH_URL) which
+// serves the PKCE-mandatory authorization codes under /oauth/* and mints
+// ES256 access tokens. The public client id `omp` is code-defined in the
+// issuer with a port-flexible 127.0.0.1 loopback callback.
+auth "stencil" {
+	name "Stencil (invite only)"
+	env "STENCIL_API_KEY"
+	login "oauth-code" {
+		client-id "omp" env="STENCIL_CLIENT_ID"
+		base-url "https://api.stencil.so" {
+			env "STENCIL_BASE_URL"
+		}
+		auth-url "https://auth.stencil.so" {
+			env "STENCIL_AUTH_URL"
+		}
+		authorize-url "{auth}/oauth/authorize"
+		scopes "openid" "profile" "email" "offline_access"
+		pkce #true
+		instructions "Sign in to your stencil.so account in the browser. If the browser cannot reach this machine, paste the final redirect URL when prompted."
+		callback port=54547 path="/callback" hostname="127.0.0.1" redirect-uri-env="STENCIL_REDIRECT_URI"
+		token url="{auth}/oauth/token" body="form"
+		credential {
+			access "access_token"
+			refresh "refresh_token"
+			expires "seconds" path="expires_in" skew-ms=300000
+		}
+		userinfo url="{auth}/oauth/userinfo" email="email" account-id="sub"
+	}
+	refresh {
+		token url="{auth}/oauth/token" body="form"
+	}
+}

package/src/compat/rules/auth/typesafe.kdl

@@ -0,0 +1,16 @@
+// TypeSafe (System One judgments) is not a chat-model provider: it answers
+// typed questions (choice / yes-no / score) over JSON state via
+// `POST /v1/systemone`, consumed through `@oh-my-pi/pi-ai`'s `TypeSafeJudge`.
+// No `providers/typesafe.kdl` entry exists on purpose — it has no chat models,
+// so it never appears in the model picker; the credential alone is what the
+// judgment resolver checks.
+auth "typesafe" {
+	name "TypeSafe"
+	env "TYPESAFE_API_KEY"
+	login "api-key" {
+		auth-url "https://console.typesafe.ai/"
+		instructions "Create or copy your API key from the TypeSafe console."
+		prompt "Paste your TypeSafe API key" placeholder="API key"
+		validate "models-endpoint" label="TypeSafe" url="https://api.typesafe.ai/v1/models" base-url-env="TYPESAFE_BASE_URL"
+	}
+}

package/src/compat/rules/providers/yolo-auto.kdl

@@ -1,17 +1,22 @@
 // Provider-wire compat for "yolo-auto"; wire constraints apply to every discovered model.
 
 provider "yolo-auto" {
-	default-model "deepseek-flash-v4"
+	default-model "qwen3.8-flash"
 	env "YOLO_AUTO_API_KEY"
 	dynamic-models-authoritative #true
 	discovery label="Yolo-Auto"
 
-	// Documented Yolo-Auto catalog (yolo-auto.com/docs, 2026-08) bundled so the
-	// provider is usable when generation and first boot have no live key. The
-	// flat-rate `/v1/models` response is authoritative once discovery runs.
-	// The compat block mirrors the provider's documented wire surface: the API
-	// speaks the generic chat template with `reasoning_effort` support and rejects
-	// the `developer` role and `store` param.
+	// Documented Yolo-Auto catalog (yolo-auto.com/models, yolo-auto.com/docs):
+	// `qwen3.8-flash` is the default model on Free and paid plans at a 256K
+	// (262144) context window, and the paid `yolo` route is initially backed by
+	// the same Flash deployment. The flat-rate `/v1/models` response carries
+	// bare ids with no limit fields and is authoritative once discovery runs.
+	// Without provider-local seeds the bare `qwen3.8-flash` slug resolves
+	// through the global reference index, which prefers the largest bundled
+	// window (1M) and misreports the deployment cap. The compat block mirrors
+	// the provider's documented wire surface: the API speaks the Qwen
+	// chat-template dialect with `reasoning_effort` support and rejects the
+	// `developer` role and `store` param.
 	seed api="openai-completions" base-url="https://yolo-auto.com/v1" bundle="fallback" {
 		model "deepseek-flash-v4" name="DeepSeek Flash V4" {
 			reasoning #true
@@ -26,6 +31,32 @@ provider "yolo-auto" {
 			supports-reasoning-effort #true
 			thinking-format "chat-template"
 		}
+		model "qwen3.8-flash" name="Qwen3.8 Flash" {
+			reasoning #true
+			input "text" "image"
+			cost input=0 output=0 cache-read=0 cache-write=0
+			limits context=262144 max-tokens=131072
+			thinking-mode "effort"
+			thinking-efforts "minimal" "low" "medium" "high"
+			supports-developer-role #false
+			supports-store #false
+			supports-reasoning-effort #true
+			thinking-format "qwen-chat-template"
+			template-reasoning-effort #true
+		}
+		model "yolo" name="Yolo" {
+			reasoning #true
+			input "text" "image"
+			cost input=0 output=0 cache-read=0 cache-write=0
+			limits context=262144 max-tokens=131072
+			thinking-mode "effort"
+			thinking-efforts "minimal" "low" "medium" "high"
+			supports-developer-role #false
+			supports-store #false
+			supports-reasoning-effort #true
+			thinking-format "qwen-chat-template"
+			template-reasoning-effort #true
+		}
 	}
 
 	supports-developer-role #false

package/src/compat/rules/taxonomy/qwen.kdl

@@ -12,6 +12,7 @@ class "qwen" {
 
     revision prefix="qwen"
 
+    override id="yolo-auto-yolo-flash-identity" provider="yolo-auto" model="yolo" class="qwen" revision="3.8" rationale="Yolo-Auto's paid yolo route is initially backed by the same Qwen3.8 Flash deployment as qwen3.8-flash; the opaque alias carries no lineage tokens" provenance="yolo-auto.com/models (2026-09)"
     override id="kilo-qwq-32b-family" provider="kilo" model="qwq-32b" logical="qwen/qwq-32b" class="qwen" rationale="The reviewed Kilo QwQ deployment belongs to the Qwen family despite its opaque product spelling" provenance="fixtures/llm-oracle/catalog/models.normalized.json"
     override id="nanogpt-eva-qwen-2-5-family" provider="nanogpt" model="EVA-Qwen2.5-32B-v0.2" logical="EVA-UNIT-01/EVA-Qwen2.5-32B-v0.2" class="qwen" rationale="The reviewed EVA deployment is a Qwen 2.5 derivative despite its opaque product namespace" provenance="fixtures/llm-oracle/catalog/models.normalized.json"
     override id="nanogpt-eva-qwen-2-5-72b-family" provider="nanogpt" model="EVA-Qwen2.5-72B-v0.2" logical="EVA-UNIT-01/EVA-Qwen2.5-72B-v0.2" class="qwen" rationale="The reviewed EVA 72B deployment is a Qwen 2.5 derivative despite its opaque product namespace" provenance="fixtures/llm-oracle/catalog/models.normalized.json"