mixdog 1.3.4 → 1.3.5

package/src/runtime/agent/orchestrator/providers/devin-auth.mjs

@@ -0,0 +1,409 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, unlinkSync } from 'node:fs';
+import { createServer } from 'node:http';
+import { join, resolve } from 'node:path';
+import { resolvePluginData } from '../../../shared/plugin-paths.mjs';
+import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
+import { boundProviderAuthPath } from '../../../shared/provider-auth-binding.mjs';
+import { modelProxyClientMode } from '../../../shared/model-proxy-mode.mjs';
+import { openLoginUrl } from './lib/open-login-url.mjs';
+import { OAUTH_PAGE_CONTENT_TYPE, oauthErrorHtml, oauthSuccessHtml } from './lib/oauth-page.mjs';
+import { createOAuthPkce, parseOAuthCodeInput } from './lib/oauth-pkce.mjs';
+import {
+  accountIdentityFields,
+  decodeJwtPayload,
+  expiryFromAccessToken,
+  normalizeAccountIdentity,
+} from './lib/oauth-token-utils.mjs';
+
+const AUTHORIZE_URL = 'https://app.devin.ai/auth/cli/continue';
+const TOKEN_URL = 'https://api.devin.ai/auth/cli/token';
+const CALLBACK_HOST = '127.0.0.1';
+const CALLBACK_PORT = 59653;
+const CALLBACK_PATH = '/callback';
+const REDIRECT_URI = `http://${CALLBACK_HOST}:${CALLBACK_PORT}${CALLBACK_PATH}`;
+const LOGIN_TIMEOUT_MS = 5 * 60_000;
+const EXCHANGE_TIMEOUT_MS = 30_000;
+// The login token is the only credential and cannot be refreshed. A token
+// without a readable `exp` claim is assumed to live for a year.
+const DEFAULT_TOKEN_LIFETIME_MS = 365 * 24 * 60 * 60_000;
+export const REAUTH_GUIDANCE = 'Open /providers in Mixdog to sign in again.';
+
+function reauthError(message) {
+  return Object.assign(new Error(message), { reauthRequired: true });
+}
+
+// Sign-in failures the desktop words in the user's language: the message leads
+// with `DEVIN_OAUTH_<CODE>:` and apps/desktop/src/renderer/oauth-failure-copy.ts
+// maps each code to its cause and remedy (like GMAIL_APP_PASSWORD_<CODE>).
+export const DEVIN_OAUTH_FAILURE_CODES = Object.freeze([
+  'DEVIN_OAUTH_CALLBACK_PORT_IN_USE',
+  'DEVIN_OAUTH_CALLBACK_SERVER_FAILED',
+  'DEVIN_OAUTH_LOGIN_TIMED_OUT',
+  'DEVIN_OAUTH_AUTHORIZATION_DENIED',
+  'DEVIN_OAUTH_STATE_MISMATCH',
+  'DEVIN_OAUTH_CODE_REQUIRED',
+  'DEVIN_OAUTH_TOKEN_EXCHANGE_FAILED',
+]);
+
+function loginFailure(code, text, props = {}) {
+  const failureCode = `DEVIN_OAUTH_${code}`;
+  return Object.assign(new Error(`${failureCode}: ${text}`), { failureCode }, props);
+}
+
+function credentialsPath() {
+  const bound = boundProviderAuthPath('devin-oauth');
+  if (bound) return resolve(bound);
+  const explicit = process.env.DEVIN_OAUTH_CREDENTIALS_PATH;
+  if (explicit) return resolve(explicit);
+  const dir = resolvePluginData();
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  return join(dir, 'devin-oauth.json');
+}
+
+export function devinTokenExpiry(token) {
+  return expiryFromAccessToken(token);
+}
+
+// The login token is a JWT whose `sub` is the Devin user; no request needed.
+export function devinTokenIdentity(token) {
+  const payload = decodeJwtPayload(token);
+  return normalizeAccountIdentity({ id: payload?.sub, email: payload?.email });
+}
+
+function loadStoredCredentials() {
+  if (modelProxyClientMode()) return null;
+  const path = credentialsPath();
+  if (!existsSync(path)) return null;
+  try {
+    const raw = JSON.parse(readFileSync(path, 'utf8'));
+    if (!raw?.access_token) return null;
+    return {
+      ...raw,
+      expires_at: Number(raw.expires_at) || devinTokenExpiry(raw.access_token),
+      identity: normalizeAccountIdentity(raw.identity) || devinTokenIdentity(raw.access_token),
+      source: 'Mixdog token store',
+    };
+  } catch {
+    return null;
+  }
+}
+
+function saveCredentials(tokens) {
+  writeJsonAtomicSync(credentialsPath(), tokens, {
+    lock: true,
+    fsyncDir: true,
+    mode: 0o600,
+    secret: true,
+  });
+}
+
+function tokenRecord(accessToken) {
+  const identity = devinTokenIdentity(accessToken);
+  return {
+    access_token: accessToken,
+    refresh_token: null,
+    expires_at: devinTokenExpiry(accessToken) || Date.now() + DEFAULT_TOKEN_LIFETIME_MS,
+    ...(identity ? { identity } : {}),
+  };
+}
+
+export function hasDevinOAuthCredentials() {
+  const tokens = loadStoredCredentials();
+  if (!tokens?.access_token) return false;
+  const expiresAt = Number(tokens.expires_at) || 0;
+  return expiresAt === 0 || expiresAt > Date.now();
+}
+
+export function describeDevinOAuthCredentials() {
+  const tokens = loadStoredCredentials();
+  if (!tokens?.access_token) {
+    return {
+      authenticated: false,
+      usable: false,
+      refreshable: false,
+      reauthRequired: false,
+      status: 'Not Set',
+      detail: 'Mixdog token store',
+    };
+  }
+  const expiresAt = Number(tokens.expires_at) || 0;
+  const expired = expiresAt > 0 && expiresAt <= Date.now();
+  return {
+    authenticated: !expired,
+    usable: !expired,
+    refreshable: false,
+    reauthRequired: expired,
+    status: expired ? 'Reauth Required' : 'Access Only',
+    detail: tokens.source || 'Devin OAuth',
+    expiresAt: expiresAt || null,
+    ...accountIdentityFields(tokens.identity),
+  };
+}
+
+export function forgetDevinOAuthCredentials() {
+  const path = credentialsPath();
+  if (!existsSync(path)) return { removed: false };
+  unlinkSync(path);
+  return { removed: true };
+}
+
+export function generateDevinOAuthParams() {
+  const { verifier, challenge } = createOAuthPkce();
+  const state = randomUUID();
+  const params = new URLSearchParams({
+    response_type: 'code',
+    redirect_uri: REDIRECT_URI,
+    code_challenge: challenge,
+    code_challenge_method: 'S256',
+    state,
+    prompt: 'select_account',
+  });
+  return { verifier, challenge, state, loginUrl: `${AUTHORIZE_URL}?${params}` };
+}
+
+export async function exchangeDevinCode(code, verifier, { fetchFn = fetch, signal } = {}) {
+  const timeout = AbortSignal.timeout(EXCHANGE_TIMEOUT_MS);
+  let response;
+  try {
+    response = await fetchFn(TOKEN_URL, {
+      method: 'POST',
+      headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+      body: JSON.stringify({ code, code_verifier: verifier }),
+      signal: signal ? AbortSignal.any([signal, timeout]) : timeout,
+      redirect: 'error',
+    });
+  } catch (error) {
+    // A cancelled login keeps its own abort; any other failure to get an
+    // answer (network, timeout) is a coded exchange failure. The cause is not
+    // quoted: only its kind is.
+    if (signal?.aborted) throw error;
+    throw loginFailure(
+      'TOKEN_EXCHANGE_FAILED',
+      error?.name === 'TimeoutError' ? 'Devin token exchange timed out' : 'Devin token exchange request failed'
+    );
+  }
+  // Response bodies may carry the login token itself, so none is ever quoted
+  // in an error: only the status is reported.
+  if (!response.ok) {
+    throw loginFailure('TOKEN_EXCHANGE_FAILED', `Devin token exchange failed (${response.status})`, {
+      status: response.status,
+      httpStatus: response.status,
+    });
+  }
+  const data = await response.json().catch(() => null);
+  if (typeof data?.token !== 'string' || !data.token) {
+    throw loginFailure('TOKEN_EXCHANGE_FAILED', 'Devin token exchange returned no token');
+  }
+  return tokenRecord(data.token);
+}
+
+// The callback port is fixed, so at most one login can own it. A newer login
+// in this process takes the port over from the one it supersedes.
+let activeLogin = null;
+
+function listenOnCallbackPort(server) {
+  return new Promise((resolveListen, rejectListen) => {
+    server.once('error', rejectListen);
+    server.listen(CALLBACK_PORT, CALLBACK_HOST, () => {
+      server.off('error', rejectListen);
+      resolveListen();
+    });
+  });
+}
+
+// Logins start one at a time, in call order: ownership of the port is decided
+// only once the previous start has fully settled, so overlapping calls
+// supersede each other instead of racing for the bind.
+let startQueue = Promise.resolve();
+
+export function beginDevinOAuthLogin(options) {
+  const started = startQueue.then(() => startDevinOAuthLogin(options));
+  startQueue = started.catch(() => {});
+  return started;
+}
+
+async function startDevinOAuthLogin({ openBrowser = true, timeoutMs = LOGIN_TIMEOUT_MS, fetchFn = fetch } = {}) {
+  activeLogin?.cancel();
+  const params = generateDevinOAuthParams();
+  const controller = new AbortController();
+  const server = createServer();
+  let timer = null;
+  let exchangePromise = null;
+  let settled = false;
+  let resolveLogin;
+  let rejectLogin;
+  const waitForCallback = new Promise((resolvePromise, rejectPromise) => {
+    resolveLogin = resolvePromise;
+    rejectLogin = rejectPromise;
+  });
+  // A caller may only ever cancel; that rejection must not go unhandled.
+  waitForCallback.catch(() => {});
+
+  const login = {
+    provider: 'devin-oauth',
+    url: params.loginUrl,
+    manualUrl: null,
+    waitForCallback,
+    // A remote client signs in on its own machine, where the redirect to this
+    // host's loopback listener cannot land: it pastes the final address (or
+    // code) back, and the state it carries must be this login's own.
+    completeCode: async (input) => {
+      const text = String(input || '').trim();
+      // An address carries its code and state as query parameters only: one
+      // without a code is not a bare code (the shared parser would take the
+      // whole address for one and spend it on the exchange).
+      const address = URL.canParse(text) ? new URL(text) : null;
+      const pasted = address
+        ? { code: address.searchParams.get('code') || '', state: address.searchParams.get('state') || '' }
+        : parseOAuthCodeInput(text, { allowHashState: true });
+      if (pasted.state && pasted.state !== params.state) throw loginFailure('STATE_MISMATCH', 'OAuth state mismatch');
+      if (!pasted.code) throw loginFailure('CODE_REQUIRED', 'Authorization code is required');
+      return await acceptCode(pasted.code);
+    },
+    cancel: () => finish(null, new Error('Devin OAuth cancelled')),
+  };
+
+  function finish(value, error = null) {
+    if (settled) return;
+    settled = true;
+    if (activeLogin === login) activeLogin = null;
+    // Work arriving after the login settled (or was cancelled) is rejected.
+    controller.abort();
+    clearTimeout(timer);
+    try {
+      server.close();
+      server.closeIdleConnections?.();
+    } catch {
+      /* already closed */
+    }
+    if (error) rejectLogin(error);
+    else resolveLogin(value);
+  }
+
+  // The authorization code is spent once: a duplicate callback joins the first
+  // exchange instead of failing the login.
+  const acceptCode = (code) => {
+    if (exchangePromise) return exchangePromise;
+    controller.signal.throwIfAborted();
+    // The browser deadline ends once a code arrives; the exchange has its own.
+    clearTimeout(timer);
+    exchangePromise = exchangeDevinCode(code, params.verifier, { fetchFn, signal: controller.signal }).then(
+      (tokens) => {
+        // A cancelled login never stores the account it was exchanging.
+        controller.signal.throwIfAborted();
+        saveCredentials(tokens);
+        return tokens;
+      }
+    );
+    exchangePromise.then(
+      (tokens) => finish(tokens),
+      (error) => finish(null, error instanceof Error ? error : new Error(String(error)))
+    );
+    return exchangePromise;
+  };
+
+  const reply = (res, status, html) => {
+    res.writeHead(status, { 'Content-Type': OAUTH_PAGE_CONTENT_TYPE, Connection: 'close' });
+    res.end(html);
+  };
+
+  const handleRequest = async (req, res) => {
+    const target = new URL(req.url || '/', REDIRECT_URI);
+    if (req.method !== 'GET' || target.pathname !== CALLBACK_PATH) {
+      res.writeHead(404);
+      res.end();
+      return;
+    }
+    // A request that is not this login's own is refused; the real callback
+    // may still arrive.
+    if (target.searchParams.get('state') !== params.state) {
+      reply(res, 400, oauthErrorHtml('The sign-in callback did not match this login.'));
+      return;
+    }
+    const authorizationError = target.searchParams.get('error');
+    if (authorizationError) {
+      // Only a plain OAuth error code is named; free text (error_description)
+      // may carry anything, secrets included, so it never reaches the message.
+      const code = /^[A-Za-z0-9_.-]{1,64}$/.test(authorizationError) ? ` (${authorizationError})` : '';
+      reply(res, 400, oauthErrorHtml('Devin did not authorize this sign-in.'));
+      // A late denial must not cancel an already accepted code.
+      if (!exchangePromise) {
+        finish(null, loginFailure('AUTHORIZATION_DENIED', `Authorization failed${code}`));
+      }
+      return;
+    }
+    const code = target.searchParams.get('code')?.trim();
+    if (!code) {
+      reply(res, 400, oauthErrorHtml('The sign-in callback carried no authorization code.'));
+      return;
+    }
+    try {
+      await acceptCode(code);
+      reply(res, 200, oauthSuccessHtml('Devin'));
+    } catch {
+      // The shared exchange reports its error through waitForCallback.
+      reply(res, 500, oauthErrorHtml('Devin could not complete the token exchange.'));
+    }
+  };
+
+  // Whatever a stray local client sends (a malformed target included) is
+  // answered here and never escapes the listener.
+  server.on('request', async (req, res) => {
+    try {
+      await handleRequest(req, res);
+    } catch {
+      if (res.headersSent) res.destroy();
+      else reply(res, 400, oauthErrorHtml('The sign-in callback was malformed.'));
+    }
+  });
+
+  try {
+    await listenOnCallbackPort(server);
+  } catch (error) {
+    const failure =
+      error?.code === 'EADDRINUSE'
+        ? loginFailure(
+            'CALLBACK_PORT_IN_USE',
+            `Callback port ${CALLBACK_HOST}:${CALLBACK_PORT} is already in use. Close the program using it (or another Devin sign-in) and try again.`,
+            { code: 'EADDRINUSE' }
+          )
+        : loginFailure(
+            'CALLBACK_SERVER_FAILED',
+            `Callback server failed on ${CALLBACK_HOST}:${CALLBACK_PORT}: ${error?.message || error}`
+          );
+    finish(null, failure);
+    throw failure;
+  }
+  // Once bound, a runtime fault on the listener ends the login.
+  server.on('error', (error) =>
+    finish(null, loginFailure('CALLBACK_SERVER_FAILED', `Callback server failed: ${error?.message || error}`))
+  );
+  timer = setTimeout(
+    () => finish(null, loginFailure('LOGIN_TIMED_OUT', `Browser authentication timed out after ${timeoutMs}ms`)),
+    timeoutMs
+  );
+  timer.unref?.();
+  activeLogin = login;
+
+  process.stderr.write(`\n[devin-oauth] Open the Devin sign-in page:\n${params.loginUrl}\n\n`);
+  if (openBrowser) await openLoginUrl('devin-oauth', params.loginUrl);
+  return login;
+}
+
+export async function loginDevinOAuth() {
+  const login = await beginDevinOAuthLogin();
+  return await login.waitForCallback;
+}
+
+// The login token cannot be refreshed: once it expires the user signs in again.
+export async function resolveDevinOAuthAccessToken() {
+  const tokens = loadStoredCredentials();
+  if (!tokens?.access_token) {
+    throw reauthError(`Devin OAuth is not connected. ${REAUTH_GUIDANCE}`);
+  }
+  if (tokens.expires_at > 0 && tokens.expires_at <= Date.now()) {
+    throw reauthError(`Devin login token expired and cannot be refreshed. ${REAUTH_GUIDANCE}`);
+  }
+  return tokens.access_token;
+}

package/src/runtime/agent/orchestrator/providers/devin-wire-families.mjs

@@ -0,0 +1,187 @@
+// Reviewed Devin model families: logical models the Cascade catalog serves as
+// one wire uid per effort tier. Each family lists its member uids in default
+// priority order, the uid each effort routes to ('off' = thinking disabled),
+// and its effort ladder. Families the server also declares through
+// `modelFamilyMetadata` are collapsed from that live metadata first; this
+// table then covers accounts and models that ship none.
+
+const SUFFIX_ROUTE = Object.freeze({
+  none: 'off',
+  minimal: 'minimal',
+  low: 'low',
+  medium: 'medium',
+  high: 'high',
+  xhigh: 'xhigh',
+  max: 'max',
+});
+
+// `${base}-${tier}${lane}` members for every tier, routed by their tier.
+function ladder(base, tiers, lane = '') {
+  const members = tiers.map((tier) => `${base}-${tier}${lane}`);
+  const routing = Object.fromEntries(tiers.map((tier, index) => [SUFFIX_ROUTE[tier], members[index]]));
+  return { members, routing };
+}
+
+// `${PREFIX}_${TIER}` enum-style members (e.g. MODEL_GPT_5_2_HIGH).
+function enumLadder(prefix, tiers) {
+  const members = tiers.map((tier) => `${prefix}_${tier.toUpperCase()}`);
+  const routing = Object.fromEntries(tiers.map((tier, index) => [SUFFIX_ROUTE[tier], members[index]]));
+  return { members, routing };
+}
+
+function family(id, name, { members, routing }, { efforts, requiresEffort = false, defaultLevel, defaultMember } = {}) {
+  return Object.freeze({
+    id,
+    name,
+    members,
+    routing,
+    ...(defaultMember ? { defaultMember } : {}),
+    thinking: {
+      mode: 'effort',
+      efforts,
+      ...(defaultLevel ? { defaultLevel } : {}),
+      ...(requiresEffort ? { requiresEffort: true } : {}),
+    },
+  });
+}
+
+const CLAUDE_TIERS = ['low', 'medium', 'high', 'xhigh', 'max'];
+const CLAUDE = { efforts: CLAUDE_TIERS, requiresEffort: true };
+const GPT_TIERS = ['none', 'low', 'medium', 'high', 'xhigh'];
+const GPT = { efforts: ['low', 'medium', 'high', 'xhigh'] };
+const GPT_REQUIRED = { efforts: ['low', 'medium', 'high', 'xhigh'], requiresEffort: true };
+const GPT_56_TIERS = ['none', 'low', 'medium', 'high', 'xhigh', 'max'];
+const GPT_56 = { efforts: ['low', 'medium', 'high', 'xhigh', 'max'] };
+const FLASH_TIERS = ['minimal', 'low', 'medium', 'high'];
+const FLASH = { efforts: FLASH_TIERS, requiresEffort: true };
+
+export const DEVIN_REVIEWED_FAMILIES = Object.freeze([
+  family('claude-opus-5', 'Claude Opus 5', ladder('claude-opus-5', CLAUDE_TIERS), CLAUDE),
+  family('claude-opus-5-fast', 'Claude Opus 5 Fast', ladder('claude-opus-5', CLAUDE_TIERS, '-fast'), CLAUDE),
+  family('claude-fable-5', 'Claude Fable 5', ladder('claude-5-fable', CLAUDE_TIERS), CLAUDE),
+  family('claude-sonnet-5', 'Claude Sonnet 5', ladder('claude-sonnet-5', CLAUDE_TIERS), CLAUDE),
+  family('claude-opus-4-7', 'Claude Opus 4.7', ladder('claude-opus-4-7', CLAUDE_TIERS), CLAUDE),
+  family('claude-opus-4-7-fast', 'Claude Opus 4.7 Fast', ladder('claude-opus-4-7', CLAUDE_TIERS, '-fast'), CLAUDE),
+  family('claude-opus-4-8', 'Claude Opus 4.8', ladder('claude-opus-4-8', CLAUDE_TIERS), CLAUDE),
+  family('claude-opus-4-8-fast', 'Claude Opus 4.8 Fast', ladder('claude-opus-4-8', CLAUDE_TIERS, '-fast'), CLAUDE),
+  family('gpt-5-2', 'GPT-5.2', enumLadder('MODEL_GPT_5_2', GPT_TIERS), GPT),
+  family('gpt-5-3-codex', 'GPT-5.3 Codex', ladder('gpt-5-3-codex', GPT_TIERS.slice(1)), GPT_REQUIRED),
+  family(
+    'gpt-5-3-codex-fast',
+    'GPT-5.3 Codex Fast',
+    ladder('gpt-5-3-codex', GPT_TIERS.slice(1), '-priority'),
+    GPT_REQUIRED
+  ),
+  family('gpt-5-4', 'GPT-5.4', ladder('gpt-5-4', GPT_TIERS), GPT),
+  family('gpt-5-4-fast', 'GPT-5.4 Fast', ladder('gpt-5-4', GPT_TIERS, '-priority'), GPT),
+  family('gpt-5-4-mini', 'GPT-5.4 Mini', ladder('gpt-5-4-mini', GPT_TIERS.slice(1)), GPT_REQUIRED),
+  family('gpt-5-5', 'GPT-5.5', ladder('gpt-5-5', GPT_TIERS), GPT),
+  family('gpt-5-5-fast', 'GPT-5.5 Fast', ladder('gpt-5-5', GPT_TIERS, '-priority'), GPT),
+  family('gpt-5-6-luna', 'GPT-5.6 Luna', ladder('gpt-5-6-luna', GPT_56_TIERS), GPT_56),
+  family('gpt-5-6-luna-fast', 'GPT-5.6 Luna Fast', ladder('gpt-5-6-luna', GPT_56_TIERS, '-priority'), GPT_56),
+  family('gpt-5-6-sol', 'GPT-5.6 Sol', ladder('gpt-5-6-sol', GPT_56_TIERS), GPT_56),
+  family('gpt-5-6-sol-fast', 'GPT-5.6 Sol Fast', ladder('gpt-5-6-sol', GPT_56_TIERS, '-priority'), GPT_56),
+  family('gpt-5-6-terra', 'GPT-5.6 Terra', ladder('gpt-5-6-terra', GPT_56_TIERS), GPT_56),
+  family('gpt-5-6-terra-fast', 'GPT-5.6 Terra Fast', ladder('gpt-5-6-terra', GPT_56_TIERS, '-priority'), GPT_56),
+  family('kimi-k3', 'Kimi K3', ladder('kimi-k3', ['low', 'high', 'max']), {
+    efforts: ['low', 'high', 'max'],
+    requiresEffort: true,
+  }),
+  family(
+    'swe-1-7',
+    'SWE-1.7',
+    { members: ['swe-1-7-medium', 'swe-1-7'], routing: { medium: 'swe-1-7-medium', max: 'swe-1-7' } },
+    { efforts: ['medium', 'max'], requiresEffort: true }
+  ),
+  family('grok-4-5', 'Grok 4.5', ladder('grok-4-5', ['low', 'medium', 'high']), {
+    efforts: ['low', 'medium', 'high'],
+    requiresEffort: true,
+  }),
+  family('inkling', 'Inkling', ladder('inkling', GPT_56_TIERS), GPT_56),
+  family('gemini-3-1-pro', 'Gemini 3.1 Pro', ladder('gemini-3-1-pro', ['low', 'high']), {
+    efforts: ['low', 'high'],
+    requiresEffort: true,
+  }),
+  family('gemini-3-5-flash', 'Gemini 3.5 Flash', ladder('gemini-3-5-flash', FLASH_TIERS), FLASH),
+  family('gemini-3-6-flash', 'Gemini 3.6 Flash', ladder('gemini-3-6-flash', FLASH_TIERS), FLASH),
+  family('gemini-3-flash', 'Gemini 3 Flash', enumLadder('MODEL_GOOGLE_GEMINI_3_0_FLASH', FLASH_TIERS), FLASH),
+  family(
+    'glm-5-2',
+    'GLM-5.2',
+    { members: ['glm-5-2', 'glm-5-2-none', 'glm-5-2-max'], routing: { high: 'glm-5-2', xhigh: 'glm-5-2' } },
+    { efforts: ['high', 'xhigh'], requiresEffort: true }
+  ),
+  family(
+    'glm-5-2-1m',
+    'GLM-5.2 1M',
+    {
+      members: ['glm-5-2-none-1m', 'glm-5-2-1m', 'glm-5-2-max-1m'],
+      routing: { off: 'glm-5-2-none-1m', high: 'glm-5-2-1m', xhigh: 'glm-5-2-max-1m' },
+    },
+    { efforts: ['high', 'xhigh'] }
+  ),
+  family(
+    'gemini-3-7-flash',
+    'Gemini 3.7 Flash',
+    {
+      members: ['gemini-3-7-flash-medium', 'gemini-3-7-flash-minimal', 'gemini-3-7-flash-low', 'gemini-3-7-flash-high'],
+      routing: ladder('gemini-3-7-flash', FLASH_TIERS).routing,
+    },
+    { ...FLASH, defaultLevel: 'medium', defaultMember: 'gemini-3-7-flash-medium' }
+  ),
+  family(
+    'swe-1-7-lightning',
+    'SWE-1.7 Lightning',
+    {
+      members: ['swe-1-7-lightning-medium', 'swe-1-7-lightning'],
+      routing: { medium: 'swe-1-7-lightning-medium', max: 'swe-1-7-lightning' },
+    },
+    {
+      efforts: ['medium', 'max'],
+      requiresEffort: true,
+      defaultLevel: 'medium',
+      defaultMember: 'swe-1-7-lightning-medium',
+    }
+  ),
+  family(
+    'grok-4-6',
+    'Grok 4.6',
+    {
+      members: ['grok-4-6-medium', 'grok-4-6-low', 'grok-4-6-high', 'grok-4-6-xhigh'],
+      routing: ladder('grok-4-6', ['low', 'medium', 'high', 'xhigh']).routing,
+    },
+    {
+      efforts: ['low', 'medium', 'high', 'xhigh'],
+      requiresEffort: true,
+      defaultLevel: 'medium',
+      defaultMember: 'grok-4-6-medium',
+    }
+  ),
+  ...['flash', 'pro'].map((size) =>
+    family(
+      `deepseek-v4-${size}`,
+      `DeepSeek V4 ${size === 'pro' ? 'Pro' : 'Flash'}`,
+      {
+        members: [`deepseek-v4-${size}-high`, `deepseek-v4-${size}-low`, `deepseek-v4-${size}-max`],
+        routing: ladder(`deepseek-v4-${size}`, ['low', 'high', 'max']).routing,
+      },
+      {
+        efforts: ['low', 'high', 'max'],
+        requiresEffort: true,
+        defaultLevel: 'high',
+        defaultMember: `deepseek-v4-${size}-high`,
+      }
+    )
+  ),
+  family(
+    'nemotron-3-ultra',
+    'Nemotron 3 Ultra',
+    {
+      members: ['nemotron-3-ultra-high', 'nemotron-3-ultra-none', 'nemotron-3-ultra-medium'],
+      routing: ladder('nemotron-3-ultra', ['none', 'medium', 'high']).routing,
+    },
+    { efforts: ['medium', 'high'], defaultLevel: 'high', defaultMember: 'nemotron-3-ultra-high' }
+  ),
+  // A single-uid rename: no effort surface.
+  Object.freeze({ id: 'claude-haiku-4-5', name: 'Claude Haiku 4.5', members: ['MODEL_PRIVATE_11'], routing: {} }),
+]);