mohdel 1.0.0 → 1.0.1

package/README.md

@@ -107,11 +107,11 @@ groq/llama-4-scout-17b-16e-instruct
 
 ## Attack surface
 
-Anthropic's 2026 threat report describes actors compromising AI wrapper
-services built on LiteLLM, using prompt injection to exfiltrate the production
-API keys held in their cloud containers. That attack needs two things: keys
-sitting where a process can read them, and a component that injected content
-can steer into reading them. Mohdel is built so neither is present.
+Anthropic's 2026 threat report describes actors compromising LLM wrapper
+services through prompt injection, exfiltrating the production API keys held
+in their cloud containers. That attack needs two things: keys sitting where a
+process can read them, and a component that injected content can steer into
+reading them. Mohdel is built so neither is present.
 
 - **Nothing executes.** No `eval`, no `new Function`, no `child_process`
   anywhere in the session, factory or library, and no automatic tool loop. A

package/js/factory/bridge.js

@@ -76,14 +76,6 @@ import { createRealtimeDeltaBuffer } from '../../src/lib/utils.js'
 export async function runAnswer ({ provider, model, modelKey, configuration, prompt, options = {} }, deps = {}) {
   const envelope = markTrustedMedia(toEnvelope({ modelKey, configuration, prompt, options }))
 
-  // If the caller passed a `realtimeHandler`, feed every `delta`
-  // event into a buffer that invokes the handler on batches matching
-  // `bufferOpts` cadence. Without this, streaming callbacks silently
-  // never fire — `mo ask --stream` and any integration that relies
-  // on streaming callbacks stops working.
-  //
-  // Skip the buffer allocation entirely when no handler was
-  // supplied — the common case.
   const deltaBuffer = options.realtimeHandler
     ? createRealtimeDeltaBuffer(options.realtimeHandler, options.bufferOpts)
     : null
@@ -99,9 +91,6 @@ export async function runAnswer ({ provider, model, modelKey, configuration, pro
       }
     }
   } finally {
-    // Flush any pending buffered content regardless of terminal
-    // path (success, error, or exception) so the handler sees the
-    // tail of the stream.
     deltaBuffer?.flush()
   }
 
@@ -233,9 +222,7 @@ function toEnvelope ({ modelKey, configuration, prompt, options }) {
   if (options.identifier) envelope.identifier = options.identifier
   if (options.idleHeartbeatMs !== undefined) envelope.idleHeartbeatMs = options.idleHeartbeatMs
 
-  // OpenRouter routing prefs ride in their own bag to keep the flat
-  // envelope clean. The openrouter adapter reads this via
-  // `config.mutateArgs`.
+  // OpenRouter routing prefs ride in their own bag; the adapter reads them via `config.mutateArgs`.
   if (options.providerOrder || options.providerAllow || options.providerDeny) {
     envelope.providerOptions = {
       openrouter: {
@@ -361,10 +348,7 @@ function toEnvelopePrompt (prompt) {
     return out
   }
 
-  // Unknown shape — reject early with a clear error. Letting this
-  // fall through would land a raw non-iterable in the envelope and
-  // produce a confusing `prompt.map is not a function` deep inside
-  // the adapter.
+  // Rejected here; falling through lands a non-iterable in the envelope and fails as `prompt.map is not a function` inside the adapter.
   throw new MohdelError('invalid prompt shape', {
     type: 'SESSION_INVALID_PROMPT',
     retryable: false,

package/js/session/_cooldown.js

@@ -104,9 +104,6 @@ export function createCooldownTracker (
   return { check, recordFailure, reset, coolingDownError, threshold, durationMs }
 }
 
-// Single session-local tracker. Re-exported as named members so
-// callers can `import * as cooldown from './_cooldown.js'` and use
-// `cooldown.reset(key)` / `cooldown.coolingDownError(key)`.
 const defaultTracker = createCooldownTracker()
 export const check = defaultTracker.check
 export const recordFailure = defaultTracker.recordFailure

package/js/session/_logger.js

@@ -26,10 +26,7 @@ const LEVELS = {
   silent: 100
 }
 
-// Real sessions want "warn" (anomalies visible) but tests would
-// otherwise flood stderr with the lines we deliberately induce.
-// Under vitest, default to silent unless MOHDEL_LOG_LEVEL is set
-// explicitly.
+// Under vitest, default to silent unless MOHDEL_LOG_LEVEL is set: induced anomalies would otherwise flood stderr.
 const DEFAULT_LEVEL = process.env.VITEST ? 'silent' : 'warn'
 const DEFAULT_VERBOSITY = 1
 
@@ -131,8 +128,4 @@ function mergeFields (target, source, includeStack) {
   }
 }
 
-// Module-level default — used when a caller doesn't pass their own.
-// Keeping the stream open lets adapters import the singleton
-// directly; `withContext` spawns scoped children per call without
-// allocating a new writer.
 export const logger = createLogger()

package/js/session/_tracing.js

@@ -48,9 +48,6 @@ export async function ensureOtelInitialized () {
     sdk.start()
     otelInitialized = true
   } catch (e) {
-    // Leave the flag false so a retry is possible. The current caller
-    // (bin.js::main) runs this once, so "retry" in practice means a
-    // process restart — but the semantics should match the flag name.
     process.stderr.write(
       `${JSON.stringify({ level: 'warn', time: Date.now(), msg: '[mohdel:tracing] OTel SDK init failed', err: { message: e.message } })}\n`
     )

package/js/session/adapters/_chat_completions.js

@@ -148,8 +148,7 @@ async function * runStreaming (envelope, client, args, config, start, deps) {
   args.stream = true
   args.stream_options = { include_usage: true }
 
-  // Accumulate via array + join to avoid per-delta V8 cons-string
-  // churn on long streams.
+  // Array + join, not `+=`: per-delta cons-strings are the cost on a long stream.
   const contentParts = []
   const reasoningParts = []
   let first = null
@@ -199,12 +198,7 @@ async function * runStreaming (envelope, client, args, config, start, deps) {
       }
       if (choice?.delta?.tool_calls) {
         for (const tc of choice.delta.tool_calls) {
-          // Resolve which slot this chunk belongs to:
-          //   1. explicit `tc.index` always wins (normal case);
-          //   2. missing `tc.index` but a `tc.id` we've seen before
-          //      → use the cross-ref we recorded on the opener;
-          //   3. new `tc.id` with no index → allocate next slot;
-          //   4. neither id nor index → can't correlate; drop + warn.
+          // Precedence: explicit `tc.index`, then a known `tc.id`, then a new slot; neither means the chunk cannot be correlated.
           let idx = tc.index
           if (idx == null && tc.id != null && idToIndex[tc.id] != null) {
             idx = idToIndex[tc.id]

package/js/session/adapters/_tools.js

@@ -8,10 +8,7 @@
 
 const argsObj = (args) => args || {}
 
-// Tool argument parse failures are expected (models routinely send
-// malformed JSON before retrying with corrections). Fall back to
-// returning the raw string — downstream adapter code handles the
-// type mismatch. Logging here would create warn-level noise.
+// Malformed tool-call JSON is routine, not an anomaly: return the raw string and let the adapter handle the mismatch.
 const parseArgs = (_name, args) => {
   if (typeof args !== 'string') return argsObj(args)
   try {

package/js/session/adapters/anthropic.js

@@ -110,8 +110,7 @@ export async function * anthropic (envelope, deps = {}) {
 
   const request = buildRequest(envelope, conversation, system, conversationCacheTtl)
 
-  // Accumulate via array + join to avoid per-delta V8 cons-string
-  // churn. Materialized at each exit point.
+  // Array + join, not `+=`: per-delta cons-strings are the cost on a long stream.
   const outputParts = []
   const currentOutput = () => outputParts.join('')
   let inputTokens = 0

package/js/session/adapters/fake.js

@@ -62,8 +62,6 @@ export async function * fake (envelope, deps = {}) {
       return
 
     case 'hang':
-      // Wait for abort. If the signal is already aborted, yield
-      // cancelled immediately. Otherwise block until it fires.
       await waitForAbort(signal)
       yield cancelledDone(start, first, envelope, '', 0, 0)
       return

package/js/session/adapters/gemini.js

@@ -101,8 +101,7 @@ export async function * gemini (envelope, deps = {}) {
     request.config = { ...(request.config ?? {}), abortSignal: signal }
   }
 
-  // Accumulate via array + join to avoid per-delta V8 cons-string
-  // churn. Materialized at each exit point.
+  // Array + join, not `+=`: per-delta cons-strings are the cost on a long stream.
   const outputParts = []
   const currentOutput = () => outputParts.join('')
   let inputTokens = 0

package/js/session/adapters/openai.js

@@ -71,8 +71,7 @@ export async function * openai (envelope, deps = {}) {
 
   const request = buildRequest(envelope, input, instructions)
 
-  // Accumulate via array + join to avoid per-delta V8 cons-string
-  // churn. Materialized at each exit point.
+  // Array + join, not `+=`: per-delta cons-strings are the cost on a long stream.
   const outputParts = []
   const currentOutput = () => outputParts.join('')
   let inputTokens = 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mohdel",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "license": "MIT",
   "author": {
     "name": "Christophe Le Bars",
@@ -136,7 +136,7 @@
     "@opentelemetry/exporter-trace-otlp-grpc": "^0.222.0",
     "@opentelemetry/sdk-node": "^0.222.0",
     "chalk": "^6.0.0",
-    "mohdel-thin-gate-linux-x64-gnu": "1.0.0"
+    "mohdel-thin-gate-linux-x64-gnu": "1.0.1"
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.125.0",

package/src/cli/complete.js

@@ -3,9 +3,7 @@ import { fieldDefs } from '../lib/schema.js'
 import { getCuratedModels, catalogEntries } from '../lib/common.js'
 import { ALIASES } from './aliases.js'
 
-// Completion must never import the factory (`src/lib/index.js`), which pulls
-// every adapter, provider SDK and the OTel stack — 350ms that would be paid on
-// every press of the tab key. Reading the catalog costs about 30ms.
+// Never import the factory here: it loads every provider SDK, on every tab press.
 
 const NOUNS = ['model', 'provider', 'creator', 'tag', 'ratelimit', 'ask', 'transcribe', 'default', 'doctor']
 
@@ -18,9 +16,6 @@ const VERBS = {
   ratelimit: ['show', 'set', 'rm', 'provider']
 }
 
-// What the argument at a given offset after `<noun> <verb>` names. `model` is
-// an id already in the catalog, so `model add` — which takes a new one — is
-// deliberately absent.
 const ARGUMENT = {
   ask: ['model'],
   transcribe: ['model'],
@@ -79,16 +74,12 @@ export const candidates = async (cword, words) => {
     return offer([...NOUNS, ...Object.keys(ALIASES)])
   }
 
-  // Resolve the alias exactly as the router does, so completion and dispatch
-  // never disagree about what a word means.
   const alias = ALIASES[before[0]]
   const chain = alias ? [alias.noun, ...alias.inject, ...before.slice(1)] : before
   const [noun, verb, ...rest] = chain
 
   if (chain.length === 1 && VERBS[noun]) return offer(VERBS[noun])
 
-  // `model show <id>` keys on two words; `ask <id>` on one. Whichever matched
-  // decides where the argument list starts.
   const paired = ARGUMENT[`${noun} ${verb}`]
   const shape = paired ?? ARGUMENT[noun]
   if (!shape) return []
@@ -109,8 +100,7 @@ complete -o default -F _mo_completion mo
 `
 
 export async function runComplete (args) {
-  // A crash here would break the user's tab key, so an unreadable or corrupt
-  // catalog offers nothing rather than an error.
+  // An unreadable catalog offers nothing rather than breaking the tab key.
   try {
     const cword = Number.parseInt(args[0], 10)
     if (!Number.isFinite(cword)) return

package/src/cli/default.js

@@ -1,10 +1,6 @@
 import { intro, outro, select, isCancel, cancel } from '@clack/prompts'
 import { getConfig, getCuratedModels, saveConfig, catalogEntries } from '../lib/common.js'
 
-// CLI-only. The default model is a convenience for someone typing `mo ask`;
-// the library and the gate never read it. A program picks a model by id or by
-// tag, where the choice is explicit and reviewable — a machine inheriting a
-// human's terminal preference is how a call ends up on a model nobody chose.
 export async function runDefault (args = []) {
   if (args.includes('-h') || args.includes('--help')) {
     console.log(`mohdel default — the model "mo ask" uses when you name none
@@ -49,8 +45,7 @@ read it: a program names its model, or selects one by tag.`)
   }
 
   try {
-    // Merge: the file also holds the chosen coding agent, and replacing the
-    // object wholesale would drop it.
+    // The file also holds the chosen coding agent; replacing it wholesale drops that.
     await saveConfig({ ...(await getConfig()), defaultModel: selectedModelId })
     outro(`Default set to ${selectedModelId} — "mo ask" uses it when you give no model.`)
   } catch (err) {

package/src/cli/entry.js

@@ -155,9 +155,6 @@ Write an entry with your coding agent: mo model instructions <provider>`)
     console.log(`${meta('Undo:')}  mo model backup diff prev  ${meta('│')}  mo model backup restore prev`)
   }
 
-  // The candidate was written by the agent, not by mohdel, so it is never
-  // removed unasked. It has served its purpose though, and the catalog's own
-  // backups are what an undo uses — not this file.
   if (path === '-') return
   if (args.includes('--rm')) {
     await rm(path, { force: true })

package/src/cli/instructions.js

@@ -14,8 +14,6 @@ const CATALOG_DOC = 'https://github.com/clbrge/mohdel/blob/main/docs/CATALOG.md'
 export const BRIEF_FILE = 'mohdel-brief.md'
 export const BRIEF_HEADING = '# mohdel catalog entry'
 
-// A brief mohdel wrote before is stale, not precious — replace it. Anything
-// else owning the name is the user's, so write alongside rather than over it.
 export const writeBrief = async (provider) => {
   const brief = await buildBrief(provider)
   let name = BRIEF_FILE
@@ -163,9 +161,6 @@ One-shot instead of a session, where the agent supports it:
 
   const assistant = (await getConfig()).assistant || null
 
-  // 150 lines of agent-facing markdown is not what someone at a terminal
-  // wants. Redirected or piped — how the recipe and agents use it — stdout
-  // still carries the brief.
   if (process.stdout.isTTY && !args.includes('--print')) {
     const { preferredAgent, briefPrompt } = await import('../lib/assistants.js')
     const { ok, meta, id: cmd } = await import('./colors.js')

package/src/cli/model.js

@@ -6,8 +6,6 @@ import { providerOf } from '#core/model-id.js'
 import { parseJsonFlag, printAvailableFields, jsonOutput, jsonOutputOne } from './json-output.js'
 import { id, label, tag, price, meta, err, warn, ok } from './colors.js'
 
-// An empty catalog is the fresh-install state, not an error — but printing
-// nothing at all reads as a broken command.
 export const EMPTY_CATALOG = 'Catalog is empty. "mo curate <provider>" adds a provider\'s models, ' +
   'then "mo model instructions <provider>" fills in the prices.'
 

package/src/cli/onboard.js

@@ -30,10 +30,7 @@ async function appendToEnvFile (key, value) {
   let content = ''
   if (existsSync(ENV_PATH)) {
     content = await readFile(ENV_PATH, 'utf8')
-    // Replace existing line if present. The replacement is a function
-    // because `$&`, `` $` ``, `$'` and `$1` are expanded inside a
-    // replacement *string* — a pasted key containing any of them would
-    // be silently rewritten before it hit disk.
+    // Function form: `$&`, `` $` ``, `$'` and `$1` are expanded inside a replacement string, which would rewrite a pasted key.
     const re = new RegExp(`^${escapeRegExp(key)}=.*$`, 'm')
     if (re.test(content)) {
       content = content.replace(re, () => `${key}=${value}`)
@@ -52,8 +49,6 @@ export async function runOnboard () {
   loadDefaultEnv()
   const { configured, unconfigured } = getConfiguredProviders()
 
-  // Already set up: a status line and the step that follows from it, not a
-  // menu. `mo --help` is the menu.
   if (configured.length > 0) {
     const curated = await getCuratedModels()
     const active = catalogEntries(curated).filter(([, s]) => !s.deprecated)
@@ -72,8 +67,6 @@ export async function runOnboard () {
     let handOver = null
     if (active.length === 0) {
       next.push([`mo curate ${first}`, 'add the models this key can reach'])
-      // An interrupted run leaves the brief behind. Telling someone to write
-      // one that is already sitting in front of them is the wrong step.
       const { BRIEF_FILE, BRIEF_HEADING } = await import('./instructions.js')
       const briefPath = resolve(process.cwd(), BRIEF_FILE)
       const briefReady = existsSync(briefPath) &&
@@ -166,13 +159,8 @@ export async function runOnboard () {
   // Reload env so the new key is visible, then fill the catalog.
   loadDefaultEnv()
 
-  // OpenRouter's model list carries prices, so picking by hand is complete
-  // there and needs no agent at all.
   const selfPricing = !!providers[selected]?.pricesFromApi
 
-  // Where the prices are published, the models that cost nothing are the whole
-  // offer for someone with no coding agent. The count belongs on the menu: put
-  // it behind a search over hundreds of ids and nobody finds it.
   let api = null
   let free = []
   if (selfPricing) {
@@ -244,9 +232,6 @@ export async function runOnboard () {
   await writeCatalogBrief(selected)
 }
 
-// The provider API returns model ids, never prices — entries land unpriced and
-// `cost` stays 0 on every result until the numbers are filled in. This is the
-// moment the user is still in the flow.
 async function writeCatalogBrief (selected) {
   const { AGENTS, detectAssistants, preferredAgent, briefPrompt } = await import('../lib/assistants.js')
   const installed = detectAssistants()

package/src/lib/assistants.js

@@ -1,9 +1,6 @@
 import { statSync } from 'node:fs'
 import { join, delimiter } from 'node:path'
 
-// Launch forms are the vendor-documented ones for starting a session on an
-// initial prompt — not the one-shot/print flags, since picking a model is a
-// conversation.
 const AGENTS = [
   { bin: 'claude', label: 'Claude Code', start: p => `claude ${p}` },
   { bin: 'codex', label: 'Codex CLI', start: p => `codex ${p}` },
@@ -46,9 +43,6 @@ export const launchLines = (installed = detectAssistants(), chosen = null, inden
 // one argument is the form every agent CLI accepts.
 const custom = (bin) => ({ bin, label: bin, start: p => `${bin} ${p}` })
 
-// Which agent the recipe should name. A stated preference beats detection —
-// PATH cannot see which of two installed agents someone actually uses, nor an
-// agent that lives in an editor.
 export const preferredAgent = (chosen, installed = detectAssistants()) => {
   if (chosen) return AGENTS.find(a => a.bin === chosen) || custom(chosen)
   return TOP.find(a => installed.includes(a.bin)) || TOP[0]

package/src/lib/catalog-review.js

@@ -60,8 +60,6 @@ export const reviewEntry = (key, spec, catalog, { strict = false, local = null }
   }
 
   for (const issue of validate(spec, key, { strict })) {
-    // Custom fields are namespaced by convention (docs/CATALOG.md) and
-    // round-trip untouched, so they are not drift.
     if (issue.message === 'unknown field' && issue.field.includes(':')) continue
     if (issue.message === 'unknown field' && local?.fields[issue.field]) continue
     if (issue.severity === 'error') errors.push(`${key}: ${issue.field} — ${issue.message}`)

package/src/lib/common.js

@@ -1,7 +1,7 @@
 import { join, sep } from 'path'
 import { homedir } from 'os'
 import { existsSync } from 'fs'
-import { readFile, writeFile, mkdir, copyFile, stat } from 'fs/promises'
+import { readFile, writeFile, mkdir, copyFile, stat, rename, unlink } from 'fs/promises'
 import envPaths from 'env-paths'
 import { validate, stripComputed } from './schema.js'
 import { silent } from './logger.js'
@@ -81,6 +81,17 @@ const getWeek = (ms) => {
   return `${d.getFullYear()}-W${String(Math.ceil((d.getDate() + new Date(d.getFullYear(), d.getMonth(), 1).getDay()) / 7)).padStart(2, '0')}-${d.getMonth()}`
 }
 
+const writeAtomic = async (filePath, contents) => {
+  const tmp = `${filePath}.${process.pid}.tmp`
+  try {
+    await writeFile(tmp, contents)
+    await rename(tmp, filePath)
+  } catch (err) {
+    await unlink(tmp).catch(() => {})
+    throw err
+  }
+}
+
 const rotateBackup = async (filePath) => {
   if (!existsSync(filePath)) return
 
@@ -214,7 +225,7 @@ const createFileOperation = (filePath, defaultValue = {}, operationType) => {
       }
 
       const sortedData = sortObjectKeys(dataToSave)
-      await writeFile(filePath, JSON.stringify(sortedData, null, 2))
+      await writeAtomic(filePath, JSON.stringify(sortedData, null, 2))
       return true
     } catch (err) {
       moduleLogger.error(`[mohdel:common] failed to save ${operationType}: ${err.message}`)

package/src/lib/local-conventions.js

@@ -79,8 +79,7 @@ export const parseLocalConventions = (text) => {
   return { fields, tags, adding, notes: doc.notes || '' }
 }
 
-// Absent is the default state, not an error. A file that exists but does not
-// parse is broken policy — it must not read as "no conventions".
+// Absent is the default state; a file that exists but does not parse is not.
 export const loadLocalConventions = async (path = LOCAL_PATH) => {
   if (!existsSync(path)) return null
   try {

package/src/lib/providers.js

@@ -146,9 +146,9 @@ const providers = {
     baseURL: 'https://dashscope-intl.aliyuncs.com/compatible-mode/v1',
     createConfiguration: apiKey => ({ apiKey }),
     references: {
-      pricing: 'https://www.alibabacloud.com/help/en/model-studio/models',
-      models: 'https://www.alibabacloud.com/help/en/model-studio/models',
-      rateLimits: 'https://www.alibabacloud.com/help/en/model-studio/rate-limit'
+      pricing: 'https://docs.qwencloud.com/developer-guides/getting-started/pricing',
+      models: 'https://www.qwencloud.com/models',
+      rateLimits: 'https://docs.qwencloud.com/developer-guides/administration/rate-limits'
     },
     contextSemantics: 'shared',
     outputCapStrategy: 'accept'

package/src/lib/select.js

@@ -94,21 +94,12 @@ const replaceModel = async (modelToReplace, newCuratedKey, newModelLabel, newMod
   }
   delete curated[modelToReplace.key]
 
-  // Preserve custom properties from the old model entry,
-  // but explicitly exclude 'model' and 'models' fields from the old entry.
-  // This prevents old model identifiers from polluting the new entry if the
-  // new model's details (newModelDetails) don't specify them, ensuring consistent `upstreamIds`.
   const {
     model: _discardedOldModelIdentifier, // eslint-disable-line no-unused-vars
     models: _discardedOldModelIdentifiers, // eslint-disable-line no-unused-vars
     ...restOfOldModelDataProperties
   } = oldModelDataFromCurated || {}
 
-  // Add new model to curated.
-  // Merge properties: Start with applicable old properties (restOfOldModelDataProperties),
-  // then layer new model details (newModelDetails), which includes new provider & sdk.
-  // Finally, ensure the new label (newModelLabel) is set.
-  // Properties in newModelDetails and newModelLabel will override any from restOfOldModelDataProperties.
   curated[newCuratedKey] = {
     ...restOfOldModelDataProperties,
     ...newModelDetails,
@@ -165,9 +156,6 @@ const isModelTrackedInCollection = (collection, providerName, modelId) => {
   return false
 }
 
-// Which creators a provider serves is a fact of the catalog, not a property of
-// the provider: a router's line-up changes week to week. Offer the ones this
-// provider already serves first, then every creator mohdel has a label for.
 const creatorOptions = async (providerName, guess) => {
   const catalog = await getCuratedModels()
   const served = new Set()
@@ -262,10 +250,6 @@ const filterUncurated = (models, providerName, curated, excluded) => {
   })
 }
 
-// A model list only carries prices when the provider publishes them
-// (`pricesFromApi`). Where it does, the ones that cost nothing are the whole
-// no-agent story, and a free-text search over hundreds of ids is no way to
-// find them.
 export const freeModels = (models) =>
   models.filter(m => m.inputPrice === 0 && m.outputPrice === 0)
 
@@ -278,9 +262,7 @@ const buildEntry = async (providerName, model, providerInstance) => {
     label: model.label || model.id,
     ...(info || {})
   })
-  // Upstream lists name the provider, never the creator. An OpenRouter id is
-  // `<vendor>/<model>`, so the vendor segment is the answer when the creator
-  // table does not recognize the name.
+  // An upstream list names the provider, never the creator; an OpenRouter id carries the vendor in its first segment.
   if (!entry.creator) entry.creator = creatorFromModelId(model.id) || model.id.split('/')[0]
   return entry
 }