omnirush 0.1.1

package/src/bin.js

@@ -0,0 +1,456 @@
+#!/usr/bin/env node
+// omnirush — launcher for the Omnirush coding agent (pi core).
+//
+// The CLI is a thin client of the Omnirush manager (a single public
+// HTTPS origin, real cert — no helper proxy, no custom CA):
+//
+//   omnirush login    device-flow sign-in (browser approval; tokens
+//                     stored 0600 in ~/.omnirush/auth.json)
+//   omnirush logout   forget the stored tokens
+//   omnirush whoami   show the signed-in device identity
+//   omnirush doctor   check auth (or pending login), manager, pi config
+//   omnirush collect  one-shot workspace snapshot upload
+//   omnirush          run the agent (default; forwards to pi)
+//
+// Environment:
+//   OMNIRUSH_ORIGIN       manager origin override (default
+//                         https://omnirush.ai/omnirush)
+//   OMNIRUSH_GATEWAY_URL  provider base URL override ({origin}/v1)
+//   OMNIRUSH_DIR          state dir override (default ~/.omnirush)
+//   OMNIRUSH_MODEL        model override for plain runs (default
+//                         gpt-6-astra; user --model still wins)
+//
+// Agent runs default to `--provider omnirush --model gpt-6-astra` (SOTA
+// only — charter rule 1). The sota extension watches every response,
+// refreshes the device token single-flight on 401 (retry once), and
+// warns on stderr if the gateway serves a different model than
+// requested; `--strict-sota` makes that violation fatal (exit 3).
+
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import http from "node:http";
+import https from "node:https";
+import os from "node:os";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+
+import {
+  DEFAULT_ORIGIN,
+  modelsConfig,
+  resolveGatewayUrl,
+  withModelDefaults,
+  resolveModelDefaults,
+} from "./lib.js";
+import {
+  clearAuth,
+  deviceAuthorize,
+  deviceMe,
+  loadAuth,
+  loadPendingFlow,
+  omniDir,
+  openBrowser,
+  pollForToken,
+  redactForDisplay,
+  refreshTokens,
+  saveAuth,
+  savePendingFlow,
+  clearPendingFlow,
+} from "../assets/extensions/omnirush/auth.js";
+
+const require = createRequire(import.meta.url);
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const OMNI_DIR = omniDir();
+// OMNIRUSH_PI_AGENT_DIR overrides where pi's config/extensions live
+// (tests use it to keep the real ~/.pi untouched).
+const PI_AGENT_DIR = process.env.OMNIRUSH_PI_AGENT_DIR
+  ? path.resolve(process.env.OMNIRUSH_PI_AGENT_DIR)
+  : path.join(os.homedir(), ".pi", "agent");
+const PI_MODELS_JSON = path.join(PI_AGENT_DIR, "models.json");
+const PI_EXT_DIR = path.join(PI_AGENT_DIR, "extensions", "omnirush");
+
+function managerOrigin() {
+  return (
+    (process.env.OMNIRUSH_ORIGIN || "").trim().replace(/\/+$/, "") ||
+    DEFAULT_ORIGIN
+  );
+}
+
+function piEntry() {
+  // The pi package is Bun-first and its "exports" map blocks plain Node
+  // resolution, so locate it by path: walk up from our own package root
+  // to the nearest node_modules containing it.
+  const PKG = "@earendil-works/pi-coding-agent";
+  let dir = path.resolve(__dirname, "..");
+  for (let i = 0; i < 6; i++) {
+    const pkgPath = path.join(dir, "node_modules", PKG, "package.json");
+    if (fs.existsSync(pkgPath)) {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+      if (pkg.bin?.pi) return path.join(dir, "node_modules", PKG, pkg.bin.pi);
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("could not locate the pinned pi CLI (@earendil-works/pi-coding-agent)");
+}
+
+function ensureDirs() {
+  fs.mkdirSync(OMNI_DIR, { recursive: true, mode: 0o700 });
+  fs.mkdirSync(PI_AGENT_DIR, { recursive: true });
+  fs.mkdirSync(PI_EXT_DIR, { recursive: true });
+}
+
+// Merge our provider into the user's models.json without clobbering
+// unrelated providers. Ours is authoritative: this file is how the
+// product ships its provider. Other providers untouched.
+function installModelsJson(gatewayUrl) {
+  let current = {};
+  try {
+    current = JSON.parse(fs.readFileSync(PI_MODELS_JSON, "utf8"));
+  } catch {
+    /* fresh install */
+  }
+  if (typeof current !== "object" || current === null) current = {};
+  current.providers = {
+    ...(current.providers || {}),
+    ...modelsConfig({ gatewayUrl }).providers,
+  };
+  fs.writeFileSync(PI_MODELS_JSON, JSON.stringify(current, null, 2) + "\n");
+}
+
+function installExtensions() {
+  const src = path.join(__dirname, "..", "assets", "extensions", "omnirush");
+  for (const f of fs.readdirSync(src)) {
+    // pi loads extensions/<dir>/index.ts only; that aggregator imports the
+    // sibling .ts modules and the shared auth.js — copy all loadable files.
+    if (!f.endsWith(".ts") && !f.endsWith(".js")) continue;
+    fs.copyFileSync(path.join(src, f), path.join(PI_EXT_DIR, f));
+  }
+}
+
+function agentGatewayUrl(auth) {
+  return resolveGatewayUrl(process.env, auth?.gatewayUrl);
+}
+
+function findBun() {
+  // Vendored per-platform bun first (bundled for linux-x64, darwin-arm64,
+  // darwin-x64, windows-x64), then PATH, then the standard single-user
+  // install location.
+  const runtimeRoot = path.resolve(__dirname, "..", ".runtime");
+  const plat = process.platform;
+  const arch = process.arch === "arm64" ? "aarch64" : "x64";
+  const candidates = [];
+  if (plat === "win32") {
+    candidates.push(
+      path.join(runtimeRoot, "bun-windows-x64", "bin", "bun.exe"),
+    );
+    for (const dir of (process.env.PATH || "").split(path.delimiter)) {
+      if (dir) candidates.push(path.join(dir, "bun.exe"));
+    }
+  } else {
+    if (plat === "linux" && arch === "x64") {
+      candidates.push(path.join(runtimeRoot, "bin", "bun"));
+    }
+    candidates.push(path.join(runtimeRoot, `bun-${plat}-${arch}`, "bin", "bun"));
+    for (const dir of (process.env.PATH || "").split(path.delimiter)) {
+      if (dir) candidates.push(path.join(dir, "bun"));
+    }
+    candidates.push(path.join(os.homedir(), ".bun", "bin", "bun"));
+  }
+  for (const c of candidates) {
+    try {
+      fs.accessSync(c, fs.constants.X_OK);
+      return c;
+    } catch {
+      /* next */
+    }
+  }
+  return null;
+}
+
+function runtimeFor(entry) {
+  // pi is Bun-first; its CLI imports node:module#enableCompileCache,
+  // which needs Node >= 22.8. Prefer bun when present, else enforce the
+  // Node floor with a clear message.
+  const bun = findBun();
+  if (bun) return { cmd: bun, args: [entry] };
+  const [major, minor] = process.versions.node.split(".").map(Number);
+  if (major > 22 || (major === 22 && minor >= 8)) {
+    return { cmd: process.execPath, args: [entry] };
+  }
+  console.error(
+    `omnirush: Node ${process.versions.node} is too old for the agent core ` +
+      "(need >= 22.8) and bun was not found. Install Node 22+ or bun.",
+  );
+  process.exit(1);
+}
+
+async function fetchJson(url, init = {}) {
+  const client = url.startsWith("http:") ? http : https;
+  return new Promise((resolve, reject) => {
+    const req = client.request(url, {
+      method: init.method || "GET",
+      headers: init.headers || {},
+      timeout: init.timeout ?? 10_000,
+    }, (res) => {
+      let body = "";
+      res.on("data", (c) => (body += c));
+      res.on("end", () => resolve({ status: res.statusCode, body }));
+    });
+    req.on("timeout", () => req.destroy(new Error("timeout")));
+    req.on("error", reject);
+    if (init.body) req.write(init.body);
+    req.end();
+  });
+}
+
+// --- auth commands ------------------------------------------------------
+
+function deviceName() {
+  return (os.hostname() || "omnirush-cli").split(/[.\s]/)[0].slice(0, 64) || "omnirush-cli";
+}
+
+async function cmdLogin(argv) {
+  ensureDirs();
+  const origin = managerOrigin();
+  const noOpen = argv.includes("--no-open");
+  const authorize = await deviceAuthorize(origin, {
+    deviceName: deviceName(),
+    platform: process.platform,
+    fetchImpl: globalThis.fetch,
+  });
+
+  console.log("Omnirush device login");
+  console.log(`  code: ${authorize.userCode}`);
+  console.log(`  open: ${authorize.verificationUriComplete}`);
+  if (!noOpen && openBrowser(authorize.verificationUriComplete)) {
+    console.log("  (browser launched — approve there; if it did not open, use the URL above)");
+  } else {
+    console.log("  (open the URL above in a browser and approve)");
+  }
+
+  savePendingFlow(OMNI_DIR, {
+    device_code: authorize.deviceCode,
+    user_code: authorize.userCode,
+    verification_uri_complete: authorize.verificationUriComplete,
+    origin,
+    expires_at: authorize.expiresAt,
+    started_at: new Date().toISOString(),
+  });
+
+  let tokens;
+  try {
+    tokens = await pollForToken(origin, {
+      deviceCode: authorize.deviceCode,
+      intervalSec: authorize.intervalSec,
+      expiresAt: authorize.expiresAt,
+      fetchImpl: globalThis.fetch,
+      onWait: () => process.stdout.write("."),
+    });
+  } catch (error) {
+    clearPendingFlow(OMNI_DIR);
+    console.error(`\nomnirush login failed: ${error.message}`);
+    process.exit(1);
+  }
+  process.stdout.write("\n");
+  clearPendingFlow(OMNI_DIR);
+
+  saveAuth(OMNI_DIR, {
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken,
+    ...(tokens.gatewayUrl ? { gatewayUrl: tokens.gatewayUrl } : {}),
+  });
+  console.log(`Signed in. Tokens stored 0600 in ${path.join(OMNI_DIR, "auth.json")}`);
+
+  let me = null;
+  try {
+    me = await deviceMe(origin, { accessToken: tokens.accessToken, fetchImpl: globalThis.fetch });
+  } catch {
+    /* identity display is best effort */
+  }
+  if (me && typeof me === "object") {
+    console.log(`Identity: ${JSON.stringify(redactForDisplay(me))}`);
+  }
+  console.log("Run `omnirush` inside a project to start.");
+}
+
+async function cmdLogout() {
+  clearAuth(OMNI_DIR);
+  console.log(`Signed out. Credentials removed from ${OMNI_DIR}`);
+}
+
+async function fetchMeWithRefresh(auth) {
+  const origin = managerOrigin();
+  let me = await deviceMe(origin, { accessToken: auth.accessToken, fetchImpl: globalThis.fetch });
+  if (me !== null) return { me, auth };
+  // 401: single-flight refresh (rotate both), retry once.
+  const next = await refreshTokens(origin, { refreshToken: auth.refreshToken, fetchImpl: globalThis.fetch });
+  saveAuth(OMNI_DIR, next);
+  me = await deviceMe(origin, { accessToken: next.accessToken, fetchImpl: globalThis.fetch });
+  return { me, auth: next };
+}
+
+async function cmdWhoami() {
+  const auth = loadAuth(OMNI_DIR);
+  if (!auth) {
+    console.error("Omnirush: not signed in. Run `omnirush login` first.");
+    process.exit(1);
+  }
+  const { me } = await fetchMeWithRefresh(auth);
+  if (!me) {
+    console.error("Omnirush: credentials rejected — run `omnirush login` again.");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(redactForDisplay(me), null, 2));
+}
+
+async function cmdDoctor() {
+  ensureDirs();
+  let healthy = true;
+  const ok = (label, good, detail) => {
+    if (!good) healthy = false;
+    console.log(`${good ? "ok  " : "FAIL"} ${label}${detail ? " — " + detail : ""}`);
+  };
+
+  // Manager reachability: /v1/models must answer 401 (route live, auth enforced).
+  const origin = managerOrigin();
+  const gateway = agentGatewayUrl(loadAuth(OMNI_DIR));
+  try {
+    const res = await fetchJson(`${gateway}/models`, { timeout: 5000 });
+    ok("manager", res.status === 401 || res.status < 500, `${origin} -> HTTP ${res.status}`);
+  } catch (e) {
+    ok("manager", false, `${origin} unreachable (${e.message})`);
+  }
+
+  // Auth: signed in, or a login waiting for browser approval (ok-pending).
+  const auth = loadAuth(OMNI_DIR);
+  if (auth) {
+    try {
+      const { me } = await fetchMeWithRefresh(auth);
+      if (me) {
+        const label =
+          (me && typeof me === "object" && (me.device_name || me.email || me.user_id || me.id)) ||
+          "device recognized";
+        ok("auth", true, `signed in (${label})`);
+      } else {
+        ok("auth", false, "credentials rejected — run `omnirush login` again");
+      }
+    } catch (e) {
+      if (e?.name === "RefreshRejectedError") {
+        ok("auth", false, "session expired — run `omnirush login` again");
+      } else {
+        ok("auth", false, `cannot verify session (${e.message})`);
+      }
+    }
+  } else {
+    const pending = loadPendingFlow(OMNI_DIR);
+    if (pending && (!pending.expires_at || Date.now() < pending.expires_at)) {
+      ok("auth", true, `PENDING approval — open ${pending.verification_uri_complete}`);
+      console.log("     login completes automatically once you approve in the browser");
+    } else {
+      ok("auth", false, "not signed in — run `omnirush login`");
+    }
+  }
+
+  installModelsJson(gateway);
+  installExtensions();
+  ok("pi config", true, PI_MODELS_JSON);
+  ok("extensions", true, PI_EXT_DIR);
+  process.exit(healthy ? 0 : 1);
+}
+
+// --- agent run ----------------------------------------------------------
+
+function requireAuth() {
+  const auth = loadAuth(OMNI_DIR);
+  if (auth) return auth;
+  const pending = loadPendingFlow(OMNI_DIR);
+  if (pending && (!pending.expires_at || Date.now() < pending.expires_at)) {
+    console.error("Omnirush: login pending — approve in the browser to finish:");
+    console.error(`  ${pending.verification_uri_complete}`);
+    process.exit(1);
+  }
+  console.error("Omnirush: not signed in. Run `omnirush login` first.");
+  process.exit(1);
+}
+
+function childEnv(auth) {
+  const gateway = agentGatewayUrl(auth);
+  const origin = (process.env.OMNIRUSH_ORIGIN || "").trim().replace(/\/+$/, "") ||
+    gateway.replace(/\/+$/, "").replace(/\/v1$/, ""); // provider base -> manager origin
+  return {
+    OMNIRUSH_TOKEN: auth.accessToken,
+    OMNIRUSH_ACCESS_TOKEN: auth.accessToken,
+    OMNIRUSH_ORIGIN: origin,
+    OMNIRUSH_GATEWAY_URL: gateway,
+    OMNIRUSH_DIR: OMNI_DIR,
+    // pi resolves its config dir from this env var; keep the child pi on
+    // exactly the models.json/extensions bin.js just installed.
+    PI_CODING_AGENT_DIR: PI_AGENT_DIR,
+  };
+}
+
+async function cmdRun() {
+  ensureDirs();
+  const auth = requireAuth();
+  installModelsJson(agentGatewayUrl(auth));
+  installExtensions();
+  const entry = piEntry();
+  const { cmd, args } = runtimeFor(entry);
+  // Plain `omnirush` always runs the SOTA model (charter rule 1); user
+  // flags win when present.
+  const piArgs = withModelDefaults([], resolveModelDefaults(process.env));
+  const child = spawn(cmd, [...args, ...piArgs], {
+    stdio: "inherit",
+    env: { ...process.env, ...childEnv(auth) },
+  });
+  child.on("exit", (code, signal) => {
+    if (signal) process.kill(process.pid, signal);
+    else process.exit(code ?? 0);
+  });
+}
+
+async function cmdCollect(argv) {
+  ensureDirs();
+  const auth = requireAuth();
+  installExtensions();
+  const entry = path.join(__dirname, "..", "assets", "collect-once.ts");
+  const { cmd, args } = runtimeFor(entry);
+  const child = spawn(cmd, [...args, ...argv], {
+    stdio: "inherit",
+    env: { ...process.env, ...childEnv(auth) },
+  });
+  child.on("exit", (code, signal) => {
+    if (signal) process.kill(process.pid, signal);
+    else process.exit(code ?? 0);
+  });
+}
+
+const [, , ...argv] = process.argv;
+const cmd = argv[0];
+if (cmd === "login") await cmdLogin(argv.slice(1));
+else if (cmd === "logout") await cmdLogout();
+else if (cmd === "whoami") await cmdWhoami();
+else if (cmd === "doctor") await cmdDoctor();
+else if (cmd === "--version" || cmd === "-v") console.log("omnirush 0.2.0 (pi core)");
+else if (cmd === "collect") await cmdCollect(argv.slice(1));
+else if (cmd === undefined || cmd === "run") await cmdRun();
+else {
+  // Forward everything (including argv[0] — e.g. `--help`, `-p prompt`,
+  // `--provider x`) to pi, defaulting the model the same way
+  // `omnirush run` does; user-specified --provider/--model are never
+  // duplicated and pi admin subcommands pass through untouched.
+  ensureDirs();
+  const auth = requireAuth();
+  installModelsJson(agentGatewayUrl(auth));
+  installExtensions();
+  const entry = piEntry();
+  const { cmd: bin, args } = runtimeFor(entry);
+  const piArgs = withModelDefaults(argv, resolveModelDefaults(process.env));
+  const child = spawn(bin, [...args, ...piArgs], {
+    stdio: "inherit",
+    env: { ...process.env, ...childEnv(auth) },
+  });
+  child.on("exit", (code) => process.exit(code ?? 0));
+}

package/src/lib.js

@@ -0,0 +1,179 @@
+// Omnirush CLI core logic — pure functions, no side effects, so node:test
+// can cover them without spawning the agent.
+
+export const DEFAULT_PROVIDER = "omnirush";
+export const DEFAULT_MODEL = "gpt-6-astra";
+
+// Manager origin the CLI talks to directly (public HTTPS, real cert —
+// no helper proxy, no custom CA). The pi provider base URL is
+// {origin}/v1; device-flow endpoints live directly under {origin}.
+export const DEFAULT_ORIGIN = "https://omnirush.ai/omnirush";
+export const DEFAULT_GATEWAY_URL = `${DEFAULT_ORIGIN}/v1`;
+
+/**
+ * Gateway (provider base) URL resolution: OMNIRUSH_GATEWAY_URL wins,
+ * then OMNIRUSH_ORIGIN, then a gateway_url rotated in with the device
+ * tokens, then the shipped default.
+ */
+export function resolveGatewayUrl(env = process.env, authGatewayUrl) {
+  const override = (env.OMNIRUSH_GATEWAY_URL || "").trim();
+  if (override) return override;
+  const origin = (env.OMNIRUSH_ORIGIN || "").trim().replace(/\/+$/, "");
+  if (origin) return `${origin}/v1`;
+  const rotated = (authGatewayUrl || "").trim();
+  if (rotated) return rotated.replace(/\/+$/, "").replace(/\/v1$/, "") + "/v1";
+  return DEFAULT_GATEWAY_URL;
+}
+
+// pi admin subcommands (dispatched on argv[0] inside pi). These reject our
+// agent flags ("Unknown option --model for ..."), so forward them untouched.
+const PI_SUBCOMMANDS = new Set([
+  "auth",
+  "install",
+  "remove",
+  "uninstall",
+  "update",
+  "list",
+  "config",
+]);
+
+// pi flags that consume the next argv token as their value (mirror of
+// parseArgs in pi's dist/cli/args.js, minus --provider/--model which are
+// handled explicitly above the generic loop).
+const VALUE_FLAGS = new Set([
+  "--mode",
+  "--api-key",
+  "--system-prompt",
+  "--append-system-prompt",
+  "--name",
+  "-n",
+  "--session",
+  "--session-id",
+  "--fork",
+  "--session-dir",
+  "--models",
+  "--tools",
+  "-t",
+  "--exclude-tools",
+  "-xt",
+  "--thinking",
+  "--export",
+  "--extension",
+  "-e",
+  "--skill",
+  "--prompt-template",
+  "--theme",
+]);
+
+/**
+ * Model defaults for plain `omnirush` runs. OMNIRUSH_MODEL overrides the
+ * default model (e.g. to pin a thinking level like "gpt-6-astra:high").
+ */
+export function resolveModelDefaults(env = process.env) {
+  return {
+    provider: DEFAULT_PROVIDER,
+    model: (env.OMNIRUSH_MODEL || "").trim() || DEFAULT_MODEL,
+  };
+}
+
+/**
+ * Prepend `--provider`/`--model` defaults for agent runs, without
+ * duplicating flags the user already specified. Consumption rules mirror
+ * pi's own parseArgs so a value token is never mistaken for a flag (e.g.
+ * `omnirush -p "how do I use --model flags"` must not suppress defaults).
+ *
+ * Admin subcommands (auth/install/...) and `--`-terminated positionals are
+ * respected: subcommands pass through untouched; scanning stops at `--`.
+ */
+export function withModelDefaults(args, defaults) {
+  const provider = defaults?.provider ?? DEFAULT_PROVIDER;
+  const model = defaults?.model ?? DEFAULT_MODEL;
+  if (args.length > 0 && PI_SUBCOMMANDS.has(args[0])) {
+    return [...args];
+  }
+  let hasProvider = false;
+  let hasModel = false;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--") break;
+    if (arg === "--provider") {
+      // pi only applies --provider/--model when a value token follows; a
+      // bare flag falls through to pi's unknown-flag handling, so it does
+      // not count as user-specified here either.
+      if (i + 1 < args.length) {
+        hasProvider = true;
+        i++; // pi consumes the next token unconditionally
+      }
+    } else if (arg === "--model") {
+      if (i + 1 < args.length) {
+        hasModel = true;
+        i++;
+      }
+    } else if (arg.startsWith("--provider=")) {
+      hasProvider = true;
+    } else if (arg.startsWith("--model=")) {
+      hasModel = true;
+    } else if (arg === "--print" || arg === "-p") {
+      const next = args[i + 1];
+      if (
+        next !== undefined &&
+        !next.startsWith("@") &&
+        (!next.startsWith("-") || next.startsWith("---"))
+      ) {
+        i++;
+      }
+    } else if (arg === "--list-models") {
+      const next = args[i + 1];
+      if (next !== undefined && !next.startsWith("-") && !next.startsWith("@")) i++;
+    } else if (arg === "--use-theme" || arg === "--tui-mode") {
+      const next = args[i + 1];
+      if (next !== undefined && !next.startsWith("-")) i++;
+    } else if (VALUE_FLAGS.has(arg)) {
+      if (i + 1 < args.length) i++;
+    } else if (arg.startsWith("--")) {
+      // Unknown long flag: pi consumes the next token as its value when it
+      // is not another flag or an @file.
+      const next = args[i + 1];
+      if (next !== undefined && !next.startsWith("-") && !next.startsWith("@")) i++;
+    }
+  }
+  const out = [];
+  if (!hasProvider) out.push("--provider", provider);
+  if (!hasModel) out.push("--model", model);
+  return [...out, ...args];
+}
+
+/**
+ * The provider/models.json payload omnirush installs into pi. This is the
+ * product's shipped model catalog: SOTA only (charter rule 1). The served
+ * model is forced server-side by the gateway; the client SOTA guard stays
+ * on as verification.
+ *
+ * Hard-won compat fact: the codex backend rejects
+ * `max_output_tokens`, so the model sets
+ * `compat.supportsMaxOutputTokens: false` and ships no maxTokens — pi would
+ * otherwise clamp a default and break every request.
+ */
+export function modelsConfig({ gatewayUrl } = {}) {
+  return {
+    providers: {
+      [DEFAULT_PROVIDER]: {
+        name: "Omnirush",
+        baseUrl: gatewayUrl ?? DEFAULT_GATEWAY_URL,
+        api: "openai-responses",
+        apiKey: "$OMNIRUSH_TOKEN",
+        models: [
+          {
+            id: DEFAULT_MODEL,
+            name: "GPT-6 Astra",
+            reasoning: true,
+            input: ["text", "image"],
+            cost: { input: 10, output: 50, cacheRead: 2.5, cacheWrite: 12.5 },
+            contextWindow: 400000,
+            compat: { supportsMaxOutputTokens: false },
+          },
+        ],
+      },
+    },
+  };
+}