pi-ollama-cloud 0.12.2 → 0.12.3

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.12.3] - 2026-10-06
+
+- Keep the usage indicator accurate when turning it off or switching providers, and show clearer errors for connection problems and invalid responses.
+- Hide unsupported reasoning controls on affected gpt-oss models and limit disk space used by web-tool caching.
+- Keep Ollama Cloud models compatible with Pi 1.0.
+- Allow model-limit updates to use the API key configured in Pi, with `OLLAMA_API_KEY` as a fallback.
+- Run the test suite successfully before publishing a release.
+
 ## [0.12.2] - 2026-09-27
 
 - Refresh the model catalog for the September 25, 2026 retirements (`deepseek-v4-flash:0731`, `glm-5.1`, `qwen3.5:397b`): dropped from the generated catalog and pricing, 20 -> 17 models. Recommended replacements per Ollama: `deepseek-v4.1-flash`, `glm-5.3`, and `glm-5.3-flash` / `deepseek-v4.1-flash`.

package/README.md

@@ -134,11 +134,11 @@ Model metadata is derived from the `/api/show` response:
 | `reasoning` | `capabilities` includes `"thinking"` |
 | `thinkingLevelMap` | [`thinking-levels.ts`](thinking-levels.ts) + [`reasoning.generated.ts`](reasoning.generated.ts) (models.dev reasoning options), with an `off` override table for models that ignore `none` |
 | `input` | `["text", "image"]` if `capabilities` includes `"vision"`, else `["text"]` |
-| `contextWindow` | `model_info.*.context_length` (falls back to 128000) |
-| `maxTokens` | Probed per-model limits from [`limits.generated.ts`](limits.generated.ts), generated by `scripts/generate-limits.ts` (requires `OLLAMA_API_KEY`). Models without a probed limit fall back to 32768. |
+| `contextWindow` | Positive integer `model_info.*.context_length` (falls back to 128000 when missing or invalid) |
+| `maxTokens` | Probed per-model limits from [`limits.generated.ts`](limits.generated.ts), generated by `scripts/generate-limits.ts` (reads the Ollama Cloud API key from Pi's `auth.json` or `OLLAMA_API_KEY`). Models without a probed limit fall back to 32768. |
 | `cost` | Official per-1M-token prices from the [ollama.com/pricing](https://ollama.com/pricing) model table, generated by `scripts/generate-pricing.ts` into `pricing.generated.ts`. Ollama Cloud is subscription-billed, so these are equivalent pay-as-you-go rates, not actual charges. Catalog IDs with no matching pricing row default to zero. Prices are pinned to the installed package version and only update on a new release, so newly added models register with zero cost until then. |
 
-The per-model max output token table (`limits.generated.ts`) is probed against the live API by `scripts/generate-limits.ts`, since `/api/show` does not expose the limit. It needs an API key: `OLLAMA_API_KEY=<key> npm run generate-limits`. Limits ship with the package, so regenerated values take effect on the next release.
+The per-model max output token table (`limits.generated.ts`) is probed against the live API by `scripts/generate-limits.ts`, since `/api/show` does not expose the limit. The script uses the `ollama-cloud` API key in Pi's `auth.json`, falling back to `OLLAMA_API_KEY`; run `npm run generate-limits` (optionally followed by a model ID to probe only that model). Limits ship with the package, so regenerated values take effect on the next release.
 
 The API itself returns no cost data: completion responses report only token counts (`prompt_tokens`/`completion_tokens`/`total_tokens`, including the final usage chunk when streaming), and `/api/show` exposes no pricing fields. The prices above come from the static `/pricing` page table and are only as fresh as the last regeneration.
 
@@ -167,7 +167,7 @@ Both tools cache results on disk (under the pi agent home, `~/.pi/agent/cache/pi
 
 - Successful searches and pages: cached for 24h
 - Failed page fetches: negative-cached for 15 min, so retrying a dead page does not re-call the API. Auth (401/403), rate-limit (429), transport (timeouts, aborts, network errors), and server (5xx) failures are not cached — fixing the key, waiting out the limit, or a transient blip lets a retry through immediately
-- Expired entries are pruned on write and the cache is capped at 500 entries per kind (searches/pages), evicting the oldest first. This bounds entry count, not file size: full page and search content can still make `cache.json` large, and loading it parses the whole file
+- Expired entries are pruned on write; the cache is capped at 500 entries per kind (searches/pages), 256 KiB per serialized entry (including its key), and 8 MiB for the complete serialized file. Oldest entries are evicted first to meet the limits. Oversized content remains available for the current call but is not persisted, so a later paging/expand request may fetch it again
 - The cache file is written with `0600` permissions. It stores full page content and raw URLs, which can embed credentials in query strings — avoid fetching URLs that carry secrets in the query string, or set a custom `PI_OLLAMA_SEARCH_CACHE_PATH`
 - Concurrent pi processes share the cache file on a last-writer-wins basis (no cross-process locking): one process's save can drop another's fresh entries, at the cost of a redundant API call
 - `refresh=true` on either tool bypasses the cache (including a cached failure) and re-calls the API; the fresh result replaces the cache entry
@@ -268,7 +268,7 @@ npm run check        # lint + format + type-check (auto-fix)
 npm run lint         # lint only (no fixes)
 npm run typecheck    # type-check only (tsgo --noEmit)
 npm run format       # format only
-OLLAMA_API_KEY=<key> npm run generate-limits   # probe max output tokens (writes limits.generated.ts)
+npm run generate-limits                         # probe max output tokens using auth.json or OLLAMA_API_KEY (writes limits.generated.ts)
 ```
 
 The project uses [Biome](https://biomejs.dev/) for linting and formatting (2-space indent, line width 120) and [tsgo](https://github.com/microsoft/typescript-go) for type-checking.
@@ -325,20 +325,24 @@ The `-e`/`--extension` flag loads the extension from the local checkout without
 
 ## Releasing
 
-Publishing a new version to npm is a two-command process:
+Publishing a new version to npm is a three-step process:
 
 ```bash
-# 1. Bump version and create a git tag in one step
+# 1. Commit and push main, then wait for the Test workflow to go green
+#    (gh run watch, or the Actions tab). CI must be green before tagging.
+# 2. Bump version and create a git tag in one step
 npm version minor   # or patch, or major
-# 2. Push the tag to trigger the GitHub Actions publish workflow
+# 3. Push the tag to trigger the GitHub Actions publish workflow
 git push --tags
 ```
 
+The publish workflow gates on CI: its `await-tests` job polls the check runs on the tagged commit and only proceeds if the Test workflow completed successfully on that exact commit (it fails closed after a timeout if the commit was never tested, e.g. a tag on a commit that is not on `main`).
+
 Because the model catalog refreshes automatically at runtime, a release is **not** needed to ship new models. Publish only when:
 
 - A model is retired and still listed by the API: add it to `RETIRED_MODEL_IDS` in `scripts/generate-models.ts` (check https://docs.ollama.com/cloud#retirements, then regenerate `models.generated.ts`).
 - Pricing changes: Ollama updates the model pricing table, or a new model needs a pricing row (regenerate `pricing.generated.ts`).
-- Max output token limits changed: run `OLLAMA_API_KEY=<key> npm run generate-limits` locally and commit.
+- Max output token limits changed: run `npm run generate-limits` locally (uses Pi's `auth.json` or `OLLAMA_API_KEY`) and commit.
 
 The tag version must match the version in `package.json` - `npm version` handles this automatically. The workflow at `.github/workflows/publish.yml` verifies the match before publishing to npm.
 

package/cache.ts

@@ -10,6 +10,10 @@ export const CACHE_TTL_MS = envInt("PI_OLLAMA_SEARCH_TTL_HOURS", 24) * 60 * 60 *
 export const FAIL_TTL_MS = envInt("PI_OLLAMA_SEARCH_FAIL_TTL_MINUTES", 15) * 60 * 1000;
 /** Max entries per map (searches/pages); oldest-ts entries are evicted beyond this. */
 export const MAX_ENTRIES = envInt("PI_OLLAMA_SEARCH_MAX_ENTRIES", 500);
+/** Maximum serialized UTF-8 size for one persisted entry, including its key. */
+export const MAX_PERSISTED_ENTRY_BYTES = 256 * 1024;
+/** Maximum serialized UTF-8 size of the complete persisted cache file. */
+export const MAX_CACHE_BYTES = 8 * 1024 * 1024;
 
 export interface SearchResult {
   title: string;
@@ -43,6 +47,8 @@ interface CacheOptions {
   ttlMs: number;
   failTtlMs: number;
   maxEntries: number;
+  maxPersistedEntryBytes: number;
+  maxCacheBytes: number;
 }
 
 function isRecord(v: unknown): v is Record<string, unknown> {
@@ -69,6 +75,14 @@ function isSearchEntry(v: unknown): v is SearchCacheEntry {
   );
 }
 
+function normalizeSearchEntry(entry: SearchCacheEntry): SearchCacheEntry {
+  return {
+    ts: entry.ts,
+    q: entry.q,
+    results: entry.results.map(({ title, url, content }) => ({ title, url, content })),
+  };
+}
+
 function isPageEntry(v: unknown): v is PageCacheEntry {
   if (!isRecord(v) || typeof v.ts !== "number") return false;
   const fieldsValid =
@@ -89,6 +103,17 @@ function isPageEntry(v: unknown): v is PageCacheEntry {
   );
 }
 
+function normalizePageEntry(entry: PageCacheEntry): PageCacheEntry {
+  const normalized: PageCacheEntry = { ts: entry.ts };
+  if (entry.status !== undefined) normalized.status = entry.status;
+  if (entry.title !== undefined) normalized.title = entry.title;
+  if (entry.content !== undefined) normalized.content = entry.content;
+  if (entry.links !== undefined) normalized.links = entry.links;
+  if (entry.error !== undefined) normalized.error = entry.error;
+  if (entry.errorType !== undefined) normalized.errorType = entry.errorType;
+  return normalized;
+}
+
 export interface CacheStore {
   loadCache(): CacheData;
   saveCache(): void;
@@ -100,6 +125,8 @@ export function createCache(options: Partial<CacheOptions> = {}): CacheStore {
   const ttlMs = options.ttlMs ?? CACHE_TTL_MS;
   const failTtlMs = options.failTtlMs ?? FAIL_TTL_MS;
   const maxEntries = options.maxEntries ?? MAX_ENTRIES;
+  const maxPersistedEntryBytes = options.maxPersistedEntryBytes ?? MAX_PERSISTED_ENTRY_BYTES;
+  const maxCacheBytes = options.maxCacheBytes ?? MAX_CACHE_BYTES;
   let cacheData: CacheData | null = null;
 
   function loadCache(): CacheData {
@@ -111,10 +138,10 @@ export function createCache(options: Partial<CacheOptions> = {}): CacheStore {
         // file degrades to "those entries are gone" instead of crashing calls.
         cacheData = { searches: {}, pages: {} };
         for (const [key, entry] of Object.entries(raw.searches)) {
-          if (isSafeKey(key) && isSearchEntry(entry)) cacheData.searches[key] = entry;
+          if (isSafeKey(key) && isSearchEntry(entry)) cacheData.searches[key] = normalizeSearchEntry(entry);
         }
         for (const [key, entry] of Object.entries(raw.pages)) {
-          if (isSafeKey(key) && isPageEntry(entry)) cacheData.pages[key] = entry;
+          if (isSafeKey(key) && isPageEntry(entry)) cacheData.pages[key] = normalizePageEntry(entry);
         }
         return cacheData;
       }
@@ -139,14 +166,66 @@ export function createCache(options: Partial<CacheOptions> = {}): CacheStore {
     for (const key of overflow) delete map[key];
   }
 
+  function serializedEntrySize(
+    key: string,
+    entry: SearchCacheEntry | PageCacheEntry,
+  ): {
+    entryBytes: number;
+    propertyBytes: number;
+  } {
+    // The one-property object includes the JSON-escaped cache key and braces.
+    // Removing only those two braces yields the exact property size in a map.
+    const onePropertyObject = JSON.stringify({ [key]: entry });
+    const entryBytes = Buffer.byteLength(onePropertyObject);
+    return { entryBytes, propertyBytes: entryBytes - 2 };
+  }
+
   function saveCache(): void {
     const data = loadCache();
     for (const [key, entry] of Object.entries(data.searches)) if (!isFresh(entry)) delete data.searches[key];
     for (const [key, entry] of Object.entries(data.pages)) if (!isFresh(entry)) delete data.pages[key];
-    // TTL bounds entry age; the cap bounds entry count so an aggressive session
-    // cannot grow the file without limit.
+    // Prune stale and over-count entries before applying serialized-byte limits.
     evictOldest(data.searches);
     evictOldest(data.pages);
+
+    const persistedData: CacheData = { searches: { ...data.searches }, pages: { ...data.pages } };
+    const searches = Object.entries(persistedData.searches).map(([key, entry]) => ({
+      ...serializedEntrySize(key, entry),
+      key,
+      entry,
+      map: persistedData.searches,
+    }));
+    const pages = Object.entries(persistedData.pages).map(([key, entry]) => ({
+      ...serializedEntrySize(key, entry),
+      key,
+      entry,
+      map: persistedData.pages,
+    }));
+    const entries = [...searches, ...pages];
+    for (const item of entries) {
+      if (item.entryBytes > maxPersistedEntryBytes) delete item.map[item.key];
+    }
+
+    function serializedCacheSize(): number {
+      let bytes = Buffer.byteLength('{"searches":{},"pages":{}}');
+      for (const mapEntries of [searches, pages]) {
+        const persistedEntries = mapEntries.filter((item) => item.map[item.key] !== undefined);
+        if (persistedEntries.length === 0) continue;
+        // The empty-map braces are already included in the base size.
+        bytes += persistedEntries.reduce((total, item) => total + item.propertyBytes, 0);
+        bytes += persistedEntries.length - 1;
+      }
+      return bytes;
+    }
+
+    let persistedBytes = serializedCacheSize();
+    const oldestFirst = entries.sort((a, b) => a.entry.ts - b.entry.ts);
+    for (const item of oldestFirst) {
+      if (persistedBytes <= maxCacheBytes) break;
+      if (item.map[item.key] === undefined) continue;
+      delete item.map[item.key];
+      persistedBytes = serializedCacheSize();
+    }
     try {
       mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
       // Use a unique temporary path so concurrent processes cannot overwrite
@@ -155,7 +234,7 @@ export function createCache(options: Partial<CacheOptions> = {}): CacheStore {
       try {
         // 0o600: the cache stores full page content and URLs, which can embed
         // credentials in query strings; it should not be world-readable.
-        writeFileSync(tmp, JSON.stringify(data), { mode: 0o600 });
+        writeFileSync(tmp, JSON.stringify(persistedData), { mode: 0o600 });
         renameSync(tmp, path);
         // Fix perms of a file written by a pre-0600 version.
         chmodSync(path, 0o600);

package/index.ts

@@ -32,10 +32,36 @@ import { fetchUsage, formatUsage, formatUsageStatusColored } from "./usage.ts";
 import { getCloudApiKey } from "./utils.ts";
 import { registerWebFetchTool, registerWebSearchTool } from "./web-tools.ts";
 
-/**
- * Resolve the new enabled state for /ollama-usage-status from its argument.
- * Exported for unit testing.
- */
+/** Guard usage-status refreshes against stale generations and duplicate triggers. */
+export function createUsageStatusRefreshGuard() {
+  let generation = 0;
+  let inFlightGeneration: number | undefined;
+
+  return {
+    invalidate() {
+      generation += 1;
+    },
+    async run(
+      isCurrent: () => boolean,
+      refresh: (stillCurrent: () => boolean) => Promise<string | undefined>,
+      setStatus: (text: string | undefined) => void,
+    ): Promise<void> {
+      if (inFlightGeneration === generation || !isCurrent()) return;
+      const requestGeneration = generation;
+      inFlightGeneration = requestGeneration;
+      try {
+        const text = await refresh(() => generation === requestGeneration && isCurrent());
+        if (generation === requestGeneration && isCurrent()) setStatus(text);
+      } catch {
+        if (generation === requestGeneration && isCurrent()) setStatus(undefined);
+      } finally {
+        if (inFlightGeneration === requestGeneration) inFlightGeneration = undefined;
+      }
+    },
+  };
+}
+
+/** Resolve the new enabled state for /ollama-usage-status from its argument. */
 export function resolveUsageStatusToggle(arg: string, current: boolean): { enabled: boolean; error?: string } {
   const a = arg.trim().toLowerCase();
   if (a === "on" || a === "enable") return { enabled: true };
@@ -161,26 +187,24 @@ export default async function (pi: ExtensionAPI) {
   const USAGE_REFRESH_MS = 5 * 60_000;
   let usageTimer: ReturnType<typeof setInterval> | null = null;
   let usageActive = false;
+  const usageRefreshGuard = createUsageStatusRefreshGuard();
   // Timestamp (ms) of the most recent refresh attempt; gates the agent_end
   // refresh so it fires at most once per cooldown. Set when a fetch starts, so
   // a failing endpoint is also throttled, not just a successful one.
   let lastRefreshAt = 0;
 
   async function refreshUsageStatus(ctx: ExtensionContext) {
-    try {
-      const apiKey = await getCloudApiKey(ctx);
-      if (!apiKey) {
-        ctx.ui.setStatus(USAGE_STATUS_KEY, undefined);
-        return;
-      }
-      lastRefreshAt = Date.now();
-      const data = await fetchUsage(apiKey);
-      ctx.ui.setStatus(USAGE_STATUS_KEY, formatUsageStatusColored(ctx.ui.theme, data));
-    } catch {
-      // Transient errors (undocumented endpoint, network) should not spam the
-      // footer; clear the status and retry on the next refresh.
-      ctx.ui.setStatus(USAGE_STATUS_KEY, undefined);
-    }
+    await usageRefreshGuard.run(
+      () => usageActive && isOllamaCloud(ctx),
+      async (stillCurrent) => {
+        const apiKey = await getCloudApiKey(ctx);
+        if (!stillCurrent() || !apiKey) return undefined;
+        lastRefreshAt = Date.now();
+        const data = await fetchUsage(apiKey);
+        return formatUsageStatusColored(ctx.ui.theme, data);
+      },
+      (text) => ctx.ui.setStatus(USAGE_STATUS_KEY, text),
+    );
   }
 
   function startUsageStatus(ctx: ExtensionContext) {
@@ -193,6 +217,7 @@ export default async function (pi: ExtensionAPI) {
   }
 
   function stopUsageStatus(ctx: ExtensionContext) {
+    usageRefreshGuard.invalidate();
     usageActive = false;
     if (usageTimer) {
       clearInterval(usageTimer);

package/limits.generated.ts

@@ -1,13 +1,11 @@
 // Auto-generated by scripts/generate-limits.ts
 // Do not edit manually.
-// Entries: 20
+// Entries: 17
 
 export const MODEL_MAX_OUTPUT_TOKENS: Record<string, number> = {
-  "deepseek-v4-flash:0731": 65536,
   "deepseek-v4-pro:0813": 65536,
   "deepseek-v4.1-flash": 393216,
   "gemma4:31b": 262144,
-  "glm-5.1": 131072,
   "glm-5.2": 131072,
   "glm-5.3": 524288,
   "glm-5.3-flash": 524288,
@@ -22,5 +20,4 @@ export const MODEL_MAX_OUTPUT_TOKENS: Record<string, number> = {
   "nemotron-3-nano:30b": 131072,
   "nemotron-3-super": 65536,
   "nemotron-3-ultra": 65536,
-  "qwen3.5:397b": 65536,
 };

package/models.generated.ts

@@ -3,9 +3,9 @@
 // Generated: 2026-09-27T00:52:07.773Z
 // Model count: 17
 
-import type { ProviderModelConfig } from "@earendil-works/pi-coding-agent";
+import type { ChatModelConfig } from "./models.ts";
 
-export const GENERATED_MODELS: ProviderModelConfig[] = [
+export const GENERATED_MODELS: ChatModelConfig[] = [
   {
     id: "deepseek-v4-pro:0813",
     name: "deepseek-v4-pro:0813",

package/models.ts

@@ -6,6 +6,11 @@ import { MODEL_PRICING, type ModelPrice } from "./pricing.generated.ts";
 import { resolve as resolveThinkingLevelMap } from "./thinking-levels.ts";
 import { concurrentMap, fetchJsonWithTimeout, getContextLength } from "./utils.ts";
 
+export type ChatModelConfig =
+  Extract<ProviderModelConfig, { type?: "chat" }> extends never
+    ? ProviderModelConfig
+    : Extract<ProviderModelConfig, { type?: "chat" }>;
+
 // --- Pricing ---
 // Per-1M-token prices are generated from the ollama.com/pricing model table by
 // scripts/generate-pricing.ts (see pricing.generated.ts, do not edit by hand).
@@ -66,17 +71,21 @@ export const OLLAMA_BASE = CLOUD_BASE_URL.replace(/\/+$/, "");
 // --- Raw API types ---
 /** Response from POST /api/show */
 interface OllamaShowResponse {
-  details: {
-    parent_model: string;
-    format: string;
-    family: string;
-    families: string[] | null;
-    parameter_size: string;
-    quantization_level: string;
-  };
-  model_info: Record<string, unknown>;
+  model_info?: Record<string, unknown> | null;
   capabilities: string[];
-  modified_at: string;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isOllamaShowResponse(value: unknown): value is OllamaShowResponse {
+  return (
+    isRecord(value) &&
+    (value.model_info === undefined || value.model_info === null || isRecord(value.model_info)) &&
+    Array.isArray(value.capabilities) &&
+    value.capabilities.every((capability) => typeof capability === "string")
+  );
 }
 
 // --- Assembly: raw API data -> ProviderModelConfig[] ---
@@ -89,7 +98,7 @@ interface OllamaShowResponse {
  * pi type definition: https://github.com/earendil-works/pi/blob/b94482762321ed0b9f8f245be57c84d786a7105d/packages/ai/src/types.ts#L361-L400
  * pi compat resolution:  https://docs.ollama.com/api/openai-compatibility https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/types.ts#L365-L425
  */
-function buildCompat(): ProviderModelConfig["compat"] {
+function buildCompat(): ChatModelConfig["compat"] {
   return {
     // Ollama uses "system" role, not "developer" (ollama: docs.ollama.com/api/openai-compatibility, pi: types.ts#supportsDeveloperRole).
     supportsDeveloperRole: false,
@@ -138,15 +147,21 @@ function buildCompat(): ProviderModelConfig["compat"] {
   };
 }
 
-export function assembleModels(raw: Record<string, OllamaShowResponse>): ProviderModelConfig[] {
+export function assembleModels(raw: Record<string, unknown>): ChatModelConfig[] {
   return Object.entries(raw)
-    .filter(([, data]) => data.capabilities?.includes("tools"))
+    .map(([id, data]) => {
+      if (!isOllamaShowResponse(data)) {
+        throw new Error(`Invalid /api/show response for ${id}: expected string capabilities and model_info object.`);
+      }
+      return [id, data] as const;
+    })
+    .filter(([, data]) => data.capabilities.includes("tools"))
     .map(([id, data]) => ({
       id,
       name: id,
-      reasoning: data.capabilities?.includes("thinking") ?? false,
-      thinkingLevelMap: resolveThinkingLevelMap(id, data.capabilities ?? []),
-      input: (data.capabilities?.includes("vision") ? ["text", "image"] : ["text"]) as ("text" | "image")[],
+      reasoning: data.capabilities.includes("thinking"),
+      thinkingLevelMap: resolveThinkingLevelMap(id, data.capabilities),
+      input: (data.capabilities.includes("vision") ? ["text", "image"] : ["text"]) as ("text" | "image")[],
       cost: resolvePrice(id),
       contextWindow: getContextLength(data.model_info ?? {}),
       maxTokens: resolveMaxTokens(id),
@@ -162,21 +177,30 @@ export async function fetchModelIds(signal?: AbortSignal, timeoutMs = FETCH_TIME
     headers.Authorization = `Bearer ${apiKey}`;
   }
 
-  const res = await fetchJsonWithTimeout<{ data: { id: string }[] }>(
-    `${OLLAMA_BASE}/v1/models`,
-    { headers },
-    timeoutMs,
-    signal,
-  );
+  const res = await fetchJsonWithTimeout<unknown>(`${OLLAMA_BASE}/v1/models`, { headers }, timeoutMs, signal);
 
   if (res.status === 429) {
     throw new Error("Ollama Cloud model list fetch rate limited. Try again shortly.");
   }
-  if (!res.ok || !res.data) {
+  if (!res.ok) {
+    if (res.status === 0) {
+      throw new Error(
+        `Ollama Cloud model list fetch failed: transport error (${res.error ?? "unknown"}). Try again shortly.`,
+      );
+    }
     throw new Error(`Failed to fetch model list: ${res.status}${res.error ? ` - ${res.error}` : ""}`);
   }
-
-  return res.data.data.map((m) => m.id);
+  if (!isRecord(res.data) || !Array.isArray(res.data.data)) {
+    throw new Error("Failed to fetch model list: unexpected response shape (expected a data array).");
+  }
+  const ids: string[] = [];
+  for (const [index, model] of res.data.data.entries()) {
+    if (!isRecord(model) || typeof model.id !== "string" || model.id.trim() !== model.id || model.id === "") {
+      throw new Error(`Failed to fetch model list: invalid model ID at data[${index}].`);
+    }
+    ids.push(model.id);
+  }
+  return ids;
 }
 
 export async function fetchModelDetails(
@@ -190,7 +214,7 @@ export async function fetchModelDetails(
     headers.Authorization = `Bearer ${apiKey}`;
   }
 
-  const res = await fetchJsonWithTimeout<OllamaShowResponse>(
+  const res = await fetchJsonWithTimeout<unknown>(
     `${OLLAMA_BASE}/api/show`,
     {
       method: "POST",
@@ -204,10 +228,19 @@ export async function fetchModelDetails(
   if (res.status === 429) {
     throw new Error("Ollama Cloud /api/show rate limited. Try again shortly.");
   }
-  if (!res.ok || !res.data) {
+  if (!res.ok) {
+    if (res.status === 0) {
+      throw new Error(
+        `Ollama Cloud /api/show for ${id} failed: transport error (${res.error ?? "unknown"}). Try again shortly.`,
+      );
+    }
     throw new Error(`Failed to fetch /api/show for ${id}: ${res.status}${res.error ? ` - ${res.error}` : ""}`);
   }
-
+  if (!isOllamaShowResponse(res.data)) {
+    throw new Error(
+      `Failed to fetch /api/show for ${id}: unexpected response shape (expected string capabilities and model_info object).`,
+    );
+  }
   return res.data;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-ollama-cloud",
-  "version": "0.12.2",
+  "version": "0.12.3",
   "type": "module",
   "keywords": [
     "pi-package"

package/thinking-levels.ts

@@ -33,7 +33,12 @@
 import type { ProviderModelConfig } from "@earendil-works/pi-coding-agent";
 import { MODEL_REASONING_OPTIONS, type ModelsDevReasoningOption } from "./reasoning.generated.ts";
 
-export type ThinkingLevelMap = NonNullable<ProviderModelConfig["thinkingLevelMap"]>;
+type ChatModelConfig =
+  Extract<ProviderModelConfig, { type?: "chat" }> extends never
+    ? ProviderModelConfig
+    : Extract<ProviderModelConfig, { type?: "chat" }>;
+
+export type ThinkingLevelMap = NonNullable<ChatModelConfig["thinkingLevelMap"]>;
 
 /** Default: off/low/medium/high/xhigh with minimal hidden. */
 export const DEFAULT: ThinkingLevelMap = {
@@ -70,6 +75,10 @@ function hidesOff(id: string): boolean {
   return OFF_NULL_EXACT.has(id) || OFF_NULL_FAMILIES.some((prefix) => id.startsWith(prefix));
 }
 
+function applyOffRestriction(id: string, map: ThinkingLevelMap): ThinkingLevelMap {
+  return hidesOff(id) ? { ...map, off: null } : map;
+}
+
 /**
  * Map a models.dev `effort` value onto the Pi level key and the reasoning_effort
  * string to send for it. Ollama's top effort value is "max"; Pi exposes it via
@@ -140,6 +149,6 @@ export function resolve(id: string, capabilities: string[]): ThinkingLevelMap |
   // An empty array (e.g. minimax-m2.5) carries no verified options; fall back
   // to DEFAULT rather than a degenerate map whose only selectable level can
   // be a leaking off.
-  if (options === undefined || options.length === 0) return DEFAULT;
+  if (options === undefined || options.length === 0) return applyOffRestriction(id, DEFAULT);
   return buildMap(options, matchedKey);
 }

package/usage.ts

@@ -114,6 +114,9 @@ export async function fetchUsage(apiKey: string, externalSignal?: AbortSignal):
   );
 
   if (!res.ok) {
+    if (res.status === 0) {
+      throw new Error(`Ollama Cloud usage failed: transport error (${res.error ?? "unknown"}). Try again shortly.`);
+    }
     // The 404 case is specific to this undocumented endpoint: it may have
     // changed or disappeared, so surface that distinctly before the shared
     // status mapping.

package/utils.ts

@@ -71,7 +71,7 @@ export async function concurrentMap<T, R>(
 
 export function getContextLength(modelInfo: Record<string, unknown>): number {
   for (const [key, value] of Object.entries(modelInfo)) {
-    if (key.endsWith(".context_length") && typeof value === "number") {
+    if (key.endsWith(".context_length") && typeof value === "number" && Number.isInteger(value) && value > 0) {
       return value;
     }
   }
@@ -96,6 +96,9 @@ export async function getCloudApiKey(ctx: Pick<ExtensionContext, "modelRegistry"
  * distinct status codes. Shared by the web tools and the usage command.
  */
 export function httpError(op: string, status: number, error?: string): never {
+  if (status === 0) {
+    throw new Error(`Ollama Cloud ${op} failed: transport error (${error ?? "unknown"}). Try again shortly.`);
+  }
   if (status === 401 || status === 403) {
     throw new Error(
       `Ollama Cloud ${op} failed: authentication error. Check your API key in OLLAMA_API_KEY or auth.json.`,

package/web-tools.ts

@@ -137,7 +137,15 @@ export function isSearchResponse(data: unknown): data is SearchResponse {
   const results = (data as SearchResponse).results;
   return (
     Array.isArray(results) &&
-    results.every((r) => typeof r.title === "string" && typeof r.url === "string" && typeof r.content === "string")
+    results.every(
+      (result) =>
+        typeof result === "object" &&
+        result !== null &&
+        !Array.isArray(result) &&
+        typeof result.title === "string" &&
+        typeof result.url === "string" &&
+        typeof result.content === "string",
+    )
   );
 }
 
@@ -176,6 +184,11 @@ function fetchFailureMessage(
     );
   } else if (entry.status === 429) {
     lines.push("Likely cause: rate limited.", "Suggestion: try again shortly (rate-limit failures are not cached).");
+  } else if (entry.status === 0) {
+    lines.push(
+      "Likely cause: a transport error (timeout, cancellation, or network failure).",
+      "Suggestion: try again shortly; transport failures are not cached.",
+    );
   } else if (entry.errorType === "response-shape") {
     lines.push(
       "Likely cause: Ollama Cloud returned an unexpected response shape.",
@@ -403,7 +416,14 @@ export function registerWebFetchTool(pi: ExtensionAPI, cacheStore: CacheStore =
         );
 
         if (!res.ok) {
-          entry = { ts: Date.now(), status: res.status, error: `HTTP ${res.status}: ${res.error ?? "unknown error"}` };
+          entry = {
+            ts: Date.now(),
+            status: res.status,
+            error:
+              res.status === 0
+                ? `Transport error: ${res.error ?? "unknown error"}`
+                : `HTTP ${res.status}: ${res.error ?? "unknown error"}`,
+          };
           // Auth, rate-limit, transport (status 0: timeout, abort, DNS/connection
           // errors), and server (5xx) failures are not negative-cached: a fixed
           // key, an expired rate-limit window, or a transient server/network