pi-orchestrator-config 4.8.2 → 4.8.4

package/extensions/pidiff/pidiff-ui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pidiff-ui",
   "private": true,
-  "version": "4.8.2",
+  "version": "4.8.4",
   "type": "module",
   "scripts": {
     "dev": "vite",

package/extensions/shared/create-runtime-provider.ts

@@ -7,6 +7,12 @@
  */
 
 import { createLogger } from "./logger.js";
+import {
+  isPricingKnown,
+  isPricingUnknown,
+  markPricingKnown,
+  markPricingUnknown,
+} from "./pricing-provenance.js";
 
 import type {
   Api,
@@ -29,6 +35,9 @@ export const AMBIENT_AUTH_KEY = "ambient"; // pragma: allowlist secret
 
 export const DEFAULT_RUNTIME_BASE_URL = "https://localhost";
 
+/** Pricing classification for models built here (never logs prices). */
+const pricingLog = createLogger("runtime-model-pricing");
+
 export interface BuildRuntimeModelOptions {
   id: string;
   name: string;
@@ -45,7 +54,7 @@ export interface BuildRuntimeModelOptions {
 
 /** Build a full Model with api/provider/baseUrl required by createProvider. */
 export function buildRuntimeModel(opts: BuildRuntimeModelOptions): Model<Api> {
-  return {
+  const model: Model<Api> = {
     id: opts.id,
     name: opts.name,
     api: opts.api,
@@ -58,6 +67,17 @@ export function buildRuntimeModel(opts: BuildRuntimeModelOptions): Model<Api> {
     contextWindow: opts.contextWindow ?? 200_000,
     maxTokens: opts.maxTokens ?? 32_768,
   };
+  // A supplied cost came from a source that published prices, so its zeros are
+  // authoritative (a free models.dev entry stays free). A default cost is Pi's
+  // numeric placeholder for "this source published no price", which is unknown.
+  // A marker already on the options (models.dev priced nothing) carries through.
+  const placeholder = !opts.cost;
+  if (placeholder || isPricingUnknown(opts)) {
+    pricingLog.debug("Runtime model has no published prices", { unknown: true });
+    return markPricingUnknown(model);
+  }
+  pricingLog.debug("Runtime model carries source-published prices", { unknown: false });
+  return isPricingKnown(opts) || opts.cost ? markPricingKnown(model) : model;
 }
 
 export interface AmbientLoginAuthOptions {

package/extensions/shared/models-dev.ts

@@ -13,6 +13,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { createLogger } from "./logger.js";
 import type { BuildRuntimeModelOptions } from "./create-runtime-provider.js";
+import { classifyCostRecord, markPricingKnown, markPricingUnknown, priceOrFallback, safeModelRef } from "./pricing-provenance.js";
 
 const log = createLogger("models-dev");
 
@@ -404,12 +405,24 @@ export function fillRuntimeModelFromCatalog(
   }
 
   if (next.cost == null && entry?.cost) {
+    // Normalize with the same validator the provenance decision uses, so an invalid
+    // component can never pass through as a price and a zero-filled placeholder is
+    // never mistaken for a published zero.
     next.cost = {
-      input: entry.cost.input ?? 0,
-      output: entry.cost.output ?? 0,
-      cacheRead: entry.cost.cache_read ?? 0,
-      cacheWrite: entry.cost.cache_write ?? 0,
+      input: priceOrFallback(entry.cost.input, 0),
+      output: priceOrFallback(entry.cost.output, 0),
+      cacheRead: priceOrFallback(entry.cost.cache_read, 0),
+      cacheWrite: priceOrFallback(entry.cost.cache_write, 0),
     };
+    // models.dev is a real price source, so its prices are authoritative when every
+    // supplied component is valid — zeros included, which makes a genuinely free
+    // CLI/ACPX model free. A record mixing a valid price with an invalid one is
+    // malformed, so the model stays unknown-priced rather than inheriting a zero.
+    if (classifyCostRecord(entry.cost, ["input", "output", "cache_read", "cache_write"], { source: "models.dev", agent, model: safeModelRef(discoveredId) }) === "known") {
+      markPricingKnown(next);
+    } else {
+      markPricingUnknown(next);
+    }
   }
 
   if (next.input == null) {

package/extensions/shared/openai-compatible-discovery.ts

@@ -5,6 +5,14 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import type { Api, Model, ProviderHeaders } from "@earendil-works/pi-ai";
 import { createLogger } from "./logger.js";
+import {
+  classifyCostRecord,
+  isPricingUnknown,
+  markPricingKnown,
+  markPricingUnknown,
+  priceOrFallback,
+  safeModelRef,
+} from "./pricing-provenance.js";
 
 const log = createLogger("openai-compatible-discovery");
 
@@ -48,10 +56,6 @@ const PI_STATIC_MODEL_DEFAULTS = {
   maxTokens: 16_384,
 } as const;
 
-function finiteNumber(value: unknown, fallback: number): number {
-  return typeof value === "number" && Number.isFinite(value) ? value : fallback;
-}
-
 function positiveFiniteNumber(value: unknown, fallback: number): number {
   return typeof value === "number" && Number.isFinite(value) && value > 0
     ? value
@@ -69,16 +73,24 @@ function materializeInput(value: unknown): ("text" | "image")[] {
   return ["text", "image"];
 }
 
-function materializeCost(value: unknown): Model<Api>["cost"] {
+function materializeCost(value: unknown, context?: Record<string, unknown>): Model<Api>["cost"] {
   const source = value && typeof value === "object" && !Array.isArray(value)
     ? value as Record<string, unknown>
     : {};
-  return {
-    input: finiteNumber(source.input, PI_STATIC_MODEL_DEFAULTS.cost.input),
-    output: finiteNumber(source.output, PI_STATIC_MODEL_DEFAULTS.cost.output),
-    cacheRead: finiteNumber(source.cacheRead, PI_STATIC_MODEL_DEFAULTS.cost.cacheRead),
-    cacheWrite: finiteNumber(source.cacheWrite, PI_STATIC_MODEL_DEFAULTS.cost.cacheWrite),
+  // Invalid components (non-finite, negative) become the placeholder zero, which
+  // keeps the materialized cost consistent with classifyCostRecord()'s decision:
+  // a record priced only with invalid values contributes no valid price and is
+  // therefore marked unknown-priced. A record with at least one valid component
+  // published its prices, so its zeros are authoritative even though the model
+  // is absent from pi-ai's generated catalog.
+  const cost = {
+    input: priceOrFallback(source.input, PI_STATIC_MODEL_DEFAULTS.cost.input),
+    output: priceOrFallback(source.output, PI_STATIC_MODEL_DEFAULTS.cost.output),
+    cacheRead: priceOrFallback(source.cacheRead, PI_STATIC_MODEL_DEFAULTS.cost.cacheRead),
+    cacheWrite: priceOrFallback(source.cacheWrite, PI_STATIC_MODEL_DEFAULTS.cost.cacheWrite),
   };
+  log.debug("Materialized discovery cost", { components: Object.keys(cost).length, priced: classifyCostRecord(source, ["input", "output", "cacheRead", "cacheWrite"], context) === "known", ...context });
+  return cost;
 }
 export interface CachedOpenAiCompatibleDiscovery<T> {
   models: readonly T[];
@@ -509,7 +521,7 @@ export function materializeOpenAiCompatibleModels(
   for (const record of records) {
     if (typeof record.id !== "string" || seenIds.has(record.id)) continue;
     seenIds.add(record.id);
-    models.push({
+    const model: Model<Api> = {
       id: record.id,
       name: typeof record.name === "string" ? record.name : record.id,
       api: "openai-completions",
@@ -519,7 +531,7 @@ export function materializeOpenAiCompatibleModels(
         ? record.reasoning
         : PI_STATIC_MODEL_DEFAULTS.reasoning,
       input: materializeInput(record.input),
-      cost: materializeCost(record.cost),
+      cost: materializeCost(record.cost, { provider: providerId, model: safeModelRef(record.id) }),
       // Native Pi metadata wins. OpenAI-compatible capability APIs may expose
       // generic input/output capacities, whose sum is Pi's context window.
       contextWindow: positiveFiniteNumber(
@@ -535,7 +547,18 @@ export function materializeOpenAiCompatibleModels(
         record.maxTokens,
         positiveFiniteNumber(record.max_output_tokens, PI_STATIC_MODEL_DEFAULTS.maxTokens),
       ),
-    });
+    };
+    // A record whose every supplied component is valid published real prices —
+    // zeros included — which pi-ai's catalog cannot vouch for, since these models
+    // are absent from it, so that provenance is marked explicitly. A record with no
+    // valid component, or one mixing a valid price with an invalid one, is a
+    // placeholder or malformed and stays unknown-priced.
+    if (classifyCostRecord(record.cost, ["input", "output", "cacheRead", "cacheWrite"], { source: "openai-compatible", provider: providerId, model: safeModelRef(record.id) }) === "known") {
+      markPricingKnown(model);
+    } else {
+      markPricingUnknown(model);
+    }
+    models.push(model);
   }
   return models;
 }

package/extensions/shared/pricing-provenance.ts

@@ -0,0 +1,145 @@
+/**
+ * Pricing provenance marker.
+ *
+ * Pi requires numeric prices, so a model whose source supplied none is registered
+ * with zeros — and those zeros mean *unknown*, not *free*. A catalog all-zero cost
+ * means the opposite: the price is known to be zero (an OpenRouter `:free`
+ * variant, for example). The number alone cannot tell the two apart, so every
+ * site that fabricates a placeholder cost marks the model and consumers read the
+ * marker instead of guessing from the value.
+ *
+ * Shared with packages/pi-sidecar through the global symbol registry: the sidecar
+ * cannot import extensions/shared (separate tsconfig rootDir). Same pattern as
+ * Symbol.for("pi-config.ambientLoginAuth") and the session-cwd ALS.
+ */
+import { createHash } from "node:crypto";
+import { createLogger } from "./logger.js";
+
+const log = createLogger("pricing-provenance");
+
+export const PRICING_UNKNOWN = Symbol.for("pi-config.pricingUnknown");
+
+/**
+ * Counterpart marker for sources that *did* publish prices, zeros included.
+ *
+ * A models.dev entry or an OpenAI-compatible `/v1/models` record that states a
+ * zero price is authoritative even though the model is absent from pi-ai's
+ * generated catalog. Without this marker the sidecar cannot tell that explicit
+ * zero from Pi's own zero-filled placeholder, and would report a genuinely free
+ * call as unknown spend.
+ */
+export const PRICING_KNOWN = Symbol.for("pi-config.pricingKnown");
+
+/**
+ * Mark a model whose prices were defaulted rather than supplied by its source.
+ *
+ * Enumerable on purpose: symbol keys stay out of Object.keys and JSON, but they
+ * do survive object spread, so a model copied downstream keeps its provenance.
+ */
+export function markPricingUnknown<T extends object>(model: T): T {
+  (model as Record<symbol, unknown>)[PRICING_UNKNOWN] = true;
+  // Never log the model or its prices — only the decision.
+  log.debug("Marked model pricing as unknown", { marked: true });
+  return model;
+}
+
+/** Whether a model was marked as having unknown (not zero) prices. */
+export function isPricingUnknown(model: unknown): boolean {
+  const unknown = !!model && typeof model === "object" && Reflect.get(model, PRICING_UNKNOWN) === true;
+  log.debug("Read model pricing provenance", { unknown });
+  return unknown;
+}
+
+/**
+ * Mark a model whose prices came from a source that published them — including
+ * authoritative zeros. Unknown wins if both markers are somehow present.
+ */
+export function markPricingKnown<T extends object>(model: T): T {
+  (model as Record<symbol, unknown>)[PRICING_KNOWN] = true;
+  log.debug("Marked model pricing as source-published", { marked: true });
+  return model;
+}
+
+/** Whether a source published this model's prices (zeros included). */
+export function isPricingKnown(model: unknown): boolean {
+  const known = !!model && typeof model === "object" && Reflect.get(model, PRICING_KNOWN) === true;
+  log.debug("Read source-published pricing provenance", { known });
+  return known;
+}
+
+/**
+ * A price is authoritative only when it is a finite, non-negative number. NaN,
+ * Infinity, and negatives describe a broken source, not a price — treating them
+ * as prices would classify an invalid quote as a known (possibly free) one.
+ */
+export function isValidPrice(value: unknown): value is number {
+  const valid = typeof value === "number" && Number.isFinite(value) && value >= 0;
+  if (!valid) log.debug("Rejected price component as invalid", { type: typeof value });
+  return valid;
+}
+
+/** Normalize one price component, falling back when the source value is invalid. */
+export function priceOrFallback(value: unknown, fallback: number): number {
+  const price = isValidPrice(value) ? value : fallback;
+  log.debug("Normalized price component", { valid: price === value });
+  return price;
+}
+
+/**
+ * Non-reversible reference for an externally supplied model id.
+ *
+ * A `/v1/models` response can echo a configured credential inside an id (the
+ * sidecar's own listing path filters exactly that case), so ids arriving from an
+ * external source are never logged verbatim. The digest still identifies which
+ * record a pricing decision came from, without exposing the value.
+ */
+export function safeModelRef(id: unknown): string {
+  const text = typeof id === "string" ? id : String(id ?? "");
+  const ref = `model#${createHash("sha256").update(text).digest("hex").slice(0, 12)}`;
+  log.debug("Derived model reference for logging", { ref });
+  return ref;
+}
+
+/**
+ * Whether a value is a usable cost record.
+ *
+ * `operation` and `context` exist so a malformed or absent price can be traced to
+ * the classification that rejected it: which pricing source, which model, and
+ * which field set. Only non-sensitive identifiers belong in `context` — never
+ * price values or credentials, and pass externally supplied ids through
+ * `safeModelRef()` rather than verbatim.
+ */
+function asRecord(value: unknown, operation: string, context?: Record<string, unknown>): Record<string, unknown> | undefined {
+  const record = value && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : undefined;
+  log.debug("Checked cost record shape", { operation, usable: !!record, ...context });
+  return record;
+}
+
+/**
+ * Classify a raw cost record's provenance: did this source publish prices we can
+ * trust, zeros included?
+ *
+ * "known" requires *every supplied* component to be a valid price and at least one
+ * of them to be present. An absent or undefined key is ignored — the source never
+ * claimed it — but an explicit `null` counts as supplied-and-invalid, because
+ * `priceOrFallback()` normalizes it to a placeholder zero just like a negative or
+ * non-numeric value. A record mixing a valid zero with an invalid component is
+ * therefore malformed, and the model must stay unknown-priced rather than
+ * reporting a driver's placeholder zero as a complete $0.
+ *
+ * `context` carries non-sensitive identifiers (pricing source, provider, model)
+ * so the decision can be traced from the log.
+ */
+export function classifyCostRecord(cost: unknown, keys: readonly string[], context?: Record<string, unknown>): "known" | "unknown" {
+  const entry = asRecord(cost, "classify-cost-record", context);
+  // Only absent (undefined) keys are skipped; an explicit null is a supplied
+  // component that failed validation.
+  const supplied = entry ? keys.filter((key) => entry[key] !== undefined) : [];
+  const priced = supplied.some((key) => isValidPrice(entry![key]));
+  const allValid = supplied.length > 0 && supplied.every((key) => isValidPrice(entry![key]));
+  const verdict = priced && allValid ? "known" : "unknown";
+  log.debug("Classified cost record provenance", { verdict, supplied: supplied.length, priced, allValid, fields: keys.length, ...context });
+  return verdict;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-orchestrator-config",
-  "version": "4.8.2",
+  "version": "4.8.4",
   "description": "Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands",
   "keywords": [
     "pi-package"