pi-zro-provider 1.3.27 → 1.3.29

package/.github/workflows/publish.yml

@@ -0,0 +1,114 @@
+name: Publish
+
+# Releases of pi-zro-provider go out from here, and only from here.
+#
+#   1. Bump "version" in package.json (the `chore(release): X.Y.Z` commit).
+#   2. Push it to main. This workflow publishes every version that npm does
+#      not have yet; any other push is a no-op.
+#
+# Run it from the Actions tab to retry a failed release, or tick "dry_run" to
+# build, check and pack without publishing.
+#
+# Auth is npm Trusted Publishing (OIDC): npm trusts this file, so no npm token
+# is stored anywhere. Registered once with
+#   npm trust github pi-zro-provider --repo monotykamary/pi-zro-provider --file publish.yml --allow-publish
+#
+# Bun installs and packs exactly as `bun publish` does; npm uploads the
+# tarballs because only the npm CLI speaks trusted publishing.
+
+on:
+  push:
+    branches: [main]
+    paths: [package.json]
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Build, check and pack, but do not publish
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: publish
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Find versions npm does not have
+        id: release
+        env:
+          DRY_RUN: ${{ inputs.dry_run }}
+        run: |
+          specs=$(
+          node -p "const p = require('./package.json'); p.name + '@' + p.version"
+          )
+          missing=""
+          for spec in $specs; do
+            # npm runs from outside the checkout so the repo's devEngines do not apply.
+            if (cd "$RUNNER_TEMP" && npm view "$spec" version >/dev/null 2>&1); then
+              echo "$spec is already on npm"
+            else
+              missing="$missing $spec"
+            fi
+          done
+          if [ "$DRY_RUN" = "true" ]; then
+            mode=dry-run
+          elif [ -n "$missing" ]; then
+            mode=publish
+            echo "::notice::Publishing$missing"
+          else
+            mode=skip
+            echo "::notice::Nothing to publish"
+          fi
+          echo "mode=$mode" >> "$GITHUB_OUTPUT"
+
+      - name: Install dependencies
+        if: steps.release.outputs.mode != 'skip'
+        run: bun install --frozen-lockfile
+
+      - name: Check
+        if: steps.release.outputs.mode != 'skip'
+        run: bun run check
+
+      - name: Pack
+        if: steps.release.outputs.mode != 'skip'
+        run: |
+          bun run --if-present prepublishOnly
+          bun pm pack --destination "$RUNNER_TEMP/pack"
+
+      - name: Publish
+        if: steps.release.outputs.mode != 'skip'
+        env:
+          MODE: ${{ steps.release.outputs.mode }}
+        run: |
+          # Trusted publishing needs npm 11.5.1 or newer.
+          npm install --global npm@latest
+          cd "$RUNNER_TEMP"
+          # ./ keeps npm from reading pack/name.tgz as a GitHub repo shorthand.
+          for tarball in ./pack/*.tgz; do
+            spec=$(tar -xOzf "$tarball" package/package.json | node -p "const p = JSON.parse(require('fs').readFileSync(0, 'utf8')); p.name + '@' + p.version")
+            echo "::group::$spec"
+            tar -tzf "$tarball"
+            echo "::endgroup::"
+            if [ "$MODE" = "dry-run" ]; then
+              echo "Dry run: not publishing $spec"
+            elif npm view "$spec" version >/dev/null 2>&1; then
+              echo "$spec is already on npm"
+            else
+              npm publish "$tarball" --access public --provenance
+            fi
+          done

package/.github/workflows/update-models.yml

@@ -5,12 +5,12 @@ on:
     - cron: "7 0 * * *" # 07:07 Asia/Ho_Chi_Minh
   workflow_dispatch:
 
-# Publishing uses npm Trusted Publishing (OIDC) bound to this workflow file, so
-# no npm token is stored. A version pushed while publishing was unavailable is
-# published by the next run that finds it missing from npm.
+# This workflow only syncs the catalog and bumps the version; publish.yml does
+# the releasing. It publishes any version npm does not have yet, so a release
+# that failed earlier goes out with the next hand-off.
 permissions:
   contents: write
-  id-token: write
+  actions: write
 
 concurrency:
   group: update-models
@@ -47,14 +47,9 @@ jobs:
           git commit -am "chore(release): v$version"
           git push origin HEAD:main
 
-      - name: Publish to npm if this version is missing
-        run: |
-          name=$(node -p "require('./package.json').name")
-          version=$(node -p "require('./package.json').version")
-          if npm view "$name@$version" version >/dev/null 2>&1; then
-            echo "$name@$version is already on npm."
-            exit 0
-          fi
-          # Trusted publishing needs npm 11.5.1 or newer.
-          npm install --global npm@latest
-          npm publish --access public --provenance
+      # Pushes made with GITHUB_TOKEN do not start other workflows, so hand the
+      # release to publish.yml explicitly.
+      - name: Hand off to publish.yml
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh workflow run publish.yml --ref main

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.3.28
+
+- Pin Pi SDK development dependencies to 1.3.0 while retaining wildcard host peers; verify real manifest loading, lifecycle and native/bundled Pi hosts offline.
+
 ## 1.3.27
 
 - Pin Pi SDK development dependencies to 1.2.0 while retaining wildcard host peers; verify real manifest loading, lifecycle and native/bundled Pi hosts offline.

package/README.md

@@ -15,7 +15,7 @@ _GLM-5.2, Kimi K3, and DeepSeek V4 / V4.1 Flash — run through the Zro inferenc
 
 ## Features
 
-- **6+ AI Models** — GLM-5.2 (default), Kimi K3, DeepSeek V4 Flash, and DeepSeek V4.1 Flash, straight from Zro's production catalog
+- **7+ AI Models** — GLM-5.2 (default), Kimi K3, DeepSeek V4 Flash, and DeepSeek V4.1 Flash, straight from Zro's production catalog
 - **Native reasoning effort** — every model ships an endpoint-verified `piLevel` → level-id map (`glm-5.2`, `glm-5.3-flash`, `deepseek-v4-flash-0731`: full `off`–`max` ladder; `deepseek-v4.1-flash`: `low`/`high`/`max` — catalog has no `none`, and `xhigh`/`max` both send `max`; `kimi-k3`: `low`/`high`/`max` — the proxy rejects `medium` there), so `/thinking low` etc. maps exactly to what the Zro proxy accepts. Quirks: `glm-5.3-flash` silently disables thinking at `low`, so `minimal`/`low` map to `minimal`; `glm-5.3` mirrors flash's full ladder — Z.ai officially removed `none` for the 5.3 family, but the proxy accepts it and streams cleanly (occasionally a short chain-of-thought preamble surfaces in `content` before the answer), and `xhigh`/`max` both send `max`
 - **OpenAI-compatible API** at `https://zro.moonmath.ai/v1`
 - **Official catalog sync** from Zro's `/api/cli/models` endpoint — same one `zro models` uses
@@ -30,6 +30,7 @@ _GLM-5.2, Kimi K3, and DeepSeek V4 / V4.1 Flash — run through the Zro inferenc
 | Auto | Text | 1.0M | 131K | — | — |
 | DeepSeek V4.1 Flash | Text + Image | 1.0M | 384K | $0.14 | $0.28 |
 | Dolly 1 Security | Text | 1.0M | 64K | — | — |
+| Dolly 2 Security | Text | 1.0M | 131K | — | — |
 | GLM-5.3 | Text | 1.0M | 131K | $1.40 | $4.40 |
 | GLM-5.3 Flash | Text + Image | 1.0M | 64K | $0.15 | $0.50 |
 | Kimi K3 | Text + Image | 1.0M | 131K | $2.50 | $12.00 |

package/models.json

@@ -86,6 +86,35 @@
       "maxTokensField": "max_tokens"
     }
   },
+  {
+    "id": "dolly2-security",
+    "name": "Dolly 2 Security",
+    "reasoning": true,
+    "thinkingLevelMap": {
+      "off": null,
+      "minimal": null,
+      "low": "low",
+      "medium": null,
+      "high": "high",
+      "xhigh": "max"
+    },
+    "input": [
+      "text"
+    ],
+    "cost": {
+      "input": 0,
+      "output": 0,
+      "cacheRead": 0,
+      "cacheWrite": 0
+    },
+    "contextWindow": 1048576,
+    "maxTokens": 131000,
+    "compat": {
+      "supportsDeveloperRole": false,
+      "supportsReasoningEffort": true,
+      "maxTokensField": "max_tokens"
+    }
+  },
   {
     "id": "glm-5.3",
     "name": "GLM-5.3",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-zro-provider",
-  "version": "1.3.27",
+  "version": "1.3.29",
   "description": "Zro provider extension for pi - GLM-5.2, GLM-5.3 Flash, Kimi K3, DeepSeek V4 Flash & DeepSeek V4.1 Flash through the Zro inference endpoint",
   "type": "module",
   "main": "index.ts",
@@ -38,8 +38,8 @@
     "brace-expansion": "5.0.12"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "1.2.0",
-    "@earendil-works/pi-coding-agent": "1.2.0",
+    "@earendil-works/pi-ai": "1.3.0",
+    "@earendil-works/pi-coding-agent": "1.3.0",
     "@types/node": "^24.10.1",
     "typescript": "6.0.3",
     "vitest": "4.1.7"

package/scripts/test-pi-compat.mjs

@@ -13,7 +13,7 @@ globalThis.fetch = async () => new Response('', { status: 503 });
 let session;
 try {
   const { createAgentSession, DefaultResourceLoader, ModelRuntime, SessionManager, SettingsManager, VERSION } = await import('@earendil-works/pi-coding-agent');
-  assert.equal(VERSION, '1.2.0', 'test the actual pinned Pi host, not a stale override');
+  assert.equal(VERSION, '1.3.0', 'test the actual pinned Pi host, not a stale override');
   const manifest = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
   for (const name of ['@earendil-works/pi-ai', '@earendil-works/pi-agent-core', '@earendil-works/pi-coding-agent', '@earendil-works/pi-tui', 'typebox']) {
     assert.equal(manifest.dependencies?.[name], undefined, `${name}: host packages must not be runtime dependencies`);
@@ -58,7 +58,7 @@ try {
       { id: label, choices: [{ index: 0, delta: {}, finish_reason: 'stop' }], usage: { prompt_tokens: 3, completion_tokens: 2, total_tokens: 5, total_cost: 0.001 } },
     ];
     const result = await modelRuntime.streamSimple(model, { messages: [
-      { role: 'system', content: 'Offline Pi 1.2.0 transcript', timestamp: 0 },
+      { role: 'system', content: 'Offline Pi 1.3.0 transcript', timestamp: 0 },
       { role: 'user', content: label, timestamp: 1 },
     ] }, {
       maxTokens: 32,
@@ -77,13 +77,13 @@ try {
     assert.equal(result.usage.totalTokens, 5);
     assert.equal(requestBody.user, label, 'request-scoped instrumentation must not cross concurrent streams');
     assert.equal(requestBody.max_tokens ?? requestBody.max_completion_tokens, 32);
-    assert.ok(requestBody.messages.some(message => typeof message.content === 'string' && message.content.includes('Offline Pi 1.2.0 transcript')));
+    assert.ok(requestBody.messages.some(message => typeof message.content === 'string' && message.content.includes('Offline Pi 1.3.0 transcript')));
     assert.deepEqual(hooks.slice(0, 2), ['payload', 'response']);
     assert.equal(hooks.filter(hook => hook === 'stream').length, 2);
   }));
   assert.equal(globalThis.fetch, offlineFetch, 'Zro must never monkey-patch global fetch');
   await session.extensionRunner.emit({ type: 'session_shutdown' });
-  assert.deepEqual(errors, [], 'Pi 1.2.0 startup and shutdown must be clean');
+  assert.deepEqual(errors, [], 'Pi 1.3.0 startup and shutdown must be clean');
   console.log(`${manifest.name}: Pi ${VERSION} manifest, ${models.length} models, startup/shutdown, concurrent streams and instrumentation OK`);
 } finally {
   session?.dispose();