samrito-pi-preset 1.0.0 → 1.0.2

package/{node_modules/pi-cliproxyapi-provider/LICENSE → LICENSE}

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Richard Hao
+Copyright (c) 2026 xiangsam
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,7 +1,7 @@
 # samrito-pi-preset
 
 A portable [pi](https://pi.dev) package that bundles this machine's extension
-collection (including the `pi-cliproxyapi-provider` provider) under a single
+collection (including the `@samrito/pi-cliproxyapi-provider` provider) under a single
 `pi install`-able package.
 
 Install it from npm in one command:
@@ -55,7 +55,7 @@ managed separately, or copy the directory to the target machine.
 | `@juicesharp/rpiv-todo` | ^2.9.0 | `index.ts` |
 | `@narumitw/pi-btw` | ^0.58.1 | `dist/index.ts` |
 | `pi-background-tasks` | ^2.5.0 | `extensions/*.ts` (2) |
-| `pi-cliproxyapi-provider` | ^0.15.30 | `extensions/index.ts` |
+| `@samrito/pi-cliproxyapi-provider` | ^0.16.0 | `extensions/index.ts` |
 | `pi-goal-x` | ^0.31.2 | `extensions/goal.ts` |
 | `pi-tool-display` | ^0.5.0 | `index.ts` |
 | `pi-zentui` | ^0.23.0 | `extensions/zentui/index.ts` |
@@ -111,14 +111,11 @@ Because it does not work, and cannot ask:
 ## Publish and install from npm
 
 The package is a normal, publishable npm package (`private` is not set), and
-`bundledDependencies` makes npm pack every plugin into the tarball. Publish
-once, then install anywhere with `pi install npm:samrito-pi-preset`.
+`bundledDependencies` makes npm pack every plugin into the tarball. Install it
+anywhere with `pi install npm:samrito-pi-preset`.
 
-```bash
-npm login                 # once per machine
-node scripts/verify.mjs   # optional but recommended before publishing
-npm publish               # runs prepack -> sync-manifest --check
-```
+Releases are driven by tags: pushing `vX.Y.Z` makes GitHub Actions publish that
+exact version. See [Releasing](#releasing) for the one-time npm setup.
 
 On the target machine:
 
@@ -141,6 +138,108 @@ bundled `node_modules/` keeps every `pi.extensions` path resolvable.
 `prepack` runs `sync-manifest.mjs --check`, so a stale `pi.extensions` fails the
 publish instead of shipping.
 
+## CI
+
+[`.github/workflows/ci.yml`](.github/workflows/ci.yml) runs on every push to
+`main` and every pull request. It never touches the registry.
+
+| Job | Checks |
+| --- | --- |
+| `verify` (Node 22 + 24) | manifest integrity, pi resolution, real extension loading via `verify.mjs` |
+| `tarball` | packs, installs, resolves and loads the **published artifact** via `verify-tarball.mjs` |
+
+The `tarball` job exists because the checkout and the published package differ in
+a way that matters: in the checkout npm hoists the plugins into a sibling
+`node_modules/`, but in the tarball `bundledDependencies` must embed them
+*inside* the package root, since `pi.extensions` paths are relative to it. A
+drift between `dependencies` and `bundledDependencies` therefore breaks only the
+published artifact, and `verify.mjs` cannot see it. Run it locally with:
+
+```bash
+npm run verify           # checks the checkout
+npm run verify:tarball   # packs, installs, and loads the real artifact
+```
+
+Both jobs also guard a repo requirement: a vendor-scoped provider package that
+was deliberately excluded from this bundle must never be referenced in tracked
+files. The search term is assembled at runtime inside the workflow so the guard
+cannot match its own source, and it deliberately does **not** scan the packed
+tarball — the bundled upstream `models.dev` dataset contains vendor model ids
+that are none of our business.
+
+## Releasing
+
+[`.github/workflows/publish.yml`](.github/workflows/publish.yml) publishes on a
+`vX.Y.Z` tag using npm **trusted publishing** (OIDC): no long-lived `NPM_TOKEN`
+secret exists, and npm attaches a provenance attestation linking the tarball to
+the repository and commit.
+
+```bash
+npm version patch        # or minor / major — bumps package.json and tags vX.Y.Z
+git push --follow-tags    # workflow runs, verifies, publishes
+```
+
+The workflow refuses a tag that disagrees with `package.json`, runs
+`scripts/verify.mjs` (loading every extension through pi's real startup path),
+and treats re-tagging an already published version as a no-op rather than a
+failure.
+
+### One-time setup
+
+A trusted publisher can only be configured for a package that already exists, so
+the first version was published manually. `samrito-pi-preset@1.0.0` exists, so
+configure once at
+[npmjs.com](https://www.npmjs.com/package/samrito-pi-preset/access):
+
+| Field | Value |
+| --- | --- |
+| Publisher | GitHub Actions |
+| Organization | `xiangsam` |
+| Repository | `samrito-pi-preset` |
+| Workflow name | `publish.yml` |
+| Environment | *(leave empty)* |
+| Allow direct publish | **enabled** |
+
+`publish.yml` must match the workflow **filename** exactly — renaming the file
+means updating this setting too. All fields are case-sensitive.
+
+Trusted publishing requires **npm CLI ≥ 11.5.1 and Node ≥ 22.14.0**; the workflow
+pins Node 24 and asserts the npm version before publishing. Provenance is
+generated automatically for GitHub Actions, so `--provenance` is explicit rather
+than required.
+
+> **Trusted publisher connections cannot be edited.** npm fixes the provider and
+> its fields once a connection is created, so changing *Allow direct publish*
+> later means deleting the connection and adding a new one.
+
+This package deliberately enables *direct publish* so a tag ships unattended. npm
+recommends the opposite (stage only, then approve with 2FA); npm's own staged
+publishing docs say to enable only `npm stage publish` and disable `npm publish`.
+The trade-off, stated plainly: with direct publish enabled, anyone who can push a
+tag or edit this workflow can publish to npm, and every consumer of the preset
+pulls that version. To tighten it later:
+
+1. Delete the trusted publisher above and recreate it with **stage-only**
+   permissions (`npm trust github … --allow-stage-publish`, no `--allow-publish`).
+2. Change the workflow's last step to `npm stage publish --provenance --access public`.
+3. After each tag, finish the release locally:
+
+```bash
+npm stage list samrito-pi-preset
+npm stage approve <stage-id>    # prompts for 2FA
+npm stage reject <stage-id>     # to back out instead
+```
+
+### Publishing by hand
+
+Still possible if OIDC is unavailable; `prepack` keeps the manifest honest.
+
+```bash
+npm login                 # once per machine
+node scripts/verify.mjs   # optional but recommended
+npm publish               # runs prepack -> sync-manifest --check
+```
+
 After the first restart, run `/preset` to apply the shipped config templates —
 they are deliberately not written automatically.
 
@@ -262,10 +361,13 @@ re-run `setup.mjs`.
 | --- | --- |
 | `extensions/preset.ts` | the bundled `/preset` command (apply config templates) |
 | `scripts/setup.mjs` | install deps, regenerate manifest, copy configs, report conflicts |
-| `scripts/verify.mjs` | 4-stage check: manifest, pi resolution, real loading, startup conflicts |
+| `scripts/verify.mjs` | 4-stage check of the checkout: manifest, pi resolution, real loading, startup conflicts |
+| `scripts/verify-tarball.mjs` | packs the tarball, installs it, and loads it through pi — catches `bundledDependencies` drift |
 | `scripts/sync-manifest.mjs` | regenerate `pi.extensions` (`--check` for drift) |
 | `scripts/pack.sh` | build a tarball (`--with-deps` to include `node_modules`) |
 | `scripts/pi-package-lib.mjs` | shared helpers mirroring pi's resolution rules |
+| `.github/workflows/ci.yml` | verify + artifact checks on push/PR |
+| `.github/workflows/publish.yml` | publish to npm on `vX.Y.Z` tags (trusted publishing) |
 
 ### `verify.mjs`
 
@@ -325,6 +427,23 @@ node scripts/setup.mjs [--skip-install] [--force-config]
 - **Paths are relative to this package.** `pi.extensions` points into
   `node_modules/`, so the directory must stay where it was installed (or be
   re-installed). Moving it requires re-running `pi install`.
+- **The provider is a fork.** `@samrito/pi-cliproxyapi-provider` is a fork of
+  the upstream `pi-cliproxyapi-provider`, adding thinking levels derived from
+  models.dev `reasoning_options`. It keeps the upstream settings namespace,
+  config paths, cache directory, and `/cliproxyapi` command, so it is a drop-in
+  replacement — but the two must not be installed together, since both register
+  the same provider and command and pi rejects the duplicate.
+- **No vendor-locked provider is bundled.** The vendor-scoped provider package
+  that was previously excluded from this bundle must not be re-introduced. CI
+  enforces this with a grep over tracked files (the term is assembled at runtime
+  in the workflow so the guard cannot match its own source), and
+  `scripts/pi-package-lib.mjs`'s `EXCLUDED_PACKAGES` lists what is deliberately
+  skipped — currently empty.
+- **Traditional token publishing should stay disabled.** npm's *Require
+  two-factor authentication and disallow tokens* setting affects only traditional
+  token auth: "Your trusted publishers will continue to work normally, as they
+  use OIDC tokens." So it is safe — and recommended — to enable it while relying
+  on the trusted publisher.
 - **Do not commit `node_modules/`** unless you intend to distribute via tarball
   with `--with-deps`.
 - **`/preset` assumes the bundled layout.** It resolves templates relative to

package/node_modules/@samrito/pi-cliproxyapi-provider/LICENSE

@@ -0,0 +1,28 @@
+MIT License
+
+Copyright (c) 2026 Richard Hao
+Copyright (c) 2026 samrito (modifications to this fork)
+
+This package is a fork of pi-cliproxyapi-provider
+(https://github.com/0xRichardH/pi-cliproxyapi-provider) by Richard Hao,
+distributed under the MIT License reproduced below. The original copyright
+notice is retained as the license requires; the modifications in this fork are
+copyright their respective author.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/{pi-cliproxyapi-provider → @samrito/pi-cliproxyapi-provider}/README.md

@@ -1,25 +1,32 @@
-# pi-cliproxyapi-provider
+# @samrito/pi-cliproxyapi-provider
 
-`pi-cliproxyapi-provider` registers one [CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI) instance as a pi model provider. It discovers models from CLIProxyAPI's OpenAI-compatible `/v1/models` endpoint and enriches them with provider-specific metadata from [models.dev](https://models.dev/). Mixed catalogs use OpenAI Completions by default, while GPT-5.6 family models (including Codex variants) use the Responses API so pi can read their usage data. Canonical `/v1/models` owners such as `openai` select the matching provider metadata; aliases can override that selection when a proxy routes billing differently.
+> A fork of [pi-cliproxyapi-provider](https://github.com/0xRichardH/pi-cliproxyapi-provider)
+> by Richard Hao (MIT). This fork adds model thinking levels sourced from
+> models.dev. It is a drop-in replacement: the settings namespace, config paths,
+> cache directory, and `/cliproxyapi` command are unchanged, so existing
+> configuration keeps working. Do not install it alongside the original — both
+> register the same provider and command, and pi rejects the duplicate.
+
+`@samrito/pi-cliproxyapi-provider` registers one [CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI) instance as a pi model provider. It discovers models from CLIProxyAPI's OpenAI-compatible `/v1/models` endpoint and enriches them with provider-specific metadata from [models.dev](https://models.dev/). Mixed catalogs use OpenAI Completions by default, while GPT-5.6 family models (including Codex variants) use the Responses API so pi can read their usage data. Canonical `/v1/models` owners such as `openai` select the matching provider metadata; aliases can override that selection when a proxy routes billing differently.
 
 ## Install
 
 Install from npm:
 
 ```bash
-pi install npm:pi-cliproxyapi-provider
+pi install npm:@samrito/pi-cliproxyapi-provider
 ```
 
 Or install from GitHub:
 
 ```bash
-pi install git:github.com/0xRichardH/pi-cliproxyapi-provider@master
+pi install git:github.com/xiangsam/pi-cliproxyapi-provider@master
 ```
 
 You can omit `@master`, but pinning a branch, tag, or commit makes Git installs reproducible:
 
 ```bash
-pi install git:github.com/0xRichardH/pi-cliproxyapi-provider@a28f326
+pi install git:github.com/xiangsam/pi-cliproxyapi-provider@a28f326
 ```
 
 Restart pi after installing, then run:
@@ -96,6 +103,72 @@ The same setting can be placed in project `.pi/settings.json`; project settings
 
 Use `"full"` only when the selected CLIProxyAPI route and upstream account actually support that limit. Requests above `272000` input tokens also use the higher models.dev context-pricing tier where one is defined.
 
+### Thinking levels
+
+The provider derives each model's selectable thinking levels from the
+`reasoning_options` field in models.dev metadata. When a model publishes an
+effort list, exactly those levels appear in Pi's thinking selector:
+
+```text
+deepseek-flash   reasoning_options: [{"type":"effort","values":["low","high","max"]}]
+                 -> Pi offers off, low, high, max
+```
+
+Two details make this more than cosmetic:
+
+- **Absent levels are hidden, not defaulted.** models.dev publishes an
+exhaustive list, so every level it omits is explicitly marked unsupported. This
+matters because Pi otherwise offers levels up to `high` using the provider
+default, and a proxy that validates the level rejects the request. CLIProxyAPI
+does exactly that: an unsupported level comes back as
+`400 level "medium" not supported, valid levels: low, high, max`.
+- **`xhigh` and `max` only appear when the list names them.** Pi hides extended
+levels unless a model maps them explicitly, which is why `max` was previously
+unreachable for models that support it.
+
+Only `type: "effort"` publishes levels. `toggle` and `budget_tokens` describe
+other reasoning shapes and are ignored, so those models keep Pi's default. A
+built-in rule for the GPT-5.6 family remains as a fallback for models whose
+metadata carries no effort list; where models.dev publishes one, it wins, because
+it tracks the model's current capability and the rule does not.
+
+> **Levels describe the model, not your proxy.** models.dev publishes the
+> canonical capability, and a CLIProxyAPI route can accept a different set. A
+> mismatch that offers a level the proxy rejects makes Pi send a request that
+> fails with `400`. Correct it with the override below.
+
+#### Correcting a level list
+
+When a proxy serves a model differently from its published metadata, or when
+the models.dev match lands on a different provider, override the map in Pi's own
+`~/.pi/agent/models.json`:
+
+```json
+{
+  "providers": {
+    "cpa": {
+      "modelOverrides": {
+        "deepseek-flash": {
+          "thinkingLevelMap": {
+            "off": "none",
+            "minimal": null,
+            "low": "low",
+            "medium": null,
+            "high": "high",
+            "xhigh": null,
+            "max": "max"
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+This layer is applied by Pi after the provider registers its models, so it wins
+over both models.dev and the built-in rules. Use `null` to hide a level the
+proxy rejects. Replace `cpa` with your configured provider name.
+
 ### Model and display configuration
 
 Run `/cliproxyapi config` in Pi TUI mode to edit every package-level `settings.json` value. The tabbed panel has `Connection`, `Models`, and `Display` sections; it controls the GPT-5.6 context-window mode and whether the model selector shows the published strict tool-schema capability.

package/node_modules/{pi-cliproxyapi-provider → @samrito/pi-cliproxyapi-provider}/package.json

@@ -1,6 +1,6 @@
 {
-  "name": "pi-cliproxyapi-provider",
-  "version": "0.15.30",
+  "name": "@samrito/pi-cliproxyapi-provider",
+  "version": "0.16.0",
   "description": "Pi provider package for CLIProxyAPI with automatic model discovery and models.dev enrichment.",
   "type": "module",
   "license": "MIT",
@@ -15,12 +15,15 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/0xRichardH/pi-cliproxyapi-provider.git"
+    "url": "git+https://github.com/xiangsam/pi-cliproxyapi-provider.git"
   },
   "bugs": {
-    "url": "https://github.com/0xRichardH/pi-cliproxyapi-provider/issues"
+    "url": "https://github.com/xiangsam/pi-cliproxyapi-provider/issues"
+  },
+  "homepage": "https://github.com/xiangsam/pi-cliproxyapi-provider#readme",
+  "publishConfig": {
+    "access": "public"
   },
-  "homepage": "https://github.com/0xRichardH/pi-cliproxyapi-provider#readme",
   "files": [
     "src",
     "extensions",

package/node_modules/{pi-cliproxyapi-provider → @samrito/pi-cliproxyapi-provider}/src/model-capabilities.ts

@@ -15,9 +15,20 @@ interface ModelCapabilityRule {
   overrides: ModelCapabilityOverrides;
 }
 
+/**
+ * Fallback level map for the GPT-5.6 family, used only when models.dev publishes
+ * no effort list for the model.
+ *
+ * `minimal` is explicitly unsupported. Measured against a live CLIProxyAPI
+ * instance, gpt-5.6-sol, -terra, and -luna all answer
+ * `400 level "minimal" not supported, valid levels: low, medium, high, xhigh, max`,
+ * so offering it produces a failing request. models.dev omits `minimal` for the
+ * same models, which is why this rule is the fallback rather than the source of
+ * truth; it stays correct by hiding what the model does not accept.
+ */
 const GPT_5_6_THINKING_LEVEL_MAP: ThinkingLevelMap = {
   off: "none",
-  minimal: "minimal",
+  minimal: null,
   low: "low",
   medium: "medium",
   high: "high",

package/node_modules/{pi-cliproxyapi-provider → @samrito/pi-cliproxyapi-provider}/src/model-ui.ts

@@ -75,13 +75,33 @@ function detailItems(model: ProviderModelConfigLike, override: ProviderModelOver
   ];
 }
 
+/**
+ * Render the thinking levels pi will actually offer.
+ *
+ * Listing `Object.keys(thinkingLevelMap)` would be misleading: a key is present
+ * with value `null` precisely to mean "unsupported, hidden", so the keys alone
+ * include levels the user can never select. Show the mapped values instead and
+ * state the count of explicitly unsupported levels.
+ */
+function thinkingLevelSummary(map: ProviderModelConfigLike["thinkingLevelMap"]): string {
+  if (!map) return "none";
+
+  const offered = Object.entries(map)
+    .filter(([, value]) => typeof value === "string")
+    .map(([level]) => level);
+  const hidden = Object.values(map).filter((value) => value === null).length;
+  if (offered.length === 0) return "none";
+
+  return hidden > 0 ? `${offered.join(", ")} (${hidden} unsupported)` : offered.join(", ");
+}
+
 function details(model: ProviderModelConfigLike): string[] {
   return [
     `Name: ${model.name}`,
     `API: ${model.api ?? "openai-completions (provider default)"}`,
     `Input: ${model.input.join(", ")}`,
     `Cost: in ${model.cost.input}, out ${model.cost.output}, cache read ${model.cost.cacheRead}, cache write ${model.cost.cacheWrite}`,
-    `Thinking map: ${model.thinkingLevelMap ? Object.keys(model.thinkingLevelMap).join(", ") : "none"}`,
+    `Thinking map: ${thinkingLevelSummary(model.thinkingLevelMap)}`,
     `Other compat: ${formattedOtherCompat(model)}`,
   ];
 }

package/node_modules/{pi-cliproxyapi-provider → @samrito/pi-cliproxyapi-provider}/src/provider.ts

@@ -2,6 +2,7 @@ import type { CpaModel } from "./cpa.ts";
 import { findMetadataMatch, type MetadataMatchMethod } from "./matching.ts";
 import { getModelApiOverride, isGpt56Model, type ModelApiContext } from "./model-api.ts";
 import { getModelCapabilityOverrides } from "./model-capabilities.ts";
+import { thinkingLevelMapFromReasoningOptions } from "./reasoning-levels.ts";
 import type { Gpt56ContextWindowMode } from "./settings.ts";
 import type {
   InputModality,
@@ -83,14 +84,22 @@ function modelFromMetadata(
   const capabilityOverrides = getModelCapabilityOverrides(capabilityContext);
   const api = getModelApiOverride(capabilityContext);
 
+  // Precedence: models.dev wins when it publishes a level list, because that
+  // list tracks the model's current capability while the rules were written
+  // against an older catalog. Measured against a live CLIProxyAPI instance, the
+  // gpt-5.6 rule is now stale: it maps `minimal`, which the proxy rejects with
+  // `400 level "minimal" not supported`, whereas the models.dev list for the
+  // same model omits `minimal` and matches the proxy exactly. The rules still
+  // fill the gap when metadata is absent or carries no effort list.
+  const thinkingLevelMap =
+    thinkingLevelMapFromReasoningOptions(metadata.reasoning_options) ?? capabilityOverrides.thinkingLevelMap;
+
   return {
     id: cpaModel.id,
     name: metadata.name ?? cpaModel.id,
     reasoning: capabilityOverrides.reasoning ?? metadata.reasoning ?? PI_MODEL_DEFAULTS.reasoning,
     ...(api ? { api } : {}),
-    ...(capabilityOverrides.thinkingLevelMap
-      ? { thinkingLevelMap: capabilityOverrides.thinkingLevelMap }
-      : {}),
+    ...(thinkingLevelMap ? { thinkingLevelMap } : {}),
     input: inputFromMetadata(metadata),
     cost: costFromMetadata(metadata),
     contextWindow: contextWindowForModel(capabilityContext, metadata.limit?.context, gpt56ContextWindow),

package/node_modules/@samrito/pi-cliproxyapi-provider/src/reasoning-levels.ts

@@ -0,0 +1,59 @@
+import type { ThinkingLevelMap } from "@earendil-works/pi-ai";
+import type { ModelsDevReasoningOption } from "./types.ts";
+
+/** pi thinking levels in ascending depth, excluding `off`. */
+const PI_THINKING_LEVELS = ["minimal", "low", "medium", "high", "xhigh", "max"] as const;
+
+/** The models.dev effort value that means "thinking disabled". */
+const EFFORT_OFF = "none";
+
+/**
+ * Convert models.dev `reasoning_options` into a pi `ThinkingLevelMap`.
+ *
+ * models.dev publishes an exhaustive `type: "effort"` list for models whose
+ * reasoning depth is selectable, using the same vocabulary pi exposes (`none`
+ * plus `minimal`..`max`). The conversion is total in both directions:
+ *
+ *   - a level present in the list maps to itself, so pi sends that exact value
+ *   - a level absent from the list maps to `null`, which hides it in pi's UI
+ *   - pi's `off` maps to models.dev `none`, which the list may signal either as
+ *     an effort value or as a separate `toggle` entry
+ *
+ * Null-ing absent levels is the point of this function. Because the list is
+ * exhaustive, leaving a level `undefined` would let pi offer it using the
+ * provider default, and a proxy that validates the level rejects the request.
+ * CLIProxyAPI does exactly that: it answers an unsupported level with
+ * `400 level "medium" not supported, valid levels: low, high, max`.
+ *
+ * `off` needs both signals because models.dev splits the ability to disable
+ * thinking from the level list. A model can publish `["low","high","max"]`
+ * alongside `{type: "toggle"}`, meaning thinking is selectable only within those
+ * levels but can still be switched off; reading the effort list alone would hide
+ * `off` from a model that supports it. 296 catalog entries have this shape,
+ * including `deepseek/deepseek-flash`, which a live CLIProxyAPI instance accepts
+ * `reasoning_effort: "none"` for.
+ *
+ * Returns `undefined` when the model publishes no effort list, so callers keep
+ * their own default. A lone `toggle` or `budget_tokens` entry enumerates no
+ * levels and cannot be expressed as a level map, so it is ignored.
+ */
+export function thinkingLevelMapFromReasoningOptions(
+  options: ModelsDevReasoningOption[] | undefined,
+): ThinkingLevelMap | undefined {
+  const effort = options?.find(
+    (option) => option.type === "effort" && Array.isArray(option.values) && option.values.length > 0,
+  );
+  const values = effort?.values;
+  if (!values) return undefined;
+
+  const offered = new Set(values);
+  const canDisableThinking =
+    offered.has(EFFORT_OFF) || (options?.some((option) => option.type === "toggle") ?? false);
+  const map: ThinkingLevelMap = {
+    off: canDisableThinking ? EFFORT_OFF : null,
+  };
+  for (const level of PI_THINKING_LEVELS) {
+    map[level] = offered.has(level) ? level : null;
+  }
+  return map;
+}

package/node_modules/{pi-cliproxyapi-provider → @samrito/pi-cliproxyapi-provider}/src/types.ts

@@ -36,6 +36,12 @@ export interface ModelsDevMetadata {
   sourceProvider?: string;
   name?: string;
   reasoning?: boolean;
+  /**
+   * How the model exposes reasoning control. Only `type: "effort"` entries carry
+   * a level list that maps onto pi thinking levels; `toggle` and `budget_tokens`
+   * describe other shapes and are not converted.
+   */
+  reasoning_options?: ModelsDevReasoningOption[];
   modalities?: {
     input?: string[];
     output?: string[];
@@ -64,6 +70,22 @@ export interface ModelsDevMetadata {
 
 export type ModelsDevCatalog = Record<string, ModelsDevMetadata>;
 
+/**
+ * One entry of a models.dev `reasoning_options` array.
+ *
+ * `type` is kept as a plain string because models.dev adds shapes over time
+ * (currently `effort`, `toggle`, and `budget_tokens`) and unknown ones must be
+ * ignored rather than rejected.
+ */
+export interface ModelsDevReasoningOption {
+  type: string;
+  /** Levels for `type: "effort"`, drawn from the same vocabulary pi uses. */
+  values?: string[];
+  /** Token bounds for `type: "budget_tokens"`. */
+  min?: number;
+  max?: number;
+}
+
 export interface ProviderModelConfigLike {
   id: string;
   name: string;

package/package.json

@@ -1,13 +1,21 @@
 {
   "name": "samrito-pi-preset",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "type": "module",
   "description": "Portable pi agent setup: bundles the extension collection and user config templates so another machine can be brought up with one install.",
   "keywords": [
     "pi-package",
     "pi-extensions"
   ],
-  "license": "UNLICENSED",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/xiangsam/samrito-pi-preset.git"
+  },
+  "homepage": "https://github.com/xiangsam/samrito-pi-preset#readme",
+  "bugs": {
+    "url": "https://github.com/xiangsam/samrito-pi-preset/issues"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -15,7 +23,8 @@
     "config",
     "extensions",
     "scripts",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "pi": {
     "extensions": [
@@ -24,9 +33,9 @@
       "node_modules/@juicesharp/rpiv-ask-user-question/index.ts",
       "node_modules/@juicesharp/rpiv-todo/index.ts",
       "node_modules/@narumitw/pi-btw/dist/index.ts",
+      "node_modules/@samrito/pi-cliproxyapi-provider/extensions/index.ts",
       "node_modules/pi-background-tasks/extensions/anthropic-attribution.ts",
       "node_modules/pi-background-tasks/extensions/background-tasks.ts",
-      "node_modules/pi-cliproxyapi-provider/extensions/index.ts",
       "node_modules/pi-goal-x/extensions/goal.ts",
       "node_modules/pi-tool-display/index.ts",
       "node_modules/pi-zentui/extensions/zentui/index.ts"
@@ -35,6 +44,7 @@
   "scripts": {
     "setup": "node scripts/setup.mjs",
     "verify": "node scripts/verify.mjs",
+    "verify:tarball": "node scripts/verify-tarball.mjs",
     "pack": "bash scripts/pack.sh",
     "sync": "node scripts/sync-manifest.mjs",
     "prepack": "node scripts/sync-manifest.mjs --check"
@@ -44,8 +54,8 @@
     "@juicesharp/rpiv-ask-user-question": "^2.9.0",
     "@juicesharp/rpiv-todo": "^2.9.0",
     "@narumitw/pi-btw": "^0.58.1",
+    "@samrito/pi-cliproxyapi-provider": "^0.16.0",
     "pi-background-tasks": "^2.5.0",
-    "pi-cliproxyapi-provider": "^0.15.30",
     "pi-goal-x": "^0.31.2",
     "pi-tool-display": "^0.5.0",
     "pi-zentui": "^0.23.0"
@@ -55,8 +65,8 @@
     "@juicesharp/rpiv-ask-user-question",
     "@juicesharp/rpiv-todo",
     "@narumitw/pi-btw",
+    "@samrito/pi-cliproxyapi-provider",
     "pi-background-tasks",
-    "pi-cliproxyapi-provider",
     "pi-goal-x",
     "pi-tool-display",
     "pi-zentui"

package/scripts/pi-package-lib.mjs

@@ -17,7 +17,8 @@
  *   collectExtensionFiles() before being written to a bundle manifest.
  */
 
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
@@ -237,3 +238,42 @@ export function directorySize(dir) {
 export function relativeToPackage(path) {
 	return relative(PACKAGE_ROOT, path);
 }
+
+/**
+ * Locate pi's ESM entry point so its own package manager and loader can be
+ * imported. Returns undefined when pi is not installed.
+ *
+ * Set PI_MODULE_PATH to point at pi explicitly; otherwise `pi` is looked up on
+ * PATH and its package root walked up to.
+ */
+export function findPiModule() {
+	const override = process.env.PI_MODULE_PATH;
+	if (override && existsSync(override)) return override;
+
+	let binary;
+	try {
+		binary = execFileSync("which", ["pi"], { encoding: "utf-8" }).trim();
+	} catch {
+		return undefined;
+	}
+
+	let current;
+	try {
+		current = dirname(realpathSync(binary));
+	} catch {
+		return undefined;
+	}
+
+	while (current !== dirname(current)) {
+		const manifestPath = join(current, "package.json");
+		if (existsSync(manifestPath)) {
+			const manifest = readJson(manifestPath);
+			if (manifest?.name === "@earendil-works/pi-coding-agent") {
+				const entry = join(current, manifest.exports?.["."]?.import ?? "dist/index.js");
+				return existsSync(entry) ? entry : undefined;
+			}
+		}
+		current = dirname(current);
+	}
+	return undefined;
+}

package/scripts/verify-tarball.mjs

@@ -0,0 +1,200 @@
+#!/usr/bin/env node
+/**
+ * Verify the *published artifact*, not the source tree.
+ *
+ * `verify.mjs` checks the checkout: its `node_modules/` is a normal npm tree
+ * where hoisting is allowed. What users actually receive is the packed tarball,
+ * where `bundledDependencies` must have embedded every plugin *inside* the
+ * package root, because pi resolves each `pi.extensions` entry relative to that
+ * root. A drift between `dependencies` and `bundledDependencies`, or a plugin
+ * that npm decides not to bundle, breaks only the tarball — the source tree
+ * still looks perfect.
+ *
+ * So this script reproduces the real delivery path:
+ *   1. `npm pack`            (runs prepack -> sync-manifest --check)
+ *   2. `npm install <tgz>`   into a throwaway prefix, like pi does
+ *   3. resolve + load through pi's own DefaultPackageManager / loadExtensions
+ *
+ * Usage:
+ *   node scripts/verify-tarball.mjs [--verbose] [--keep]
+ *
+ * Exits 1 on any failure. Skips (exit 0, with a note) when pi cannot be found,
+ * matching verify.mjs.
+ */
+
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdtempSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, relative } from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+	PACKAGE_ROOT,
+	findPiModule,
+	manifestExtensionEntries,
+	readPackageJson,
+} from "./pi-package-lib.mjs";
+
+const verbose = process.argv.includes("--verbose");
+const keep = process.argv.includes("--keep");
+const problems = [];
+
+const ok = (message) => console.log(`  \u001b[32m✓\u001b[0m ${message}`);
+const note = (message) => console.log(`  \u001b[33m!\u001b[0m ${message}`);
+const heading = (title) => console.log(`\n\u001b[1m${title}\u001b[0m`);
+
+function problem(message) {
+	problems.push(message);
+	console.log(`  \u001b[31m✗\u001b[0m ${message}`);
+}
+
+const npm = process.env.PI_NPM_COMMAND ?? "npm";
+const manifest = readPackageJson();
+const declared = manifestExtensionEntries();
+const workDir = mkdtempSync(join(tmpdir(), "pi-tarball-"));
+
+/** Thrown after a problem() call so the report is not duplicated in the catch. */
+class AlreadyReported extends Error {}
+
+/** npm pack/install can fail for reasons the output already explains. */
+function run(command, args, options = {}) {
+	try {
+		return execFileSync(command, args, { encoding: "utf-8", ...options });
+	} catch (error) {
+		problem(`${command} ${args[0]} failed: ${String(error.stderr ?? error.message).trim().split("\n")[0]}`);
+		throw new AlreadyReported("command failed");
+	}
+}
+
+try {
+	// ------------------------------------------------------------- 1. pack
+
+	heading("1. npm pack");
+
+	const packOutput = run(npm, ["pack", "--silent", "--pack-destination", workDir], { cwd: PACKAGE_ROOT }).trim();
+	const archiveName = packOutput.split("\n").filter(Boolean).pop() ?? "";
+	const tarball = join(workDir, archiveName);
+	if (!archiveName || !existsSync(tarball)) {
+		problem(`npm pack did not produce a tarball (output: ${packOutput || "empty"})`);
+		throw new AlreadyReported("pack failed");
+	}
+	ok(`${archiveName} (${(statSync(tarball).size / 1024 / 1024).toFixed(1)} MB)`);
+
+	// ------------------------------------------- 2. install like pi does
+
+	heading("2. install into a throwaway prefix");
+
+	const installRoot = join(workDir, "agent", "npm");
+	run(
+		npm,
+		["install", tarball, "--prefix", installRoot, "--legacy-peer-deps", "--no-audit", "--no-fund"],
+		{ stdio: verbose ? "inherit" : "pipe" },
+	);
+
+	const installedRoot = join(installRoot, "node_modules", manifest.name);
+	if (!existsSync(installedRoot)) {
+		problem(`${manifest.name} is not present in the install prefix`);
+		throw new AlreadyReported("install failed");
+	}
+	ok(`installed to node_modules/${manifest.name}`);
+
+	// Every bundled plugin must exist *inside* the package root: that is what
+	// makes the relative pi.extensions paths resolve for an npm-installed user.
+	const missing = declared.filter((entry) => !existsSync(join(installedRoot, entry)));
+	if (missing.length > 0) {
+		problem(`${missing.length} pi.extensions entry/entries missing from the tarball`);
+		for (const entry of missing.slice(0, 10)) console.log(`      ${entry}`);
+		console.log("      fix: keep `dependencies` and `bundledDependencies` in sync");
+	} else {
+		ok(`all ${declared.length} pi.extensions entries are contained in the tarball`);
+	}
+
+	// ------------------------------------------------- 3. pi resolve + load
+
+	heading("3. resolve and load through pi");
+
+	const piModule = findPiModule();
+	if (!piModule) {
+		note("pi not found on PATH; skipped (set PI_MODULE_PATH to enable)");
+	} else {
+		const agentDir = join(workDir, "agent");
+		writeFileSync(
+			join(agentDir, "settings.json"),
+			`${JSON.stringify({ packages: [`npm:${manifest.name}`] }, null, 2)}\n`,
+			"utf-8",
+		);
+
+		const { DefaultPackageManager, SettingsManager } = await import(pathToFileURL(piModule).href);
+		const settingsManager = SettingsManager.create(installedRoot, agentDir);
+		const manager = new DefaultPackageManager({
+			cwd: installedRoot,
+			agentDir,
+			settingsManager,
+		});
+
+		const resolved = await manager.resolve();
+		const extensions = resolved.extensions.filter((resource) => resource.enabled);
+
+		if (extensions.length !== declared.length) {
+			problem(`pi resolved ${extensions.length} extensions, expected ${declared.length}`);
+		} else {
+			ok(`pi resolved ${extensions.length} extensions from the installed tarball`);
+		}
+
+		// A path outside the package root means npm hoisted a plugin instead of
+		// bundling it, which is exactly the failure this script exists to catch.
+		const outside = extensions.filter((resource) => !resource.path.startsWith(installedRoot));
+		if (outside.length > 0) {
+			problem(`${outside.length} extension(s) resolved outside the installed package`);
+			for (const resource of outside) console.log(`      ${resource.path}`);
+		}
+
+		const loader = await import(pathToFileURL(join(dirname(piModule), "core/extensions/loader.js")).href);
+		const result = await loader.loadExtensions(
+			extensions.map((resource) => resource.path),
+			installedRoot,
+		);
+
+		for (const error of result.errors) {
+			problem(`load error in ${relative(installedRoot, error.path)}: ${error.error.split("\n")[0]}`);
+		}
+		if (result.errors.length === 0) {
+			const tools = result.extensions.reduce((total, extension) => total + extension.tools.size, 0);
+			const commands = result.extensions.reduce((total, extension) => total + extension.commands.size, 0);
+			ok(`all ${result.extensions.length} extensions loaded, 0 errors`);
+			console.log(`  · registered: ${tools} tools, ${commands} commands`);
+		}
+
+		// The bundled /preset command has to survive packaging too; without it the
+		// config templates shipped in config/ would be unreachable.
+		if (result.extensions.some((extension) => extension.commands.has("preset"))) {
+			ok("/preset command is registered");
+		} else {
+			problem("/preset command is missing from the packaged extensions");
+		}
+
+		if (verbose) {
+			for (const extension of result.extensions) {
+				console.log(`      ${relative(installedRoot, extension.resolvedPath ?? extension.path)}`);
+			}
+		}
+	}
+} catch (error) {
+	if (!(error instanceof AlreadyReported)) {
+		problem(`verification failed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+} finally {
+	if (keep) {
+		console.log(`\n  kept: ${workDir}`);
+	} else {
+		rmSync(workDir, { recursive: true, force: true });
+	}
+}
+
+console.log("");
+if (problems.length > 0) {
+	console.log(`\u001b[31m${problems.length} problem(s)\u001b[0m`);
+	for (const item of problems) console.log(`  - ${item}`);
+	process.exitCode = 1;
+} else {
+	console.log("\u001b[32mOK\u001b[0m — the packed tarball installs, resolves, and loads.");
+}