opencode-models 0.1.0__tar.gz

opencode_models-0.1.0/.githooks/pre-commit

@@ -0,0 +1,24 @@
+#!/bin/sh
+# Fast local gates, no new installs: a secret-pattern sweep over the tree
+# plus ruff lint and format check from the project's own venv.
+# Fails the commit on findings. (CI runs the real gitleaks scanner on
+# every push and PR; this hook is the cheap local tripwire.)
+
+# 1. Tracked secret patterns (same sweep as `just audit`, but failing).
+# The pattern is split with '' so this file never matches itself.
+if grep -rniE 'BEGIN (RSA |OPENSSH |EC )?PRIVATE ''KEY|aws_secret_''access_key|ghp_''[A-Za-z0-9]{36}|github_pat_''[A-Za-z0-9]{22}' --exclude-dir=.venv --exclude-dir=.git --exclude-dir=__pycache__ . ; then
+    echo "pre-commit: secret-looking content above — remove it before committing" >&2
+    exit 1
+fi
+
+# 2. Lint + format via the project's own venv (installed by `just bootstrap`).
+# Missing venv is not a failure: warn and let CI be the backstop.
+if command -v uv >/dev/null 2>&1 && uv run --no-sync ruff --version >/dev/null 2>&1; then
+    uv run --no-sync ruff check opencode_models tests || exit 1
+    uv run --no-sync ruff format --check opencode_models tests || {
+        echo "pre-commit: run 'just lint' (or 'uv run ruff format opencode_models tests') and re-stage" >&2
+        exit 1
+    }
+else
+    echo "pre-commit: ruff not available (run 'just bootstrap' once) — lint skipped, CI still checks" >&2
+fi

opencode_models-0.1.0/.githooks/pre-push

@@ -0,0 +1,17 @@
+#!/bin/sh
+# Block pushing the local-data branch: it holds the full fetched dataset
+# (hundreds of third-party records plus workspace-derived snapshots) and
+# must never leave this machine. The branch is intentionally never pushed;
+# this hook makes that rule mechanical instead of remembered.
+#
+# Invoked by git with lines "<local ref> <local sha> <remote ref>
+# <remote sha>" on stdin; exit non-zero rejects the push.
+
+while read local_ref _local_sha _remote_ref _remote_sha; do
+    case "$local_ref" in
+    refs/heads/local-data)
+        echo "refusing to push $local_ref: the fetched dataset must stay local (see README, Data)" >&2
+        exit 1
+        ;;
+    esac
+done

opencode_models-0.1.0/.github/dependabot.yml

@@ -0,0 +1,24 @@
+version: 2
+
+updates:
+  # The package itself is stdlib-only; the Actions pinned in
+  # .github/workflows are what drifts. All minor/patch action updates
+  # land in one grouped weekly PR instead of one PR each; majors stay
+  # individual so a breaking action change gets its own review.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    # delay version updates N days after release: avoids yanked-release
+    # haste, and satisfies the zizmor dependabot-cooldown audit
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 3
+    groups:
+      github-actions:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch

opencode_models-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,88 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# Least privilege: jobs get read-only repo access by default.
+permissions:
+  contents: read
+
+# One run per ref: a new push cancels the older in-progress run.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.12", "3.14"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          enable-cache: true
+      - name: sync (with the pinned lockfile)
+        run: uv sync --python ${{ matrix.python-version }}
+      - name: unit tests
+        run: uv run --no-sync python -m unittest discover -s tests -v
+      - name: the console resolves and runs from the entry point
+        # no scraped dataset in CI: it is fetched on demand (see README)
+        run: uv run --no-sync opencode-models --help
+
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - name: wheel + sdist build
+        run: uv build
+      - name: install the wheel into a throwaway tool env
+        run: |
+          uv tool install --force dist/*.whl
+          opencode-models --help >/dev/null
+
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - name: sync (with the pinned lockfile, dev tools included)
+        run: uv sync --python "3.12"
+      # same commands as `just lint`; ruff itself comes from the locked
+      # dev group, never from the network at CI time beyond the lockfile
+      - name: lint, format check and complexity gate
+        run: |
+          uv run --no-sync ruff check opencode_models tests
+          uv run --no-sync ruff format --check opencode_models tests
+
+  zizmor:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # No SARIF upload: code scanning is not enabled for this repo, and
+      # the upload is what kept failing — not the audit. The audit still
+      # runs and fails this step on findings. If code scanning gets
+      # enabled, drop this flag and add a job-level `permissions` block
+      # with `security-events: write` (upload) plus `actions: read`
+      # (run association).
+      - name: audit workflows with zizmor
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        with:
+          advanced-security: false

opencode_models-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,34 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+# Least privilege: checkout needs repo read access; publishing uses
+# a short-lived OIDC token instead of a stored PyPI secret.
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write # trusted publishing (PyPI must list this repo as a trusted publisher first)
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          # no cache: releases are rare enough that a cold sync is cheap,
+          # and it removes the cache-poisoning surface entirely
+          enable-cache: false
+      - name: check the tag matches the package version
+        run: test "${GITHUB_REF#refs/tags/v}" = "$(grep -m1 '^version *=' pyproject.toml | cut -d'"' -f2)"
+      - name: wheel + sdist build
+        run: uv build
+      - name: publish to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

opencode_models-0.1.0/.github/workflows/secret-scan.yml

@@ -0,0 +1,36 @@
+name: secret-scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "0 6 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    # contents: read comes from the top level; pull-requests: read lets
+    # the action resolve the PR range it scans on pull_request events.
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: scan history for leaked secrets
+        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
+        # v2 requires the token explicitly on pull_request events, where it
+        # needs the API to determine the scan range
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

opencode_models-0.1.0/.gitignore

@@ -0,0 +1,21 @@
+__pycache__/
+*.pyc
+*.egg-info/
+.venv/
+dist/
+# No fetched page or payload is committed. This `*.html` rule also caught the
+# test fixtures once, silently: nothing under tests/ is HTML any more (the
+# board shapes are written out in tests/test_boards.py), and a `git add -A`
+# that skips a file is easy to miss until CI fails on a clean checkout.
+*.html
+!README.md
+
+# The scraped/fetched dataset is deliberately not in this branch's history:
+# `opencode-models fetch` populates it, and the `local-data` branch keeps a
+# committed copy. The curated overlays in data/overrides/ ARE tracked.
+data/opencode/
+data/tier_prices/
+data/aiarena/
+data/boards/
+data/usage/
+data/available/

opencode_models-0.1.0/.opencode/skills/backfill-scores/SKILL.md

@@ -0,0 +1,284 @@
+---
+name: backfill-scores
+description: Use when an opencode-models model has only one scored benchmark and is therefore unranked, or when asked to find, research or add benchmark numbers — covers where to look, which sources are actually scrapable, how to write a data/overrides JSON file, and how to verify it landed.
+---
+
+# Backfilling missing benchmark scores
+
+A model needs two of the four scored benchmarks to carry a score at all
+(`scoring.MIN_AXES`), so the models worth chasing are the ones sitting on
+one. This is how to find them, source a number, write it down, and prove it
+landed.
+
+The rule everything else serves: **a number without a source is not data.**
+The loader drops any override entry that has no `source`, so a file without
+one is inert — it will not appear, fail, or warn.
+
+## 1. Find what is missing
+
+The target list is models that are **listed in a Zen or Go plan** and carry
+**one** scored benchmark. Both filters matter:
+
+- A model no plan lists is a model about to be unlisted. A number for it
+  changes nothing, because nothing recommends it.
+- A model with no scored benchmark at all is a different problem (nothing to
+  pair with, and usually nothing published). A model with *one* is a missing
+  pair away from being ranked.
+
+```sh
+PYTHONPATH=. uv run python -c "
+from pathlib import Path
+from opencode_models.cli import _load
+from opencode_models.scoring import scales, derived_scores, canonical, _TRACKED
+from opencode_models.availability import load_available, offered
+from opencode_models import sources
+
+models, *_ = _load(Path('data'))
+table = scales(models)
+# availability is the provider's own snapshot, not the committed slug lists:
+# a model a plan has dropped is not worth a number
+offered = {m.model_id for tier, ids in load_available(Path('data')).items()
+           if ids for m in sources.members(models, ids)[0]}
+for m in models:
+    derived = derived_scores(m, table)
+    plan = next((t for t, ids in load_available(Path('data')).items()
+                 if ids and offered(m.model_id, ids)), None)
+    if not plan or len(derived) != 1:
+        continue
+    has = canonical(next(iter(derived)))
+    missing = [b.replace('Terminal-Bench ', 'TB ').replace('SWE-Bench ', 'SWE ')
+               for b in _TRACKED if canonical(b) != has]
+    print(f'{plan:4} {m.model_id:34} has {has:20} missing {\", \".join(missing)}')
+"
+```
+
+**Skip old and superseded models.** A nano, a mini, a two-generations-back
+release, and anything the provider is about to retire will not change a
+recommendation. Chase the new frontier and the opencode-exclusive ones first;
+those are where a second axis moves a row.
+
+Coverage per benchmark, for a wider view — the `scores` command prints one
+column per benchmark with model counts:
+
+```sh
+uv run opencode-models --data data scores
+```
+
+Filter that list down before spending time on it: an unreleased model or a
+fine-tune nobody benchmarks will never turn up a number, and a 7B model is
+not on Terminal-Bench at all. Prefer models that are **new, strong, and
+opencode-exclusive** — those are the ones where a missing score actually
+changes the ranking.
+
+## 2. Check what we already fetch first
+
+`data/boards/` holds the official boards, already parsed. If the model is on
+one of them, the score is already there and nothing needs writing:
+
+```sh
+python3 -c "
+import json
+for name in ('tbench', 'swebench'):
+    for r in json.load(open(f'data/boards/{name}.json')):
+        if 'grok' in r['model_name'].lower(): print(r)
+"
+```
+
+Those two boards are fetched by `opencode-models fetch` and merged by tier. Do
+not hand-copy a number that is already in there.
+
+**Checked and empty for the thin models (2026-10).** Of the 26 Zen/Go models
+sitting on exactly one axis, neither board holds a second scored axis for any
+of them: `tbench.json` carries only Terminal-Bench 4.0 rows we already have,
+and the one SWE-bench row that matches (Kimi K2.5) is Multilingual, which is
+not scored on. Do not re-run this check hoping for a different answer — it
+only changes when the boards themselves gain rows, and `fetch` reports that.
+
+## 3. Where to look, in order
+
+### Vendor pages, and what they actually publish
+
+Vendor launch pages **are** scrapable — `curl -sL` with a real User-Agent
+returns 200–300 KB of HTML — but for new frontier models they publish
+Terminal-Bench 4.0 and little else. Checked on Anthropic's Haiku 5.5 and
+Sonnet 5.5 pages and xAI's Grok 4.7 post: all three carry Terminal-Bench 4.0,
+none carries SWE-bench or Terminal-Bench 2.1.
+
+Normalise before concluding a page lacks a benchmark: vendor HTML writes
+"SWE‑bench" with U+2011, "SWE-bench™" with a trademark, and non-breaking
+spaces. A plain-space search misses all three and reports a false negative.
+
+```sh
+python3 - <<'EOF'
+import re, subprocess, unicodedata
+html = subprocess.run(["curl", "-sL", "--max-time", "30",
+                       "-H", "User-Agent: opencode-models/0.1", URL],
+                      capture_output=True, text=True).stdout
+for a, b in (("\u2011", "-"), ("\u00a0", " "), ("\u2122", ""), ("\u00ae", "")):
+    html = html.replace(a, b)
+html = unicodedata.normalize("NFKC", html)
+print(sorted({m.group(0) for m in
+              re.finditer(r"(terminal[\s-]*bench|swe[\s-]*bench)[^<>\n]{0,30}",
+                          html, re.I)}))
+EOF
+```
+
+This is the structural finding behind the thin-model list: the axis vendors
+publish is Terminal-Bench 4.0, and it is the one axis a model can be alone
+on. A model announced today will usually have exactly one scored axis.
+
+### Hugging Face model cards
+
+Public and reliable to read, and they carry the metrics a lab chose to
+publish. Kimi K3's card has Terminal-Bench 2.1 (88.3) in an HTML results
+table — the benchmark name is in one `<td>`, the numbers in the next ones, so
+parse the table rather than searching for a "name: value" pattern. MiMo-V2.5's
+card carries no scored axis at all. A 29-byte card means the repo name is
+wrong (`Entry not found`), not that the model is unbenchmarked — search
+`https://huggingface.co/api/models?search=<name>` for the real id.
+
+### Primary for opencode-exclusive and stealth models
+
+**OpenCode's own Reddit and Twitter** — `r/opencode` and the OpenCode
+accounts on X. These are where a model appears before it is in any
+aggregator: a stealth launch, a "we just shipped X" post, a screenshot of a
+leaderboard. They are also the weakest possible source: they are the
+vendor's own claim. Cite them as tier 3 unless the post links an
+independent run, and say so in the note.
+
+When a model is announced with no evaluation at all, that is a finding, not
+a blocker — write a file with no benchmarks? No. Leave it out and say the
+model is unbenchmarked, exactly as LongCat-2.5-Preview was.
+
+### Scrapable, verified
+
+| source | how | notes |
+|---|---|---|
+| **Hugging Face datasets-server** | `https://datasets-server.huggingface.co/rows?dataset=<org>/<name>&config=…&split=…&offset=0&length=100` | public JSON, no auth. Already used: `opencode-models fetch` reads arena Elo from `openaccess-ai-collective/chatbot-arena-elo-scores` (fields `elo_score`, `chatbot_name`) |
+| **Terminal-Bench 4.0 board** | `https://www.tbench.ai/leaderboard/terminal-bench/4.0` | parsed by `fetch`; per row: accuracy ± CI95, agent, reasoning effort, date, rank |
+| **SWE-bench** | `https://www.swebench.com/` | parsed by `fetch`; subsets Verified, Multilingual, Multimodal, Lite; `checked` entries only |
+| **aider polyglot** | `https://aider.chat/docs/leaderboards/` | a plain `<tr>` table — but its newest entry is GPT-5-era (Aug 2025), so only use it for older models, never for ranking current ones |
+
+### Verified NOT scrapable — do not waste a pass
+
+StepFun's model pages (JS shell, ~2KB served; numbers render in a browser),
+Artificial Analysis eval pages (e.g. `/evaluations/terminalbench-4-0`):
+machine-readable model registry with exact run slugs (which settles
+"Opus 5 vs 5.5" questions), but chart scores are client-rendered - only
+the top three are stated in the page prose. A screenshot transcription is
+not a source: one transcribed bar collided with the prose, so nine adopted
+cells were reverted. Per-model pages are 4MB app shells, no data API. Vals
+AI, Scale's SWE-Atlas, DeepSWE, LiveBench, the Epoch AI benchmarking
+dashboard, and the Open LLM Leaderboard HF space: all render their numbers in
+a browser. **Check whether the data is embedded before writing a source off**
+— tbench.ai looks exactly like one of these and is not, because a Next.js
+page streams the data it renders from. Look for `self.__next_f`,
+`<script type="application/json">`, or a `_next/data` route before giving up.
+
+## 4. When a source is protected: ask, precisely
+
+When the only remaining source is one a scraper cannot reach, hand the user a
+request they can answer in one sitting. Vague asks ("can you find benchmarks
+for X?") come back with nothing. Give them, per model, **only the axes it
+lacks** — asking for a number the catalog already holds wastes their time and
+yours:
+
+```
+Model:  moonshotai/kimi-k3  (Kimi K3)  — Zen
+Has:     Terminal-Bench 2.1  88.3
+Looking for (one of these is enough to make it rankable):
+  - SWE-Bench Verified (% resolved), or SWE-Bench Pro
+  - Terminal-Bench 4.0 (pass@1)
+What makes a number usable:
+  - which harness/agent ran it (Claude Code, Codex, mini-swe-agent, …)
+  - reasoning effort, if the board distinguishes it
+  - the date, and the CI or trial count if published
+  - the exact URL to the run, not a screenshot
+Why it matters: one axis is not a score (scoring.MIN_AXES), so this model is
+unranked and never recommended, however strong that one number is.
+```
+
+A bare score with no harness is worth far less than the ranking suggests —
+Terminal-Bench 2.x and 4.0 are different scales, and a run on a bespoke
+scaffold is not comparable with a standardized board.
+
+Batch the ask: one message listing the models, each with the single axis it
+most needs, beats 26 separate ones. Prioritise by how strong the model
+already looks on its one axis — a model at 88 on Terminal-Bench 2.1 that
+cannot be ranked is the most expensive gap in the console.
+
+## 5. Write the file
+
+`data/overrides/<lab>__<model>.json`, matching the upstream record filename.
+Format and full rules are in `data/overrides/README.md`; the short version:
+
+```json
+{
+  "model": {
+    "id": "stepfun/step-5-preview",
+    "note": "why this model needs an overlay, in one or two sentences",
+    "benchmarks": [
+      {
+        "name": "Terminal-Bench",
+        "version": "2.1",
+        "score": 85.0,
+        "metric": "pass@1",
+        "source": "https://…",
+        "note": "who ran it, when, on what scaffold, and any caveat"
+      }
+    ]
+  }
+}
+```
+
+Rules that are enforced, not advisory:
+
+- **`source` is required.** The loader drops an entry without one.
+- **`id` must name its lab** (`lab/model`), matching the catalog.
+- **The key is (`name`, `version`)**, the same key the catalog uses — a
+  benchmark with no version lands on its own axis.
+- **Do not add a model file for a model that has no upstream record.** The
+  entry would sit there matching nothing.
+- Nothing ever writes here. `fetch` refuses to touch `data/overrides/`.
+
+Source tiers, which decide whether your value applies:
+
+| tier | kind | example |
+|---|---|---|
+| 1 | independent evaluator, one harness | artificialanalysis.ai |
+| 2 | official board, scaffold recorded per row | tbench.ai, swebench.com |
+| 3 | vendor post, card, aggregator | x.ai, opencode posts, benchmarklist.com |
+
+A tier-1 override replaces a tier-3 upstream number. A tier-3 claim against
+an independent upstream is **recorded but not applied** — it shows up in
+`conflicts` and the upstream value stays. Choose the source honestly; the
+tier decides the outcome anyway.
+
+## 6. Verify
+
+```sh
+just test                                    # guard tests read the real files
+uv run opencode-models --data data conflicts   # did it apply, or just get noted?
+uv run opencode-models --data data list --benchmark "Terminal-Bench 2.1"
+```
+
+What to look for:
+
+1. `just test` — the committed overrides are checked for a `source` on every
+   entry and a lab-qualified id. A file that fails here is not loadable.
+2. `conflicts` — `override wins` means your value is in the view;
+   `override noted, upstream kept` means your source was tiered *below* the
+   one already there, so nothing changed. That is the tier policy working,
+   not a bug.
+3. `list --benchmark "Terminal-Bench 2.1"` — the model should appear, with
+   `*` beside its name marking it curated.
+
+If a model you expected to be picked does not appear, the most likely cause
+is the tier: a vendor number cannot displace an independent one.
+
+## Etiquette
+
+One sequential pass per source, real `User-Agent: opencode-models/0.1`, 30s
+timeouts. No credentials, no telemetry, no scraping a source that asks not
+to be scraped. A board that publishes a JSON API is meant to be read; a
+social feed is meant to be read by a person.

opencode_models-0.1.0/.plan/.TEMPLATE.md

@@ -0,0 +1,22 @@
+---
+status: open
+type: feature
+priority: medium
+area: backend
+---
+
+## Notes
+
+Short description and context. Agents append progress notes below, newest first. Do not edit existing lines — append
+only.
+
+## Status values
+
+| status        | meaning                                                       |
+| ------------- | ------------------------------------------------------------- |
+| `idea`        | aspirational — not fully settled, not ready to start          |
+| `backlog`     | accepted but deferred — consider when stepping back to plan   |
+| `open`        | ready to be picked up                                         |
+| `in-progress` | actively being worked on                                      |
+| `blocked`     | cannot proceed; note the blocker in the body                  |
+| `done`        | completed                                                     |

opencode_models-0.1.0/.plan/.schema.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "description": "Schema for .plan/*.md YAML frontmatter. Filename (without .md) is the unique task key.",
+  "type": "object",
+  "required": ["status", "type", "priority"],
+  "properties": {
+    "status": {
+      "enum": ["idea", "backlog", "open", "in-progress", "blocked", "done"]
+    },
+    "type": {
+      "enum": ["bug", "feature", "chore", "decision", "perf"]
+    },
+    "priority": {
+      "enum": ["high", "medium", "low"]
+    },
+    "area": {
+      "description": "Optional grouping label for filtering (e.g. backend, frontend, devops, testing)",
+      "type": "string"
+    }
+  },
+  "additionalProperties": false
+}

opencode_models-0.1.0/.plan/public-release.md

@@ -0,0 +1,67 @@
+---
+status: in-progress
+type: chore
+priority: high
+area: devops
+---
+
+## Notes
+
+Public-release hardening, decided 2026-10-20. Decisions (same day, with
+maintainer — they supersede the plan below where they differ): the
+email stays everywhere (`codesam` name is fine too) — LICENSE,
+commit identities, pyproject contact unchanged, no history rewrite.
+README contact paths are GitHub issues + private security advisories
+only. The gitleaks pre-commit hook needs its own toolchain
+(golang/docker image) or a system binary — fails the local-and-cheap
+test, so the local audit-grep hook stands in and CI keeps running real
+gitleaks.
+
+## Steps
+
+- [x] 1. ~~LICENSE identity + history rewrite.~~ DROPPED by decision:
+  email and `codesam` name stay as-is everywhere; no rewrite, no
+  force-push.
+- [x] 2. README due-diligence paragraph on benchmark data (GitHub-only
+  contact paths). Added as "### Data due diligence" under ## Data.
+- [x] 3. Client-side git hooks, no new installs (`.githooks/`, wired via
+  `just bootstrap` without clobbering an existing `core.hooksPath`):
+  `pre-push` refuses `refs/heads/local-data`; `pre-commit` runs the
+  secret-pattern sweep and `ruff check` + `ruff format --check` via the
+  project's own venv, with a graceful skip when ruff is unavailable.
+  Verified: pre-commit passes on a clean tree, fails on planted token
+  fixtures (a fake GitHub PAT and a fake AWS key); pre-push refuses a
+  `local-data` push and allows normal branches (scratch-repo end-to-end
+  run).
+
+## Open questions — all settled 2026-10-20 (see Notes above for answers)
+
+- Q1: commit identities — settled: leave unchanged.
+- Q2: `pyproject.toml` author contact — settled: leave unchanged.
+- Q3: due-diligence paragraph contact path — settled: GitHub issues +
+  private security advisories.
+
+## Verification (revised — no rewrite, no force-push anywhere)
+
+- `just lint`, `just test` green on a fresh checkout after `just bootstrap`.
+- Hooks fire on trial runs: `pre-commit` blocks a planted secret-pattern
+  file and fails a planted lint violation; `pre-push` refuses a
+  `local-data` push and allows a normal branch push.
+- `git config core.hooksPath` untouched when already set to something
+  else (bootstrap must not clobber an existing hooks setup).
+
+## Remaining scope (reopened 2026-10-20 — not started, needs direction)
+
+- [ ] Release process: reserve the PyPI name with a first publish;
+  single-source the version (currently hardcoded in `pyproject.toml`
+  and as the `opencode-rank/0.1` User-Agent); add CHANGELOG.md;
+  tag-triggered publish workflow.
+- [ ] Repo hygiene: CONTRIBUTING.md only — decided against issue/PR
+  templates and against a CODE_OF_CONDUCT (small single-maintainer tool;
+  GitHub issues + private security advisories already cover reporting).
+- [ ] GitHub push protection + secret scanning at public-launch time
+  (free for public repos; the local grep and CI gitleaks stay as the
+  pre-launch layers).
+- [ ] Source-site Terms of Service review for republished benchmark
+  numbers — deferred counsel work; the README due-diligence note is the
+  interim public stance.

opencode_models-0.1.0/.plan/robustness.md

@@ -0,0 +1,22 @@
+---
+status: in-progress
+type: feature
+priority: high
+area: cli
+---
+
+## Notes
+
+`fetch` dies with a traceback when the catalog sitemap is unreachable, and
+`list` / `next` / `models` silently use arbitrarily old snapshots. Two
+fixes, both in console output behavior, no ranking changes:
+
+1. Catalog fetch failure degrades to a warning (`keeping existing records`),
+   same shape as the existing per-source warnings. Exit code stays 0.
+2. `list`, `next`, and the `models` snapshot path warn per tier when a
+   `tier_prices/<tier>.json` snapshot is older than 7 days
+   (`STALE_AFTER_DAYS`), by file mtime. Missing files stay silent (unknown
+   is already reported as unknown).
+
+Out of scope: exit-code changes, auto-refresh, freshness of `data/available`
+(keyed runs re-fetch it live), docs beyond one README line.