[pierreraby]

Requested version and channel

• Version: 0.8.1 (patch), stable channel -> npm latest, GitHub Release stable/non-draft.
• Authorization: prepared on explicit maintainer request in the current session. Merge and the v0.8.1 tag remain separate approvals; this PR does not publish anything.

Pre-release state recorded (2026-11-09T05:14Z)

• npm dist-tags: latest = 0.8.0, next = 0.7.3-next.0 (unchanged by this PR).
• Latest GitHub Release: v0.8.0.
• npm view pi-commandcode-provider@0.8.1 -> E404 / No match found for version 0.8.1 while the package lookup returns 0.8.0, so the version is unused; no local or remote v0.8.1 tag exists.
• Last release run 42125188180 finished; no release in flight.

What is included

• #209 — capability snapshot command-code@1.88.3 -> 1.88.5 and reviewed pricing refresh. No external contributors reported or authored this work.
• #208 is CI-only and already on main; it changes no published behaviour and is not the reason for this release.

Why a patch now

RELEASE.md asks maintainers to prioritize broken auth/transport, missing paid-model pricing and host compatibility regressions, and to propose a patch release when a verified user-facing fix is ready. Until now, deepseek/deepseek-v4.1-flash-ultrafast was served by the live /provider/v1/models list with ZERO_MODEL_COST, an unknown price status, text-only input, no reasoning flag and no effort levels, although it is billed at $2.40/$9.60 per million tokens. This is not a release for a CLI version-only delta.

User-visible changes

• Reviewed display prices for the ultrafast model: $2.40 input, $9.60 output, $0.048 cache read per million tokens, no cache-write charge, single published rate. Before this release the same model displayed a zero estimate plus an unknown-price warning; the billing usage page remains authoritative.
• Image input, reasoning and selectable efforts off/low/high/max for that model.
• Retired poolside/laguna-s-2.1-free metadata and its free price entry. It already disappeared from the live model list, so users see no functional change there.

Migration and known limitations

• No migration: no API, config, credential or routing change; endpoint routing defaults are unchanged.
• The model list itself never depended on a release, so this patch does not add access to new models — it adds their reviewed capabilities and prices.
• Models without a published output limit keep the shared 65,536-token default, capped by the context window (this applies to the ultrafast model).
• Validation is synthetic/registry based: no live login, no billed inference, no claim about account entitlement or billing accuracy.

Local checks (before opening this PR)

• npm test with PI_LOCAL_REQUIRED=1 OMP_COMPAT_REQUIRED=1: PASS with real hosts Pi 1.5.0, Oh My Pi 18.16.0 and Bun 1.4.4; the host-contract suites pass for all three protocols on both hosts and the endpoint-routing suite passes on both.
• npm run format:check, npm audit --audit-level=moderate (0 vulnerabilities), npm pack --dry-run (31 files, 278.1 kB), git diff --check: PASS.
• actionlint is not installed locally; the CI format job validates the workflows with rhysd/actionlint:1.7.7.
• Diff is limited to package.json, package-lock.json and CHANGELOG.md.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[pierreraby]

Memory benchmark rerun: the first attempt failed before any repository code ran, while oven-sh/setup-bun@v2.2.0 downloaded Bun 1.4.4 — Unexpected HTTP response: 504 twice, then the action gave up (job log, 2026-11-09T05:17Z). No benchmark step executed and the release diff only changes package.json, package-lock.json and CHANGELOG.md, so I reran the failed job rather than changing anything. The rest of CI was already green on this exact head.

[github-actions]

Memory benchmark

Compared base 84cf674 with PR head 66acd1a on the same GitHub-hosted darwin runner. Lower values are better.

Metric	Base	PR	PR − Base	Change
Stable RSS	107.0 MiB ± 0.2 MiB	106.6 MiB ± 0.4 MiB	-0.3 MiB ± 0.6 MiB	-0.3%
Physical footprint	61.5 MiB ± 0.4 MiB	60.6 MiB ± 0.7 MiB	-1.1 MiB ± 0.7 MiB	-1.7%
Physical peak	73.2 MiB ± 0.6 MiB	71.6 MiB ± 0.6 MiB	-1.4 MiB ± 1.4 MiB	-2.0%

Interpretation: Differences larger than their measured MAD: Physical footprint -1.1 MiB ± 0.7 MiB, Physical peak -1.4 MiB ± 1.4 MiB.

Extension overhead above pi baseline

Metric	Base overhead	PR overhead	Difference
Stable RSS	+5.5 MiB ± 0.8 MiB	+5.3 MiB ± 1.3 MiB	-0.3 MiB ± 0.6 MiB
Physical footprint	+4.1 MiB ± 1.1 MiB	+3.6 MiB ± 0.5 MiB	-1.1 MiB ± 0.7 MiB
Physical peak	+4.9 MiB ± 2.2 MiB	+4.2 MiB ± 1.2 MiB	-1.4 MiB ± 1.4 MiB

Values are medians of 6 alternating, paired runs. The value after ± is the median absolute deviation (MAD). Each process was sampled 12 times after a 2500 ms warm-up.

Environment: pi 0.84.4, Bun 1.4.4, darwin arm64. RSS comes from ps; physical footprint and peak come from macOS footprint.

This is a comparative signal, not a pass/fail threshold. GitHub-hosted runner noise can affect absolute values.

[pierreraby]

Release run 42567186925 failed in checks / Oh My Pi compatibility, before package/publish/verify. Nothing was published: npm view pi-commandcode-provider@0.8.1 still returns E404 and latest is still 0.8.0.

Failure detail (test:routing-hosts, corrupted-routing-file fallback scenario): omp: must emit a real request. The loopback mock never received a POST for that prompt, and the host surfaced a production-style 401 Invalid 'Authorization' header or token on an openai-responses request, while the extension's own catalog fetch had succeeded against the mock (source: live, refresh: idle, 3 models) and /commandcode-status reported last request: none with route: unknown.

The same tree and the same Oh My Pi version 18.18.3 passed the very same test:routing-hosts command on main CI run 42566976976 three minutes earlier, and on this PR's CI. The release commit only changes package.json, package-lock.json and CHANGELOG.md, so this is intermittent rather than attributable to the release diff.

I reran only the failed job. A green rerun does not prove the race is gone — no POST reaching the mock while the host still produced a production 401 points at a host/provider registration ordering issue worth its own investigation, tracked as follow-up rather than dismissed as a flake.