feat(model): per-model context limits and pricing, generated from Cursor's docs (#89)

* feat(model): per-model context window limits from Cursor docs

* feat(model): per-model pricing from Cursor docs for TUI cost display

* feat(model): per-model output limits for high-output frontier models

* fix(model): emit limits and cost on the config channel opencode reads

* feat(model): generate context limits and pricing from Cursor docs

* docs(model): point MODEL_OUTPUT_LIMITS edits at the generator template

* fix(model): make the model-data drift check unable to pass without checking

The drift mechanism had three ways to report success without having
verified anything, and the function holding every hard contract had no
test coverage.

- Remove the fail-open CLI guard. `isInvokedDirectly()` compared
  `process.argv[1]` against `import.meta.url`; on any invocation where
  they differ, `main()` never ran and the process exited 0 having done
  nothing. The symlink fix addressed one instance, not the class. The
  generator module is now import-pure and `scripts/sync-model-limits-cli.mjs`
  calls `main()` unconditionally. Verified through a symlink, an absolute
  path from another cwd, and `npm exec`.
- The CI step now captures stdout and requires the run summary line, so
  "exited 0 having done nothing" fails instead of passing for free.
- An empty price cell no longer becomes $0. `parseDocsTable` leaves an
  absent cell unset (distinct from present-but-empty) and throws when a
  requested column is missing from a row; `parsePrice("")` throws.
  `"-"` still means $0, which is what Cursor documents it as.
- `generate()` takes injectable `modelIds`/`overrides`, so strict
  overrides, ambiguity on both tables, docs-over-override precedence and
  the deterministic sort are exercised against the fixtures rather than
  resting on one-time manual probes. `normalizeForComparison` is covered
  too: it is what keeps `--check` from failing daily.
- Matching consults the `Provider` column. `claude`/`gpt` are dropped from
  both sides to survive word-order differences, which also discarded vendor
  identity; an id naming a dropped vendor now matches only a row whose
  Provider agrees. Counts unchanged: 29 exact / 0 ambiguous on context,
  27 exact / 6 overridden on pricing.
- Fixtures gain the verbatim `Claude Opus 4.7 (fast mode)` row ($30/$150,
  6x Opus's rate) and assert `claude-opus-4-7` refuses it.
- Write-mode I/O failure exits 2, not 1: a failed write does not establish
  that the committed file is stale.
- `Synced:` relabelled `Data last changed:`. Write mode short-circuits when
  only the date would move, so the committed date was never a verification
  date and read as though the file were a year stale.
- `schedule`/`workflow_dispatch` are workflow-wide triggers, so `build` and
  `integration` are now scoped to push/pull_request.
- `SOURCES.context` points at the URL that currently serves markdown. The
  `.md` form began returning HTTP 404, which made every run exit 2 — the
  scheduled job's exit-2-is-a-warning branch would have swallowed that
  indefinitely. No emitted value changes.

Zero numeric values change in the regenerated `src/model-limits.ts`: key
sets, key order, `DEFAULT_*`, `MODEL_OUTPUT_LIMITS` and all three
`resolve*` functions are byte-identical. The only diff is the header.

Tests 416 -> 442. Each new test was mutation-checked against the
pre-change behaviour to confirm it can fail.

* fix(model): use .md doc URLs and fail the drift job on unverified

Two corrections to the drift check:

- SOURCES.context pointed at the extensionless docs URL, justified by a
  comment claiming the .md form returned 404. Not reproducible: measured
  against both URL shapes, the .md form returns the markdown table under
  both a markdown-preferring and a wildcard Accept header, while the
  extensionless form returns a ~110KB HTML page under a wildcard Accept.
  The .md form does not depend on the Accept header staying
  markdown-preferring, so both sources now use it. Comment corrected to
  the measured behavior.

- Exit 2 (docs unreachable/unparseable, or a model id matching nothing)
  annotated a warning and exited 0, so a permanently broken check would
  pass every week indefinitely. It now fails the job: unverified is not
  the same as verified-clean.

Regenerated output changes one line, the source URL recorded in the
generated header. No numeric value changed.

Author: justin-carper

.github/workflows/ci.yml

@@ -1,16 +1,25 @@
 name: CI
 
+# `schedule` and `workflow_dispatch` exist for the model-data-drift job only.
+# Triggers are workflow-wide in Actions, so every job below carries an `if:`
+# that scopes it to the events it is actually for.
 on:
   push:
     branches: ["**"]
   pull_request:
+  schedule:
+    - cron: "0 9 * * 1"
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
   build:
     name: typecheck · test · build (node ${{ matrix.node-version }})
+    # Code CI only. The weekly cron and manual dispatch exist for
+    # model-data-drift; re-running the matrix on them buys nothing.
+    if: github.event_name == 'push' || github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -45,8 +54,56 @@ jobs:
       - name: Build
         run: npm run build
 
+  model-data-drift:
+    name: model limits · drift vs Cursor docs
+    # Deliberately not on pull_request: this job reaches cursor.com, and PR CI
+    # stays hermetic.
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: "24.x"
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check committed model limits against Cursor docs
+        run: |
+          log="$RUNNER_TEMP/drift.log"
+          set +e
+          npm run sync:model-limits -- --check 2>&1 | tee "$log"
+          code=${PIPESTATUS[0]}
+          set -e
+          if [ "$code" = "1" ]; then
+            echo "::error::src/model-limits.ts is stale. Run 'npm run sync:model-limits' and commit."
+            exit 1
+          fi
+          if [ "$code" = "2" ]; then
+            echo "::error::Could not verify model data (docs unreachable, unparseable, or a model id matched nothing). The drift check did not run — treat this as unverified, not as passing."
+            exit 1
+          fi
+          if [ "$code" != "0" ]; then
+            echo "::error::Unexpected exit code $code from the drift check."
+            exit "$code"
+          fi
+          # Exit 0 is only trustworthy if the run also reported its summary. A
+          # bare 0 is what "did nothing at all" looks like, and that has
+          # happened: an entry-point guard once skipped main() entirely and the
+          # job passed for free. Demand the evidence, not just the code.
+          if ! grep -qE 'sync-model-limits: src/model-limits\.ts is up to date \(context: [0-9]+ from docs, [0-9]+ overridden \| cost: [0-9]+ from docs, [0-9]+ overridden \| [0-9]+ model ids\)' "$log"; then
+            echo "::error::Drift check exited 0 without printing a run summary — it did not actually verify anything."
+            exit 1
+          fi
+
   integration:
     name: e2e · opencode loads plugin & lists models
+    # Code CI only, same reason as `build`.
+    if: github.event_name == 'push' || github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7

package.json

@@ -53,6 +53,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:e2e": "vitest run --config vitest.e2e.config.ts --passWithNoTests",
+    "sync:model-limits": "node scripts/sync-model-limits-cli.mjs",
     "prepublishOnly": "npm run typecheck && npm test && npm run build"
   },
   "dependencies": {

scripts/sync-model-limits-cli.mjs

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+/**
+ * CLI entry point for `scripts/sync-model-limits.mjs`.
+ *
+ * This file exists so the generator module stays import-pure (the tests import
+ * it) without needing an "am I the entry point?" guard inside it. Such a guard
+ * — comparing `process.argv[1]` against `import.meta.url` — is fail-open: on
+ * any invocation where the two differ (a symlinked path, a wrapper, an exec
+ * shim) `main()` never runs and the process exits 0 having done nothing, which
+ * makes the scheduled drift check permanently green and permanently useless.
+ * That already happened once, via a symlinked `/tmp` path on macOS.
+ *
+ * There is no guard here. Running this file always runs `main()`.
+ */
+import { main } from "./sync-model-limits.mjs";
+
+process.exitCode = await main(process.argv.slice(2));

scripts/sync-model-limits.d.mts

@@ -0,0 +1,56 @@
+/**
+ * Types for `sync-model-limits.mjs`. The script is plain ESM JavaScript (it
+ * runs via `node` with no build step), but `tsconfig.json` includes `test`, so
+ * `test/sync-model-limits.test.ts` needs a declaration to import it.
+ *
+ * This mirror is hand-maintained. `allowJs: true` would remove the need for it,
+ * but it does not work in this repo: it pulls `src/sidecar/agent-host.mjs` into
+ * the program, and that file assigns to `console.log`, which strips `log`,
+ * `debug`, `info`, `warn`, and `error` off the global `Console` type and breaks
+ * 30 checks in existing `.ts` files. Measured, not assumed — see
+ * `.superpowers/sdd/task-6-report.md`. Two things keep this file honest in the
+ * meantime: `test/sync-model-limits.test.ts` asserts the module's runtime
+ * export names match the list declared here, and the tests call every declared
+ * signature, so a parameter that is declared but missing (or vice versa) fails
+ * `npm run typecheck`.
+ */
+
+export type DocsRow = Record<string, string>;
+
+export type ModelCost = {
+  input: number;
+  output: number;
+  cacheRead: number;
+  cacheWrite: number;
+};
+
+export type MatchResult =
+  | { row: DocsRow; ambiguous?: never }
+  | { row?: never; ambiguous: string[] };
+
+export declare const SOURCES: { context: string; pricing: string };
+export declare const MODEL_IDS: string[];
+export declare const OVERRIDES: Record<
+  string,
+  { context?: number; cost?: ModelCost; why: string }
+>;
+
+export declare function parseDocsTable(md: string, columnNames: string[]): DocsRow[];
+export declare function parseTokens(text: string): number | undefined;
+export declare function parsePrice(text: string): number;
+export declare function matchModelId(id: string, docRows: DocsRow[]): MatchResult | undefined;
+export declare function normalizeForComparison(text: string): string;
+export declare function generate(input: {
+  contextMd: string;
+  pricingMd: string;
+  modelIds?: readonly string[];
+  overrides?: Record<string, { context?: number; cost?: ModelCost; why?: string }>;
+  date?: string;
+}): {
+  text: string;
+  stats: {
+    context: { matched: number; overridden: number };
+    cost: { matched: number; overridden: number };
+  };
+};
+export declare function main(argv: string[]): Promise<number>;