pi-commandcode-provider 0.7.7

• Recognize the off reasoning effort now published for the DeepSeek V4 and V4.1 models, so the catalog parser no longer rejects it and the generate transport never forwards off as reasoning_effort. The Provider API and Oh My Pi adapters translate the level from the model's thinking metadata on their own wire.
• Refresh the static capability snapshot to command-code@1.79.2: add claude-haiku-5-5, mistral/mistral-large-4 (image input, 262K output limit), and the free stealth/glyph-cluster:free; retire stealth/pixel-canary and stealth/space-bunny-alpha.
• Add reviewed display pricing for the refreshed catalog — claude-haiku-5-5 with its 100K long-context tier, mistral/mistral-large-4, and the free stealth/glyph-cluster:free — drop the retired stealth/space-bunny-alpha, and correct the claude-sonnet-5-5 cache-read rate to $0.10 per million tokens, verified against the official pricing page on 2026-10-09. The snapshot now covers all 87 advertised models.
• Fix 400 input[N].call_id failures on the /alpha/generate fallback by shortening compound Responses tool-call ids (<call_id>|<item_id>, 73 characters in the reported session) to the 64-character wire limit. The mapping is deterministic per request and shared by tool calls and their results, so pairing is preserved and distinct ids never collide; short ids pass through unchanged and the Provider API path is untouched (#141).
• Replay prior assistant reasoning on the generate transport so the model can see its own earlier thinking on follow-up turns, matching the Command Code CLI's /alpha/generate wire (toWireMessages in command-code@1.79.2), which replays every thinking block as a reasoning part with no model check and no signature. Prior reasoning was dropped in 0.5.0, which made multi-turn tasks whose state lives only in thinking — plans, games, consistency checks — silently re-decide on the fallback transport.
• Reject local OAuth callback requests that carry an untrusted browser Origin before any callback payload is processed, so a cross-origin forged text/plain POST (including a forged access_denied) can no longer terminate a pending browser login (#149). Origin-less local clients, the trusted Command Code/localhost origins, and the state-mismatch flow are unchanged.

Contributors

• @sandexzx — refreshed the Command Code catalog to 1.79.2, taught the parser the new off reasoning effort, and added the matching reviewed pricing (#145).
• @szpoont — reported the generate fallback's call_id length failures with a reproducible session export (#141).
• @LongLongBigInt — diagnosed the dropped assistant reasoning across generate turns and contributed the replay fix with cumulative fixtures (#146, #148).
• @karaaslanz — hardened the local OAuth callback against forged browser origins and caught the short-ID collision edge case in the tool-call ID fix (#144, #149).

Validation

• Release CI and packed/registry package tests with real Pi and OMP against mock APIs.
• No live Command Code account test is performed by this workflow.
• Commit: b61093d
• Release workflow