Sync public snapshot from freebuff-private

Source: CodebuffAI/freebuff-private@d3dada203e5b8f899197ab09fb07e25d077b000b

Author: github-actions[bot]

agents/base-chat.ts

@@ -63,6 +63,8 @@ End every response by calling the suggest_followups tool with exactly 3 followup
       // DEFAULT_CONTEXT_WINDOW and got a 52k budget on a million-token model.
       'openai/gpt-5.6-luna': 1_000_000,
       'meta/muse-spark-1.2-contributor': 1_000_000,
+      // Ox Alpha: 1,048,576 published, entered low for the same reason.
+      'stealth/ox-alpha': 1_000_000,
     }
 
     /** For any model not listed above. Assuming a window is smaller than it is

bun.lock

@@ -694,6 +694,8 @@ describe('every freebuff root agent declares a prompt opening', () => {
     'base2-free-luna-max': BASE2,
     // Web-only Muse Spark root; createBase2('free', …) like its siblings.
     'base2-free-muse-spark': BASE2,
+    // Web/Cloud-only Ox Alpha root; createBase2('free', …) like its siblings.
+    'base2-free-ox-alpha': BASE2,
     'base2-free-cloud-planner': CLOUD_PLANNER,
     'base2-free-cloud-planner-limited': CLOUD_PLANNER,
     // Desktop threads compose their prompt onto base3's, so position 0 matches.

common/src/__tests__/free-agents.test.ts

@@ -0,0 +1,215 @@
+/**
+ * Ox Alpha is a Web/Cloud-only row served at a list price of zero by an
+ * anonymous host, and every unusual thing about it is unusual on purpose. These
+ * tests pin the three decisions that a later reader would otherwise correct
+ * back to convention: it is metered by no pool, it warns without claiming a
+ * training grant, and it names its own reasoning effort rather than taking the
+ * provider's.
+ */
+import { describe, expect, it } from 'bun:test'
+
+import {
+  FREEBUFF_MODELS,
+  FREEBUFF_SERVICE_ONLY_MODEL_IDS,
+  FREEBUFF_WEB_GEO_EXEMPT_MODEL_IDS,
+  FREEBUFF_WEB_LIMITED_MODEL_IDS,
+  isFreebuffServiceOnlyModelId,
+  isFreebuffSessionModelAllowedForAccessTier,
+  isFreebuffWebModelAllowedForLimitedTier,
+  LIMITED_FREEBUFF_MODEL_IDS,
+  FREEBUFF_MODEL_CONTEXT_WINDOWS,
+  FREEBUFF_OX_ALPHA_MAX_PRICE,
+  FREEBUFF_OX_ALPHA_MODEL_ID,
+  FREEBUFF_MIMO_V25_MODEL_ID,
+  FREEBUFF_STANDARD_MODEL_IDS,
+  FREEBUFF_TRACED_MODEL_IDS,
+  FREEBUFF_WEB_ALL_MODELS,
+  FREEBUFF_WEB_GOD_ONLY_MODEL_IDS,
+  FREEBUFF_WEB_MODELS,
+  FREEBUFF_WEB_PREMIUM_MODEL_IDS,
+  getFreebuffModelReasoningEffort,
+  isFreebuffOxAlphaModelId,
+  isFreebuffWebModelId,
+  SUPPORTED_FREEBUFF_MODELS,
+} from '../constants/freebuff-models'
+import {
+  FREEBUFF_ROOT_AGENT_IDS,
+  FREEBUFF_ROOT_AGENT_ID_BY_MODEL,
+  FREEBUFF_WEB_BASE3_AGENT_ID_BY_MODEL,
+  FREEBUFF_CLI_BASE3_AGENT_ID_BY_MODEL,
+  FREE_MODE_AGENT_MODELS,
+} from '../constants/free-agents'
+
+const OX = FREEBUFF_OX_ALPHA_MODEL_ID
+const row = FREEBUFF_WEB_MODELS.find((m) => m.id === OX)
+
+describe('Ox Alpha is a Web/Cloud row', () => {
+  it('is offered on the browser surfaces and to every user', () => {
+    expect(row).toBeDefined()
+    expect(isFreebuffWebModelId(OX)).toBe(true)
+    // Not a god-only test row — this one is meant to carry real traffic.
+    expect(FREEBUFF_WEB_GOD_ONLY_MODEL_IDS as readonly string[]).not.toContain(
+      OX,
+    )
+  })
+
+  it('stays off the CLI and Desktop', () => {
+    // The absence from these two lists IS the surface gate: FREEBUFF_MODELS is
+    // the CLI/Desktop catalog and SUPPORTED_FREEBUFF_MODELS is what
+    // isFreebuffSessionModelId admits there. Adding it to either ships the
+    // model to surfaces whose capacity we have not agreed to spend yet.
+    expect(FREEBUFF_MODELS.map((m) => m.id)).not.toContain(OX)
+    expect(SUPPORTED_FREEBUFF_MODELS.map((m) => m.id)).not.toContain(OX)
+    expect(FREEBUFF_CLI_BASE3_AGENT_ID_BY_MODEL[OX]).toBeUndefined()
+    expect(FREEBUFF_WEB_ALL_MODELS.map((m) => m.id)).toContain(OX)
+  })
+
+  it('matches dated builds of itself, so a variant cannot escape the fence', () => {
+    expect(isFreebuffOxAlphaModelId(OX)).toBe(true)
+    expect(isFreebuffOxAlphaModelId('stealth/ox-alpha-20260820')).toBe(true)
+    expect(isFreebuffOxAlphaModelId('stealth/ox-beta')).toBe(false)
+    expect(isFreebuffOxAlphaModelId(null)).toBe(false)
+  })
+})
+
+describe('Ox Alpha is metered by no pool, and that rests on the price fence', () => {
+  it('is standard rather than premium', () => {
+    expect(row?.premium).toBe(false)
+    expect(FREEBUFF_WEB_PREMIUM_MODEL_IDS as readonly string[]).not.toContain(
+      OX,
+    )
+    expect(FREEBUFF_STANDARD_MODEL_IDS).toContain(OX)
+  })
+
+  it('fences the price at exactly zero', () => {
+    // The two numbers are the whole justification for the assertion above. A
+    // ceiling above zero admits a repriced endpoint, and this row has no pool
+    // to bound what that would cost — so raising either of these without also
+    // giving the model a quota is the mistake this test exists to stop.
+    expect(FREEBUFF_OX_ALPHA_MAX_PRICE.prompt).toBe(0)
+    expect(FREEBUFF_OX_ALPHA_MAX_PRICE.completion).toBe(0)
+  })
+})
+
+describe('Ox Alpha discloses retention without claiming a training grant', () => {
+  it('warns, while staying dataUse: service', () => {
+    // The one row in the catalog where a warning does NOT imply
+    // `dataUse: 'training'`. OpenRouter's stealth terms say the host retains
+    // prompts and completions and does not train on them, so the warning is
+    // owed and the training label is not. `dataUse` is machine-readable and
+    // drives trace storage, which is why it may not be used as a stand-in for
+    // "something to disclose".
+    expect(row?.warning).toBeDefined()
+    expect(row?.dataUse).toBe('service')
+    expect(FREEBUFF_TRACED_MODEL_IDS as readonly string[]).not.toContain(OX)
+  })
+})
+
+describe('Ox Alpha names its own reasoning effort', () => {
+  it('sends high, not the provider default of max', () => {
+    // Reasoning is MANDATORY on this model and the provider's default rung is
+    // `max` — measured at ~4x the completion tokens and ~4x the latency of
+    // `high`, with samples truncated mid-answer. An unset effort here is not a
+    // neutral choice; it is that rung.
+    expect(getFreebuffModelReasoningEffort(OX)).toBe('high')
+    expect(row?.efforts).toEqual(['low', 'high', 'max'])
+    expect(row?.defaultEffort).toBe('high')
+  })
+
+  it('carries a context window rather than falling back to the default', () => {
+    // Absent, base-chat budgets a million-token model 131,072 and summarizes a
+    // thread ~8x early, throwing away the prompt cache each time.
+    expect(FREEBUFF_MODEL_CONTEXT_WINDOWS[OX]).toBe(1_000_000)
+  })
+})
+
+describe('Ox Alpha is registered everywhere a root must be', () => {
+  it('has a base2 and a base3 root, both allowlisted and both pinned', () => {
+    expect(FREEBUFF_ROOT_AGENT_ID_BY_MODEL[OX]).toBe('base2-free-ox-alpha')
+    expect(FREEBUFF_WEB_BASE3_AGENT_ID_BY_MODEL[OX]).toBe('base3-free-ox-alpha')
+    for (const id of ['base2-free-ox-alpha', 'base3-free-ox-alpha']) {
+      // Missing from this list, the root's own requests 403 with
+      // free_mode_invalid_agent_hierarchy.
+      expect(FREEBUFF_ROOT_AGENT_IDS as readonly string[]).toContain(id)
+      // Pinned to exactly one model: a root that allows more than one is a
+      // door onto everything else it allows.
+      expect([...(FREE_MODE_AGENT_MODELS[id] ?? [])]).toEqual([OX])
+    }
+  })
+})
+
+describe('Ox Alpha reaches limited-tier regions', () => {
+  it('is offered and admitted at limited tier', () => {
+    // Both halves, because they are enforced in different places and only one
+    // of them is visible to a user: the picker list decides whether the row is
+    // drawn, and the session gate decides whether their first send works. A row
+    // that passes one and fails the other is the exact shape of the GLM/Desktop
+    // bug freebuff-offer-invariants.ts was written for.
+    expect(isFreebuffWebModelAllowedForLimitedTier(OX)).toBe(true)
+    expect(isFreebuffSessionModelAllowedForAccessTier(OX, 'limited')).toBe(true)
+    expect(FREEBUFF_WEB_LIMITED_MODEL_IDS).toContain(OX)
+    expect(FREEBUFF_WEB_GEO_EXEMPT_MODEL_IDS as readonly string[]).toContain(OX)
+  })
+
+  it('reaches limited regions WITHOUT joining the CLI/Desktop limited catalog', () => {
+    // The split is the whole trick. LIMITED_FREEBUFF_MODEL_IDS maps over
+    // SUPPORTED_FREEBUFF_MODELS and feeds the CLI picker, the home FAQ and the
+    // README, so adding a Web/Cloud-only row there would advertise it on
+    // surfaces that cannot run it — and `LIMITED_FREEBUFF_MODELS` would carry an
+    // `undefined!` where the row should be.
+    expect(LIMITED_FREEBUFF_MODEL_IDS as readonly string[]).not.toContain(OX)
+  })
+
+  it('still costs the limited pool nothing extra', () => {
+    // The limited tier is metered by REGION, not by model: every limited
+    // session draws on the same pool whichever row it picks. This widens what
+    // those users may choose, never how much they get — so no quota list
+    // mentions the model, and none should.
+    expect(FREEBUFF_WEB_PREMIUM_MODEL_IDS as readonly string[]).not.toContain(
+      OX,
+    )
+  })
+})
+
+describe('Ox Alpha is unreachable from anything but our own runner', () => {
+  it('is service-account-only', () => {
+    // The one gate here that an attacker cannot restate. Everything else that
+    // keeps this model off a surface is a client-side fact — absent from the
+    // CLI catalog means no shipped build renders it, which stops our users and
+    // nobody else. A hand-written caller names the agent id and model directly
+    // and passes every allowlist, because that pair IS valid; what it cannot
+    // produce is the runner's API key.
+    expect(isFreebuffServiceOnlyModelId(OX)).toBe(true)
+    expect(FREEBUFF_SERVICE_ONLY_MODEL_IDS as readonly string[]).toContain(OX)
+  })
+
+  it('covers dated builds and nothing else', () => {
+    expect(isFreebuffServiceOnlyModelId('stealth/ox-alpha-20260820')).toBe(true)
+    expect(isFreebuffServiceOnlyModelId(FREEBUFF_MIMO_V25_MODEL_ID)).toBe(false)
+    expect(isFreebuffServiceOnlyModelId(null)).toBe(false)
+  })
+
+  it('is the only model on that list, and the reason is the missing pool', () => {
+    // Muse Spark and Kimi K3 Eco are browser-only too, and would pass this gate
+    // in normal operation — but both are premium-pooled, so a third party
+    // reaching one spends a quota that runs out. Ox Alpha is metered by
+    // nothing, which is what makes it worth a gate of its own. If that ever
+    // stops being the distinction, add them here; do not delete this test.
+    expect([...FREEBUFF_SERVICE_ONLY_MODEL_IDS]).toEqual([OX])
+    expect(FREEBUFF_STANDARD_MODEL_IDS).toContain(OX)
+  })
+})
+
+describe('the data tag', () => {
+  it('renders wherever the row does, on both tiers', () => {
+    // `warning` is what the picker draws the compact "Data" label from, and the
+    // row is reachable from the full-access standard group AND the limited
+    // tier's list — so a warning that only existed on one of those would be a
+    // disclosure a limited-region user never sees.
+    expect(row?.warning).toBe('Anonymous provider retains prompts')
+    expect(FREEBUFF_WEB_MODELS.find((m) => m.id === OX)?.warning).toBeDefined()
+    expect(
+      FREEBUFF_WEB_LIMITED_MODEL_IDS.includes(OX) && row?.warning !== undefined,
+    ).toBe(true)
+  })
+})

common/src/__tests__/ox-alpha.test.ts

@@ -18,6 +18,7 @@ import {
   FREEBUFF_KIMI_K3_ECO_MODEL_ID,
   FREEBUFF_MINIMAX_M3_MODEL_ID,
   FREEBUFF_MUSE_SPARK_12_CONTRIBUTOR_MODEL_ID,
+  FREEBUFF_OX_ALPHA_MODEL_ID,
   LIMITED_FREEBUFF_MODEL_ID,
   FREEBUFF_MIMO_V25_MODEL_ID,
 } from './freebuff-models'
@@ -124,6 +125,7 @@ export const FREEBUFF_WEB_BASE3_AGENT_ID_BY_MODEL: Record<string, string> = {
   [FREEBUFF_GLM_V52_MODEL_ID]: 'base3-free-glm',
   [FREEBUFF_KIMI_K3_ECO_MODEL_ID]: 'base3-free-kimi-k3-eco',
   [FREEBUFF_MUSE_SPARK_12_CONTRIBUTOR_MODEL_ID]: 'base3-free-muse-spark',
+  [FREEBUFF_OX_ALPHA_MODEL_ID]: 'base3-free-ox-alpha',
 }
 
 /**
@@ -320,6 +322,10 @@ export const FREEBUFF_ROOT_AGENT_IDS = [
   // other root so its subagents pass the hierarchy gate; the model, not this
   // list, is what keeps it off the CLI and Desktop.
   'base2-free-muse-spark',
+  // Freebuff Web and Cloud only (Ox Alpha), for the same reason and with the
+  // same division of labour: the model's absence from SUPPORTED_FREEBUFF_MODELS
+  // is what keeps it off the CLI and Desktop, not this list.
+  'base2-free-ox-alpha',
   // Capacity-limited trial orchestrator (Claude Fable 5). Reachable only while
   // the server is still advertising the offer, but it must be listed here
   // unconditionally: a session admitted while the pool was open runs its full
@@ -348,6 +354,7 @@ export const FREEBUFF_ROOT_AGENT_IDS = [
   'base3-free-glm',
   'base3-free-kimi-k3-eco',
   'base3-free-muse-spark',
+  'base3-free-ox-alpha',
   // Freebuff CLI base3 roots. Every other id it needs is already above,
   // shared with Web; Fable is the one model the CLI offers and Web does not.
   'base3-free-fable',
@@ -370,6 +377,7 @@ export const FREEBUFF_ROOT_AGENT_ID_BY_MODEL: Record<string, string> = {
   [FREEBUFF_KIMI_K3_ECO_MODEL_ID]: 'base2-free-kimi-k3-eco',
   [FREEBUFF_FABLE_5_MODEL_ID]: 'base2-free-fable',
   [FREEBUFF_MUSE_SPARK_12_CONTRIBUTOR_MODEL_ID]: 'base2-free-muse-spark',
+  [FREEBUFF_OX_ALPHA_MODEL_ID]: 'base2-free-ox-alpha',
 }
 
 /**
@@ -521,6 +529,11 @@ export const FREE_MODE_AGENT_MODELS: Record<string, Set<string>> = {
   'base2-free-muse-spark': new Set([
     FREEBUFF_MUSE_SPARK_12_CONTRIBUTOR_MODEL_ID,
   ]),
+  // Web/Cloud-only Ox Alpha root, pinned to its one model like every other. The
+  // pinning matters here even though the model is free: an agent id is the
+  // handle a hand-written caller reaches for, and a root allowed more than one
+  // model is a door onto everything else it allows.
+  'base2-free-ox-alpha': new Set([FREEBUFF_OX_ALPHA_MODEL_ID]),
   // Limited-offer trial root. Only this agent may run Fable for free, and only
   // on Fable — the pool accounting keys off the model, so a root that could
   // also run something else would let a session escape it.