provider, catalog: a prompt cap above a model's window is held to the window (#1286) - #1288

Input for the review of this PR (from a parallel investigation of #1286; not a verdict).

1. limit.input is a real prompt cap for most of the models that carry it, including on the same OpenCode provider. https://models.opencode.ai/api.json and https://models.dev/api.json were byte-identical when I fetched them today (5,361,863 bytes, cmp clean). So this is not a separate catalog whose input means something different. In it, opencode (Zen) has 27 models with limit.input. 24 of them are OpenAI's GPT-5 family, for example:

The GPT-5 rows also satisfy input + output == context, so that test can't separate the cases. 272K/922K is the prompt cap OpenAI enforces, and Codex's own catalog uses it. github-copilot has the same pattern (claude-opus-4.8 200000/168000/64000, gpt-5-mini 264000/128000/64000), and Copilot's max_prompt_tokens is the real limit there. With this PR, any plugin that passes these through (an OpenCode Zen or Copilot plugin) is served at 400K/1.05M. Agents then compact past what the API accepts. This is the e950eb0 lesson (a rule from one vendor's report applied to every model) in reverse.

Review test I ran on this PR's head edc0b0f3 merged onto main 67329b8d (merge 677252ca, -tags nogui, temp HOME). It's a plugin opencode provider with gpt-5.5 {1050000, 922000, 128000} and gpt-5-codex {400000, 272000, 128000}:

review1288_test.go:17: gpt-5.5: 1050000, want 922000
review1288_test.go:17: gpt-5-codex: 400000, want 272000
--- FAIL: TestReview1288GPTCap

On main it passes. TestPluginCatalogPrefersContextWindow and TestCursorPluginContext pass on the merge.

2. OpenCode's own client uses input as the budget. It doesn't keep context as the window. In packages/opencode/src/session/overflow.ts usable(), when limit.input is set it returns limit.input - reserved (reserved = min(20000, max output)). So OpenCode compacts space-bunny-free at about 504K. magpie's current 524288 agrees with OpenCode.

3. For space-bunny-free alone, the catalog's number is wrong. I sent it directly to https://opencode.ai/zen/v1/chat/completions (Bearer public, max_tokens 16). Both prompts were accepted, with HTTP 200: usage.prompt_tokens 577812 and 866292. So the reporter is right about this model, but the fix belongs to that catalog entry (models.dev), or at most to that one model. It is not a reason to flip the rule for every plugin model.

4. One real bug in the current rule: input > context. Examples are opencode/hy3-free 190000/192000, Cloudflare AI Gateway's openai/gpt-5* 128000/272000, and venice/openai-gpt-52 256000/272000. These are served above their window. min(input, context) (when both are set) fixes it. The same applies to mdModel.window() in internal/catalog/catalog.go, the sibling of pluginCatalog.

5. The diff deletes an unrelated existing test. plugin_context_test.go is replaced whole. That removes clinePlugin, pluginWindow and TestPluginModelWindow (Cline's models taking models.dev windows by vendor prefix, and the user's SetContext override, ARNO / v0.1.815). The PR description doesn't mention this. The new test belongs in a file of its own, or appended.

What catalog.Model.Context drives. It is documented as "how many tokens a prompt may hold" (catalog.go, from 09c635c). The gateway's /v1/models serves it as context_window, context_length and max_input_tokens (gateway.go, the model list). It is also written into each agent's model list: dsh contextWindow, Pi, Crush, omp, Codex's catalog and others under internal/agent. Agents compact at it, so a number above the real prompt cap means requests that get rejected, not merely early compaction.

Thanks for the detailed pass - I reproduced each point before touching the code.

1. Confirmed with your exact test (plugin opencode provider, gpt-5.5 {1050000, 922000, 128000}, gpt-5-codex {400000, 272000, 128000}): fails on the old head with your numbers (1050000 served), passes on main, and passes again on the revised head. The PR no longer flips the preference - input wins wherever it sits under the window. The byte-identical catalogs and the Copilot max_prompt_tokens pattern settle it: input is a real cap.
2. Noted - overflow.ts usable() returning limit.input - reserved is the vendor behavior to match, so magpie's current 524288 for space-bunny-free agrees with OpenCode itself. The "halved" framing is out of the PR.
3. Agreed - HTTP 200 at 577812 and 866292 prompt tokens proves the entry, not the rule, is wrong for that one model. The body now says the fix belongs in the models.dev data. Happy to file that correction upstream at models.dev if you want it tracked.
4. Done in both places: pluginCatalog and mdModel.window() now clamp a cap that sits above the window (hy3-free 192000 -> 190000; Cloudflare AI Gateway's 272000 over 128000). TestPluginCatalogClampsInputAboveWindow and TestWindowClampsInputAboveContext fail on main and pass here; the GPT-5 caps are in the tests as controls (272000 kept).
5. My mistake - I wrote the new test over plugin_context_test.go instead of adding to it. Restored: clinePlugin, pluginWindow and TestPluginModelWindow are back and passing, the new test is appended, and the diff is now purely additive (+64 -0).

Force-pushed as 3820c8b. go vet, go build -tags nogui, and go test -tags nogui ./internal/provider ./internal/catalog under a temp HOME all pass.

Quick note since the formal review landed against the old head: current head 3820c8b implements exactly the narrow shape you described - input kept as the budget, clamped to context only when it sits above the window, gpt-5's 272K covered as a control test, and the deleted test file restored in full (diff is +64 -0 now). Details in my comment above. Ball's in your court, no rush.

Re-reviewed at head 3820c8ba, merged onto current main 1f140046 (merge 780fc744), -tags nogui, temp HOME with Go caches pinned. This head is the narrow fix the earlier review asked for, so I'm merging it.

Ran

• go test -tags nogui -count=1 ./internal/catalog ./internal/provider ./internal/gateway ./internal/agent on the merge with main 14ed370e: all ok. ./internal/catalog ./internal/provider again on the merge with 1f140046: ok.
• go vet -tags nogui (darwin, GOOS=linux, GOOS=windows) on ./internal/catalog ./internal/provider: clean. go build -tags nogui . for darwin, linux and windows: ok.
• Fails without the change: with main's plugins.go and catalog.go, TestPluginCatalogClampsInputAboveWindow fails ("hy3-free: 192000, want 190000") and TestWindowClampsInputAboveContext fails ("input above context: 272000, want 128000"). With the change both pass.
• Broke it on purpose: I made pluginCatalog take context whenever it is set (the provider: plugin models keep limit.context as the window, not limit.input (#1286) #1296 rule). The PR's test fails ("gpt-5-codex: 400000, want 272000"), and so does a review test with real OpenCode rows (gpt-5.5 1050000 vs 922000, gpt-5-codex, space-bunny-free 1048576 vs 524288, big-pickle). With the PR as written that review test passes: gpt-5.5 922000, gpt-5-codex 272000, space-bunny-free 524288, big-pickle 160000, hy3-free 190000.
• Real models.dev data (api.json fetched today): I dumped every Provider(pid) model's Context and every ContextOf(id) on main and on this head. Exactly the 10 rows with input above context change: opencode/hy3-free 192000→190000, venice/openai-gpt-52 272000→256000, six cloudflare-ai-gateway/openai/gpt-5* 272000→128000, and two qwen3.7-flash rows. Nothing else changes, and ContextOf("gpt-5") stays 272000.
• TestPluginModelWindow and TestCursorPluginContext are kept and pass. The diff is additive.

Not verified: a live plugin model through the running gateway. Also, Cloudflare AI Gateway's 128000 is what models.dev says, not a value checked against Cloudflare. The clamp follows the data, and the smaller number is the safe side. space-bunny-free stays at 524288 (its input entry is the models.dev data problem noted in #1286).

Shipped in v0.1.1118. Thanks!