cartethyia 2.4.4 → 2.4.6

package/src/providers/integrations/buddy/workbuddy/shared.ts

@@ -1,171 +1,200 @@
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-
-import type { OpenAICompatibleAdapterConfig } from "../../../adapters/compatible-adapter";
-import { withBearerAuthentication } from "../../../adapters/compatible-adapter";
-import type { CanonicalRequest } from "../../../../protocol/canonical-model";
-import type { ProviderDispatchContext, ProviderDispatchTarget, ProviderId } from "../../../provider-contracts";
-import { resolveInboundSessionId } from "../../../operations/session-resolution";
-import { buddyConversationHeaders } from "../buddy-conversation-headers";
-import {
-  buildWorkBuddyUserAgent,
-  getWorkBuddyClientVersion,
-  getWorkBuddyCliVersion,
-} from "../../../operations/client-versions";
-
-/**
- * WorkBuddy serves chat from a versioned path on a base URL that carries no
- * version segment (billing uses the unversioned `/billing/…` path), so both the
- * adapter config and the static catalog rows must state it. The generic
- * `/chat/completions` default would join into
- * `https://www.workbuddy.ai/chat/completions`, which that upstream answers with
- * a 405 HTML error page.
- */
-export const WORKBUDDY_CHAT_PATH = "/v2/chat/completions" as const;
-
-export {
-  buildWorkBuddyUserAgent,
-  getWorkBuddyClientVersion,
-  getWorkBuddyCliVersion,
-};
-
-/** WorkBuddy international gateway domain (Origin/Referer/X-Domain). */
-export const WORKBUDDY_DOMAIN = "www.workbuddy.ai";
-
-/**
- * Stable per-account device identifiers.
- *
- * WorkBuddy's desktop client presents one fixed virtual device per account.
- * Deriving `X-Machine-ID` / `X-Session-ID` from the account id (sha256, 36 hex)
- * keeps them constant across restarts while staying distinct per account, so
- * multiple pooled accounts are not correlated by a missing or drifting device
- * fingerprint. Mirrors the reference gateway's `wb2a:<purpose>:<uid>` scheme.
- */
-function deriveAccountStableId(accountId: string, purpose: string): string {
-  const sum = createHash("sha256").update(`wb2a:${purpose}:${accountId}`).digest("hex");
-  return sum.slice(0, 36);
-}
-
-/**
- * Per-request WorkBuddy chat headers — the exact desktop-client contract.
- *
- * The international gateway gates chat on the desktop `User-Agent` (platform
- * brand `WorkBuddy AI`; the wrong brand trips 403 code 11140), plus the
- * `X-CodeBuddy-Request` risk gate and the account-scoped device headers.
- * The background client-version monitor keeps this value fresh; dispatch only
- * reads the cached value and never waits on a version endpoint.
- */
-export async function workbuddyHeaders(
-  context?: ProviderDispatchContext,
-  request?: CanonicalRequest,
-  domain = WORKBUDDY_DOMAIN,
-  clientVersion = getWorkBuddyClientVersion(),
-): Promise<Record<string, string>> {
-  const headers: Record<string, string> = {
-    accept: "application/json, text/event-stream",
-    "user-agent": buildWorkBuddyUserAgent(clientVersion, getWorkBuddyCliVersion()),
-    origin: `https://${domain}`,
-    referer: `https://${domain}/`,
-    "accept-language": "en-US",
-    "x-requested-with": "XMLHttpRequest",
-    "x-codebuddy-request": "1",
-    "x-domain": domain,
-    "x-agent-purpose": "conversation",
-    "x-ide-name": "WorkBuddy",
-    "x-ide-type": "WorkBuddy",
-    "x-ide-version": clientVersion,
-    "x-product": "WorkBuddy",
-    // Personal international accounts carry no enterprise id: declare it
-    // explicitly so upstream risk control does not treat the omission as
-    // suspicious.
-    "x-no-enterprise-id": "1",
-  };
-  // The conversation/tracing family the upstream's channel check looks for. A
-  // live request answered `400 · 11128 "conversation id missing"` while carrying
-  // only `x-session-id`; the aggregation key below is the one the reference
-  // marks mandatory.
-  Object.assign(
-    headers,
-    buddyConversationHeaders({
-      ...(resolveInboundSessionId(context, request) === undefined
-        ? {}
-        : { conversationId: resolveInboundSessionId(context, request) }),
-    }),
-  );
-  const accountId = context?.credential.account_id;
-  if (accountId) {
-    headers["x-user-id"] = accountId;
-    headers["x-machine-id"] = deriveAccountStableId(accountId, "machine");
-    headers["x-session-id"] = deriveAccountStableId(accountId, "session");
-  }
-  const deviceToken = readBuddyDeviceToken(context);
-  if (deviceToken !== undefined) headers["x-device-token"] = deviceToken;
-  return headers;
-}
-
-/**
- * Desktop risk token, sent only when the account actually has one.
- *
- * The account's own `auth_state` wins. When it carries none, a file the
- * desktop client writes (`CARTETHYIA_DEVICE_TOKEN_FILE`, default
- * `/app/data/device_token`) is read instead — cached for five minutes, and
- * ignored when it is larger than 1 KB, because a token file that size is not
- * a token. A missing file is the normal case and reads as "no token".
- */
-const DEVICE_TOKEN_FILE_MAX_BYTES = 1024;
-const DEVICE_TOKEN_FILE_TTL_MS = 5 * 60_000;
-let deviceTokenFileCache: { readonly value: string | undefined; readonly readAt: number } | undefined;
-
-export function readBuddyDeviceToken(context?: ProviderDispatchContext): string | undefined {
-  const state = context?.credential.auth_state;
-  const value = state?.["deviceToken"] ?? state?.["device_token"];
-  if (typeof value === "string" && value.trim().length > 0) return value.trim();
-  return readDeviceTokenFile();
-}
-
-function readDeviceTokenFile(): string | undefined {
-  const now = Date.now();
-  if (deviceTokenFileCache !== undefined && now - deviceTokenFileCache.readAt < DEVICE_TOKEN_FILE_TTL_MS) {
-    return deviceTokenFileCache.value;
-  }
-  const path = process.env["CARTETHYIA_DEVICE_TOKEN_FILE"] ?? "/app/data/device_token";
-  let value: string | undefined;
-  try {
-    const raw = readFileSync(path);
-    if (raw.byteLength > 0 && raw.byteLength <= DEVICE_TOKEN_FILE_MAX_BYTES) {
-      const text = raw.toString("utf8").trim();
-      if (text.length > 0) value = text;
-    }
-  } catch {
-    value = undefined;
-  }
-  deviceTokenFileCache = { value, readAt: now };
-  return value;
-}
-
-/**
- * Shared OpenAI-compatible chat-adapter config for WorkBuddy: bearer auth
- * (api_key and oauth both use `Authorization: Bearer`), `/v2/chat/completions`
- * endpoint, per-request desktop-client headers, and the payload hook.
- */
-export function workbuddyAdapterConfig(args: {
-  providerId: ProviderId;
-  baseUrl: string;
-  domain?: string;
-  prePayload: (
-    payload: Record<string, unknown>,
-    request: CanonicalRequest,
-    candidate: ProviderDispatchTarget,
-  ) => void;
-  fetchImpl?: typeof fetch;
-}): OpenAICompatibleAdapterConfig {
-  return withBearerAuthentication({
-    provider_id: args.providerId,
-    base_url: args.baseUrl,
-    endpoint_paths_by_wire_family: { chat: WORKBUDDY_CHAT_PATH },
-    buildExtraHeaders: (context, request) =>
-      workbuddyHeaders(context, request, args.domain ?? WORKBUDDY_DOMAIN),
-    prePayload: args.prePayload,
-    ...(args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}),
-  });
-}
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+
+import type { OpenAICompatibleAdapterConfig } from "../../../adapters/compatible-adapter";
+import { withBearerAuthentication } from "../../../adapters/compatible-adapter";
+import type { CanonicalRequest } from "../../../../protocol/canonical-model";
+import type { ProviderDispatchContext, ProviderDispatchTarget, ProviderId } from "../../../provider-contracts";
+import { resolveInboundSessionId } from "../../../operations/session-resolution";
+import { buddyConversationHeaders } from "../buddy-conversation-headers";
+import { buddyCliHeaders, buddyCliTraceHeaders } from "../buddy-cli-headers";
+import { buddyUserId, resolveBuddyIdentity } from "../buddy-identity";
+import {
+  buildWorkBuddyUserAgent,
+  getWorkBuddyClientVersion,
+  getWorkBuddyCliVersion,
+} from "../../../operations/client-versions";
+
+/**
+ * WorkBuddy serves chat from a versioned path on a base URL that carries no
+ * version segment (billing uses the unversioned `/billing/…` path), so both the
+ * adapter config and the static catalog rows must state it. The generic
+ * `/chat/completions` default would join into
+ * `https://www.workbuddy.ai/chat/completions`, which that upstream answers with
+ * a 405 HTML error page.
+ */
+export const WORKBUDDY_CHAT_PATH = "/v2/chat/completions" as const;
+
+export {
+  buildWorkBuddyUserAgent,
+  getWorkBuddyClientVersion,
+  getWorkBuddyCliVersion,
+};
+
+/** WorkBuddy international gateway domain (Origin/Referer/X-Domain). */
+export const WORKBUDDY_DOMAIN = "www.workbuddy.ai";
+
+/**
+ * Stable per-account device identifiers.
+ *
+ * WorkBuddy's desktop client presents one fixed virtual device per account.
+ * Deriving `X-Machine-ID` / `X-Session-ID` from the account id (sha256, 36 hex)
+ * keeps them constant across restarts while staying distinct per account, so
+ * multiple pooled accounts are not correlated by a missing or drifting device
+ * fingerprint. Mirrors the reference gateway's `wb2a:<purpose>:<uid>` scheme.
+ */
+function deriveAccountStableId(accountId: string, purpose: string): string {
+  const sum = createHash("sha256").update(`wb2a:${purpose}:${accountId}`).digest("hex");
+  return sum.slice(0, 36);
+}
+
+/**
+ * Per-request WorkBuddy chat headers — the exact desktop-client contract.
+ *
+ * The international gateway gates chat on the desktop `User-Agent` (platform
+ * brand `WorkBuddy AI`; the wrong brand trips 403 code 11140), plus the
+ * `X-CodeBuddy-Request` risk gate and the account-scoped device headers.
+ * The background client-version monitor keeps this value fresh; dispatch only
+ * reads the cached value and never waits on a version endpoint.
+ *
+ * `cliIdentity` selects the reference CLI contract instead. The two are not
+ * variations of one set: the CLI drops every browser header and the device
+ * token, and adds the agent envelope. Left unset, nothing changes.
+ */
+export async function workbuddyHeaders(
+  context?: ProviderDispatchContext,
+  request?: CanonicalRequest,
+  domain = WORKBUDDY_DOMAIN,
+  clientVersion = getWorkBuddyClientVersion(),
+  cliIdentity?: boolean,
+): Promise<Record<string, string>> {
+  const conversation = buddyConversationHeaders({
+    ...(resolveInboundSessionId(context, request) === undefined
+      ? {}
+      : { conversationId: resolveInboundSessionId(context, request) }),
+  });
+  const accountId = context?.credential.account_id;
+  if (resolveBuddyIdentity(context, cliIdentity) === "cli") {
+    // The reference CLI: issued by the OpenAI Node SDK, so no browser header
+    // and no device token, and the machine/session device pair does not
+    // exist — only `X-User-Id`, which is `anonymous` without a uid.
+    return {
+      accept: "application/json",
+      "user-agent": `CLI/${getWorkBuddyCliVersion()} CodeBuddy/${getWorkBuddyCliVersion()}`,
+      "x-domain": domain,
+      "x-agent-purpose": "conversation",
+      "x-ide-name": "CLI",
+      "x-ide-type": "CLI",
+      "x-ide-version": getWorkBuddyCliVersion(),
+      "x-product": "SaaS",
+      "x-no-enterprise-id": "1",
+      ...conversation,
+      ...buddyCliTraceHeaders(conversation),
+      ...buddyCliHeaders({ userId: buddyUserId(context) }),
+    };
+  }
+  const headers: Record<string, string> = {
+    accept: "application/json, text/event-stream",
+    "user-agent": buildWorkBuddyUserAgent(clientVersion, getWorkBuddyCliVersion()),
+    origin: `https://${domain}`,
+    referer: `https://${domain}/`,
+    "accept-language": "en-US",
+    "x-requested-with": "XMLHttpRequest",
+    "x-codebuddy-request": "1",
+    "x-domain": domain,
+    "x-agent-purpose": "conversation",
+    "x-ide-name": "WorkBuddy",
+    "x-ide-type": "WorkBuddy",
+    "x-ide-version": clientVersion,
+    // Both references send the literal `SaaS` here. `WorkBuddy` was a value
+    // this repo invented; the desktop product name belongs in `x-ide-name`,
+    // and the CN test below compares the two realms against each other rather
+    // than to a hard-coded string.
+    "x-product": "SaaS",
+    // Personal international accounts carry no enterprise id: declare it
+    // explicitly so upstream risk control does not treat the omission as
+    // suspicious.
+    "x-no-enterprise-id": "1",
+  };
+  // The conversation/tracing family the upstream's channel check looks for. A
+  // live request answered `400 · 11-128 "conversation id missing"` while carrying
+  // only `x-session-id`; the aggregation key below is the one the reference
+  // marks mandatory.
+  Object.assign(headers, conversation);
+  if (accountId) {
+    headers["x-user-id"] = accountId;
+    headers["x-machine-id"] = deriveAccountStableId(accountId, "machine");
+    headers["x-session-id"] = deriveAccountStableId(accountId, "session");
+  }
+  const deviceToken = readBuddyDeviceToken(context);
+  if (deviceToken !== undefined) headers["x-device-token"] = deviceToken;
+  return headers;
+}
+
+/**
+ * Desktop risk token, sent only when the account actually has one.
+ *
+ * The account's own `auth_state` wins. When it carries none, a file the
+ * desktop client writes (`CARTETHYIA_DEVICE_TOKEN_FILE`, default
+ * `/app/data/device_token`) is read instead — cached for five minutes, and
+ * ignored when it is larger than 1 KB, because a token file that size is not
+ * a token. A missing file is the normal case and reads as "no token".
+ */
+const DEVICE_TOKEN_FILE_MAX_BYTES = 1024;
+const DEVICE_TOKEN_FILE_TTL_MS = 5 * 60_000;
+let deviceTokenFileCache: { readonly value: string | undefined; readonly readAt: number } | undefined;
+
+export function readBuddyDeviceToken(context?: ProviderDispatchContext): string | undefined {
+  const state = context?.credential.auth_state;
+  const value = state?.["deviceToken"] ?? state?.["device_token"];
+  if (typeof value === "string" && value.trim().length > 0) return value.trim();
+  return readDeviceTokenFile();
+}
+
+function readDeviceTokenFile(): string | undefined {
+  const now = Date.now();
+  if (deviceTokenFileCache !== undefined && now - deviceTokenFileCache.readAt < DEVICE_TOKEN_FILE_TTL_MS) {
+    return deviceTokenFileCache.value;
+  }
+  const path = process.env["CARTETHYIA_DEVICE_TOKEN_FILE"] ?? "/app/data/device_token";
+  let value: string | undefined;
+  try {
+    const raw = readFileSync(path);
+    if (raw.byteLength > 0 && raw.byteLength <= DEVICE_TOKEN_FILE_MAX_BYTES) {
+      const text = raw.toString("utf8").trim();
+      if (text.length > 0) value = text;
+    }
+  } catch {
+    value = undefined;
+  }
+  deviceTokenFileCache = { value, readAt: now };
+  return value;
+}
+
+/**
+ * Shared OpenAI-compatible chat-adapter config for WorkBuddy: bearer auth
+ * (api_key and oauth both use `Authorization: Bearer`), `/v2/chat/completions`
+ * endpoint, per-request desktop-client headers, and the payload hook.
+ */
+export function workbuddyAdapterConfig(args: {
+  providerId: ProviderId;
+  baseUrl: string;
+  domain?: string;
+  prePayload: (
+    payload: Record<string, unknown>,
+    request: CanonicalRequest,
+    candidate: ProviderDispatchTarget,
+  ) => void;
+  fetchImpl?: typeof fetch;
+  cliIdentity?: boolean;
+}): OpenAICompatibleAdapterConfig {
+  return withBearerAuthentication({
+    provider_id: args.providerId,
+    base_url: args.baseUrl,
+    endpoint_paths_by_wire_family: { chat: WORKBUDDY_CHAT_PATH },
+    buildExtraHeaders: (context, request) =>
+      workbuddyHeaders(context, request, args.domain ?? WORKBUDDY_DOMAIN, undefined, args.cliIdentity),
+    prePayload: args.prePayload,
+    ...(args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}),
+  });
+}

package/src/providers/integrations/codex/codex.ts

@@ -31,7 +31,11 @@ import { decodeSseEvents } from "../../../protocol/sse-decoder";
 import { imageCreatedSeconds, imagePrompt, responsesImageResult } from "../../../protocol/image-generation";
 import { isRecord, joinUrl } from "../../../protocol/codecs";
 import { postUpstreamJson } from "../../../protocol/upstream/post-json";
-import { parseUpstreamBackoff, sleep as defaultSleep } from "../../../transport/failure-policy";
+import {
+  MIN_RETRY_BUDGET_MS,
+  parseUpstreamBackoff,
+  sleep as defaultSleep,
+} from "../../../transport/failure-policy";
 
 /**
  * Sleep used by the 429 capacity-wait loop, overridable in tests.
@@ -277,13 +281,6 @@ const CODEX_429_MAX_WAIT_MS = 60_000;
 /** Zero-delay 429 guard. Grows from 50ms, doubling per wait. */
 const CODEX_429_MIN_WAIT_MS = 50;
 
-/**
- * The attempt-loop floor: a retry repeats the whole pre-dispatch phase, so it
- * needs at least this much budget left on top of the upstream call itself.
- * Mirrors `MIN_RETRY_BUDGET_MS` in `src/transport/dispatch/attempt-loop.ts`.
- */
-const MIN_RETRY_BUDGET_MS = 15_000;
-
 /** The `x-codex-*` window headers, in seconds or epoch seconds. */
 function codexWindowResetMs(res: Response): number | undefined {
   for (const header of ["x-codex-primary-reset-at", "x-codex-secondary-reset-at"]) {

package/src/providers/integrations/factory/factory-oauth.ts

@@ -29,6 +29,7 @@ import type {
 } from "../../authentication/oauth-flow-store";
 import {
   devicePollBackoff,
+  decodeJwtPayload,
   nonEmptyTrimmedString,
   readJsonResponse,
   record,
@@ -71,19 +72,14 @@ export type { FactoryDroidEnvelope } from "../../../security/credential-codec";
  * Repeating it on every refresh would add a JWKS fetch to the dispatch path for
  * no additional guarantee: the signature cannot change without the payload
  * changing, and the payload is what this reads.
+ *
+ * Delegates to the shared decoder rather than hand-rolling a base64url pass:
+ * `atob` decodes to a Latin-1 string, so a claim carrying multi-byte UTF-8
+ * came back as mojibake. `Buffer.from(segment, "base64url")` round-trips the
+ * original bytes.
  */
 function jwtClaims(token: string): Record<string, unknown> | undefined {
-  const segments = token.split(".");
-  const payload = segments[1];
-  if (segments.length < 2 || payload === undefined || payload.length === 0) return undefined;
-  try {
-    const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
-    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), "=");
-    const parsed: unknown = JSON.parse(atob(padded));
-    return record(parsed);
-  } catch {
-    return undefined;
-  }
+  return decodeJwtPayload(token);
 }
 
 /** Expiry from the token's own `exp` claim, or the fallback when absent. */

package/src/providers/integrations/opencode/opencode-go-quota.ts

@@ -0,0 +1,130 @@
+import {
+  getJson,
+  type FetchLike,
+  type ProviderQuotaResult,
+  type ProviderQuotaWindow,
+} from "../../quota/quota-contracts";
+import type { QuotaCollectionContext } from "../../quota/quota-support";
+
+const SOURCE = "opencode-go";
+
+/**
+ * The Go plan's `/v1/usage` answer.
+ *
+ * `usage` carries exactly three windows in the reference implementation —
+ * `rolling`, `weekly`, `monthly` — each with a `percent` and a `resetsAt`.
+ * The shape is read defensively: an unknown window name is still reported
+ * rather than dropped, since a new window is more useful to an operator than
+ * a silently narrower view.
+ */
+interface GoUsageWindow {
+  readonly percent?: number | null;
+  readonly resetsAt?: string | null;
+  readonly status?: string | null;
+}
+
+interface GoUsagePayload {
+  readonly usage?: Readonly<Record<string, GoUsageWindow | undefined>> | null;
+  readonly plan?: string | null;
+}
+
+/** Windows whose meaning the reference names, in the order it lists them. */
+const KNOWN_WINDOWS: readonly (readonly [string, string])[] = [
+  ["rolling", "Rolling"],
+  ["weekly", "Weekly"],
+  ["monthly", "Monthly"],
+];
+
+function labelFor(kind: string): string {
+  for (const [name, label] of KNOWN_WINDOWS) {
+    if (name === kind) return label;
+  }
+  return kind.charAt(0).toUpperCase() + kind.slice(1);
+}
+
+function resetIso(value: string | null | undefined): string | null {
+  if (typeof value !== "string" || value.trim() === "") return null;
+  const parsed = Date.parse(value);
+  if (!Number.isFinite(parsed)) return null;
+  return new Date(parsed).toISOString();
+}
+
+/**
+ * One window, or `undefined` when the upstream omitted what makes it usable.
+ *
+ * A window with no percentage is not a zero-percent window — it is an absent
+ * measurement, and reporting it as `0` would tell the operator the plan is
+ * exhausted when the upstream simply did not say.
+ */
+function windowFor(
+  kind: string,
+  raw: GoUsageWindow | undefined,
+): ProviderQuotaWindow | undefined {
+  if (!raw) return undefined;
+  const percent = typeof raw.percent === "number" && Number.isFinite(raw.percent)
+    ? Math.min(100, Math.max(0, raw.percent))
+    : null;
+  if (percent === null) return undefined;
+  return {
+    kind,
+    label: labelFor(kind),
+    // The endpoint reports subscription-wide percentages, never per-key or
+    // per-model balances. Every window of one subscription reads the same
+    // budget, so adding them would double-count: they are independent, and
+    // the lowest gates the account.
+    accounting: "independent",
+    usedPercent: percent,
+    remainingPercent: 100 - percent,
+    resetsAt: resetIso(raw.resetsAt),
+  };
+}
+
+function parseWindows(payload: GoUsagePayload): readonly ProviderQuotaWindow[] {
+  const usage = payload.usage;
+  if (!usage) return [];
+  const windows: ProviderQuotaWindow[] = [];
+  const seen = new Set<string>();
+  // Known windows first, in their documented order, so the dashboard is
+  // stable across refreshes; anything novel is appended.
+  for (const [name] of KNOWN_WINDOWS) {
+    seen.add(name);
+    const window = windowFor(name, usage[name]);
+    if (window) windows.push(window);
+  }
+  for (const [name, raw] of Object.entries(usage)) {
+    if (seen.has(name)) continue;
+    const window = windowFor(name, raw);
+    if (window) windows.push(window);
+  }
+  return windows;
+}
+
+/**
+ * Fetches the OpenCode Go plan's subscription quota from `/v1/usage`.
+ *
+ * The anonymous free tier has no usage surface — it is rate-limited by egress
+ * IP, not by an account balance — so this is the keyed `opencode-go` tier
+ * only. The endpoint reports percentages for a *shared* subscription: several
+ * Go keys can draw on one plan, so no window here may be summed against
+ * another account's.
+ */
+export async function fetchOpenCodeGoQuota(
+  credential: string,
+  fetcher: FetchLike,
+  _context?: QuotaCollectionContext,
+): Promise<ProviderQuotaResult> {
+  const token = credential.trim();
+  const payload = (await getJson(
+    `https://opencode.ai/zen/go/v1/usage`,
+    {
+      authorization: `Bearer ${token}`,
+      accept: "application/json",
+      "x-opencode-client": "cli",
+    },
+    fetcher,
+  )) as GoUsagePayload;
+  const windows = parseWindows(payload);
+  const plan =
+    (typeof payload.plan === "string" && payload.plan.trim()) || "OpenCode Go";
+  return { source: SOURCE, plan, windows, error: null };
+}

package/src/providers/integrations/opencode/provider.ts

@@ -6,6 +6,7 @@ import type { ProviderDispatchContext } from "../../provider-contracts";
 import { PROVIDER_COMPATIBILITY_PROFILES } from "../../provider-metadata";
 import { defineModel } from "../../provider-model-definition";
 import type { ApiKeyProviderSpec } from "../../configured-provider";
+import { resolveOpenCodeUnavailableFree } from "../../../config/providers";
 import { buildOpenCodeHeaders } from "./fingerprint";
 import { OPENCODE_TOOL_DEFINITIONS } from "./tool-definitions";
 /**
@@ -65,6 +66,28 @@ const UNAVAILABLE_FREE_ZEN_IDS: readonly string[] = [
   "space-bunny-free",
 ];
 
+/**
+ * The unavailable list, overridable without a code change.
+ *
+ * These ids are what upstream *currently* refuses, measured 2026-10-14 — and
+ * the reference gateway takes the opposite approach entirely: it trusts
+ * metadata (`pricing.go` marks a model free when its cost is 0 and it is not
+ * deprecated) and hardcodes no ids at all. Ours is more precise while the
+ * measurements hold, and worse the moment upstream changes, because a new
+ * refusal needs a deploy.
+ *
+ * `CARTETHYIA_OPENCODE_UNAVAILABLE_FREE` lets an operator correct that
+ * immediately: a comma-separated list that *replaces* the bundled one, or the
+ * single token `none` to trust the listing completely. The bundled ids remain
+ * the default so an unconfigured install behaves exactly as it does today.
+ */
+function unavailableFreeZenIds(): readonly string[] {
+  const override = resolveOpenCodeUnavailableFree();
+  if (override === undefined) return UNAVAILABLE_FREE_ZEN_IDS;
+  if (override === "none") return [];
+  return override;
+}
+
 /**
  * Zen ids served by the native System One decision endpoint, not the chat wire.
  *
@@ -93,7 +116,7 @@ export function isSystemoneZenModel(modelId: string): boolean {
  * fail a probe.
  */
 export function isFreeTierZenModel(modelId: string): boolean {
-  if (UNAVAILABLE_FREE_ZEN_IDS.includes(modelId)) return false;
+  if (unavailableFreeZenIds().includes(modelId)) return false;
   return modelId.endsWith("-free") || KNOWN_FREE_ZEN_IDS.includes(modelId);
 }
 
@@ -108,6 +131,17 @@ export function isFreeTierZenModel(modelId: string): boolean {
  */
 const ANONYMOUS_ZEN_BEARER = "public";
 
+/**
+ * The `Accept` a free-tier dispatch advertises.
+ *
+ * What OpenCode 2.x's AI SDK puts on the wire, and what the reference gateway
+ * sends (`upstream.go:1293`). The gate has only ever been seen accepting the
+ * narrower `text/event-stream`, so nothing here fixes a live failure — this is
+ * the value a real client produces, which is the only defensible choice when
+ * the gate tightens.
+ */
+const FREE_TIER_ACCEPT = "application/json, text/event-stream";
+
 function opencodeDesktopHeaders(
   context: ProviderDispatchContext,
   request?: CanonicalRequest,
@@ -124,8 +158,13 @@ function opencodeDesktopHeaders(
     ...(freeModel ? { authorization: `Bearer ${ANONYMOUS_ZEN_BEARER}` } : {}),
     // The free-tier gate refuses non-streaming dispatches with 403
     // FreeTierError, so free models always advertise SSE regardless of the
-    // client's own Accept; billed models keep the JSON default.
-    ...(freeModel ? { accept: "text/event-stream" } : {}),
+    // client's own Accept; billed models keep the JSON default. The value is
+    // what OpenCode 2.x's AI SDK sends, not the narrower
+    // `text/event-stream` we used to claim — the gate always accepted the
+    // narrow one, so this is alignment with the real client rather than a
+    // fix for a live failure. It costs nothing: `stream: true` is forced on
+    // the body either way, so the upstream answers SSE regardless.
+    ...(freeModel ? { accept: FREE_TIER_ACCEPT } : {}),
   };
 }
 /**