cartethyia 2.4.5 → 2.4.6

package/src/providers/integrations/buddy/buddy-catalog-shared.ts

@@ -73,8 +73,9 @@ const BUDDY_IMAGE_MODEL_IDS: readonly { id: string; endpoint: string; ctx: numbe
  * `seedance-2.5` is the text-to-video model the buddy facade exposes. It is a
  * distinct service kind (`videoGeneration`), not a chat or image row, so it is
  * built by {@link makeBuddyVideoModels} and reached through
- * `/v1/videos/generations` rather than a chat wire. CodeBuddy CN is
- * deliberately absent — it publishes a different roster.
+ * `/videos/generations` (relative to each variant's own base, which is why the
+ * WorkBuddy rows carry the `/v2` segment themselves) rather than a chat wire.
+ * CodeBuddy CN is deliberately absent — it publishes a different roster.
  */
 const BUDDY_VIDEO_MODEL_IDS: readonly { id: string; endpoint: string; ctx: number; out: number }[] = [
   { id: "seedance-2.5", endpoint: "/videos/generations", ctx: 1_000_000, out: 128_000 },

package/src/providers/integrations/buddy/buddy-cli-headers.ts

@@ -0,0 +1,88 @@
+/**
+ * The header family only the CLI identity sends.
+ *
+ * Everything here comes from the two reference gateways, which agree: the
+ * desktop product sends conversation/tracing headers and browser transport,
+ * while the CLI sends the agent envelope plus the OpenAI Node SDK fingerprint
+ * and no browser headers at all. A request carrying both halves is a hybrid no
+ * real client produces, which is what risk control keys on.
+ *
+ * Two references, two fingerprints: the hub derives OS/arch and a Node version
+ * from its own host, and codebuddy2api pins a fixed Linux/x64/v24.21.0 set.
+ * Neither can be right for every deployment, so the values here follow the
+ * host this gateway actually runs on — they are a fingerprint of the process,
+ * not a claim about a remote machine.
+ */
+
+/** OpenAI Node SDK 6.25.0 `x-stainless-*` fingerprint; both references agree. */
+const STAINLESS_PACKAGE_VERSION = "6.25.0";
+
+function hostOs(): string {
+  return process.platform === "win32" ? "Windows" : process.platform === "darwin" ? "MacOS" : "Linux";
+}
+
+function hostArch(): string {
+  return process.arch === "arm64" || process.arch === "ia32" ? process.arch : "x64";
+}
+
+/**
+ * The SDK fingerprint headers.
+ *
+ * `x-stainless-timeout` is in the hub only and `x-stainless-retry-count` is in
+ * both; the SDK sends both, so both go out.
+ */
+export function buddyStainlessHeaders(): Record<string, string> {
+  return {
+    "x-stainless-lang": "js",
+    "x-stainless-package-version": STAINLESS_PACKAGE_VERSION,
+    "x-stainless-os": hostOs(),
+    "x-stainless-arch": hostArch(),
+    "x-stainless-runtime": "node",
+    "x-stainless-runtime-version": process.version,
+    "x-stainless-retry-count": "0",
+    "x-stainless-timeout": "1200",
+  };
+}
+
+/**
+ * The trace family the CLI carries as a child span.
+ *
+ * The desktop product omits the parent (`with_parent=False` in the reference);
+ * the CLI conversation request is a child span, so it also sends `b3`'s fourth
+ * field and `X-B3-ParentSpanId`. `buddyConversationHeaders` already produces
+ * `traceparent`, `b3`, and the `X-B3-*` set, so only the parent is added here.
+ */
+export function buddyCliTraceHeaders(
+  conversation: Readonly<Record<string, string>>,
+): Record<string, string> {
+  const traceId = conversation["x-trace-id"] ?? conversation["x-b3-traceid"];
+  const spanId = conversation["x-b3-spanid"];
+  if (traceId === undefined) return {};
+  const b3 = `${traceId}-${spanId ?? traceId.slice(0, 16)}-1-${traceId.slice(0, 16)}`;
+  return { ...(spanId === undefined ? {} : { "X-B3-ParentSpanId": spanId }), b3 };
+}
+
+/**
+ * The full CLI identity envelope, minus what each caller already supplies.
+ *
+ * The caller keeps ownership of `User-Agent`, `X-IDE-*`, `X-Domain`, and the
+ * conversation family, because those vary by provider and realm: only the
+ * headers that are the same for every CLI dispatch are built here.
+ */
+export function buddyCliHeaders(args: { readonly userId: string }): Record<string, string> {
+  return {
+    "X-Agent-Intent": "craft",
+    "X-Agent-Type": "main",
+    // The reference enum is local-agent / cloud-agent / agent-agent, and its
+    // parser returns "other" for anything unknown or absent. A gateway is none
+    // of the three, so "other" is the honest value rather than a guess.
+    "X-Agent-Runtime": "other",
+    "X-User-Id": args.userId,
+    // Personal accounts are not an enterprise and the reference sends the flag
+    // either way (`true` only for an enterprise id), so the non-enterprise
+    // default goes out here. Step 3 replaces this with the account's real
+    // enterprise id once discovery carries one.
+    "X-Private-Data": "false",
+    ...buddyStainlessHeaders(),
+  };
+}

package/src/providers/integrations/buddy/buddy-conversation-headers.ts

@@ -81,6 +81,10 @@ export function buddyConversationHeaders(
     "x-request-id": messageId,
     "x-root-request-id": conversationRequestId,
     "x-trace-id": traceId,
+    // W3C trace context alongside the B3 set below: the upstream reads both,
+    // and every reference request carries `traceparent`, so sending only the
+    // B3 half leaves a header the channel check expects absent.
+    traceparent: `00-${b3TraceId}-${messageId.slice(0, 16)}-01`,
     "x-b3-traceid": b3TraceId,
     "x-b3-spanid": messageId.slice(0, 16),
     "x-b3-sampled": "1",

package/src/providers/integrations/buddy/buddy-discovery-shared.ts

@@ -37,6 +37,18 @@ export const BUDDY_CN_MODELS_PATH = "/console/enterprises/personal/models" as co
  */
 export const BUDDY_INTL_MODELS_PATH = "/v2/enterprises/personal/models" as const;
 
+/**
+ * Remote config path, answered on every realm's chat host.
+ *
+ * Both reference gateways treat this as the primary model catalog and the
+ * personal-models paths above as the narrower fallback: `/v3/config` carries
+ * the same `{ code, msg, data: { models, agents } }` envelope plus the
+ * per-product rosters the personal path does not always publish. It is tried
+ * first, and a failure falls through to the path the caller already passes, so
+ * a host that does not answer it behaves exactly as it does today.
+ */
+export const BUDDY_CONFIG_PATH = "/v3/config" as const;
+
 /** Envelope code the console directory answers on success. */
 const BUDDY_OK_CODE = 0;
 
@@ -92,13 +104,33 @@ export async function fetchBuddyDirectoryModels(args: {
   readonly fetcher?: typeof fetch | undefined;
 }): Promise<readonly ModelDefinition[] | null> {
   const fetcher = args.fetcher ?? globalThis.fetch;
+  const primary = await fetchBuddyDirectoryOnce(args, fetcher, BUDDY_CONFIG_PATH);
+  if (primary !== null) return primary;
+  // Both references rank `/v3/config` above the personal-models path, but this
+  // repo has only ever called the latter, so the fallback keeps today's
+  // behaviour intact for a host that answers one and not the other.
+  return await fetchBuddyDirectoryOnce(args, fetcher, args.modelsPath);
+}
+
+/** Reads one directory path; `null` on any transport, status, or shape miss. */
+async function fetchBuddyDirectoryOnce(
+  args: {
+    readonly siteUrl: string;
+    readonly providerId: string;
+    readonly credential: string;
+    readonly endpoint: string | undefined;
+    readonly signal?: AbortSignal | undefined;
+  },
+  fetcher: typeof fetch,
+  path: string,
+): Promise<readonly ModelDefinition[] | null> {
   // The directory scores by account: an access token's `sub` is the uid. An
   // opaque API key carries no identity, and the endpoint still answers for it,
   // so the header is declared absent rather than guessed.
   const uid = buddyAccountUid(args.credential);
   let response: Response;
   try {
-    response = await fetcher(`${siteOrigin(args.siteUrl)}${args.modelsPath}`, {
+    response = await fetcher(`${siteOrigin(args.siteUrl)}${path}`, {
       method: "GET",
       headers: {
         accept: "application/json",

package/src/providers/integrations/buddy/buddy-identity.ts

@@ -0,0 +1,46 @@
+import type { ProviderDispatchContext } from "../../provider-contracts";
+
+/**
+ * Which upstream client a buddy provider presents itself as.
+ *
+ * `desktop` is what every buddy provider sends today and stays the default for
+ * all four. `cli` is the identity the reference gateways use for CLI traffic: a
+ * different header set, a different User-Agent formula, and a different CN
+ * upstream.
+ *
+ * Nothing flips to `cli` implicitly. Being wrong here is what gets an account
+ * blocked upstream, so a provider changes identity only when an operator or an
+ * account says so.
+ */
+export type BuddyIdentity = "desktop" | "cli";
+
+/**
+ * Resolves the identity one buddy dispatch presents.
+ *
+ * Precedence is account then provider: an account authorized as a CLI keeps
+ * that identity even when the provider default changes, because the upstream
+ * recorded it at login. The provider-level flag is
+ * `compatibilityProfile.cli_identity`, already declared, validated, and
+ * defaulted — it just never reached these adapters before.
+ */
+export function resolveBuddyIdentity(
+  context: ProviderDispatchContext | undefined,
+  profileIdentity?: boolean | undefined,
+): BuddyIdentity {
+  const accountRaw = context?.credential.auth_state?.["cliIdentity"];
+  if (accountRaw === true) return "cli";
+  if (accountRaw === false) return "desktop";
+  return profileIdentity === true ? "cli" : "desktop";
+}
+
+/**
+ * The upstream's `X-User-Id` for a buddy dispatch.
+ *
+ * The reference CLI sends the literal `anonymous` when it has no uid rather
+ * than omitting the header, so an unauthenticated dispatch still looks like a
+ * client rather than like a caller that forgot a header.
+ */
+export function buddyUserId(context?: ProviderDispatchContext): string {
+  const accountId = context?.credential.account_id;
+  return accountId !== undefined && accountId.length > 0 ? accountId : "anonymous";
+}

package/src/providers/integrations/buddy/buddy-oauth-shared.ts

@@ -280,7 +280,43 @@ export class BuddyOAuthClient extends OAuthDeviceFlow {
         reason: `${this.#variant.providerId} token response omitted accessToken`,
       };
     }
-    return { status: "complete", result: tokenResult(this.#variant, payload) };
+    // The profile nickname is a second, authorized request the reference makes
+    // once the token lands — the JWT carries the email but not always a
+    // display name. Best-effort by design: a login must not fail because the
+    // profile endpoint was unreachable, so every miss falls back to the label
+    // the token itself yields.
+    const nickname = await this.fetchAccountNickname(deviceAuthId, access);
+    if (nickname === undefined) return { status: "complete", result: tokenResult(this.#variant, payload) };
+    const result = tokenResult(this.#variant, payload);
+    return {
+      status: "complete",
+      result: { ...result, accountLabel: result.accountLabel ?? nickname },
+    };
+  }
+
+  /** Reads the account profile nickname, or `undefined` on any miss. */
+  private async fetchAccountNickname(
+    deviceAuthId: string,
+    accessToken: string,
+  ): Promise<string | undefined> {
+    try {
+      // Both references call `/v2/plugin/login/account` with the token after
+      // the poll succeeds; the poll URL is the same versioned plugin root, so
+      // the profile path is derived from it rather than declared per variant.
+      const url = `${this.#variant.devicePollUrl.replace("/plugin/auth/token", "/plugin/login/account")}?state=${encodeURIComponent(deviceAuthId)}`;
+      const response = await this.fetchFn(url, {
+        method: "GET",
+        headers: {
+          ...(await devicePollHeaders(this.#variant)),
+          authorization: `Bearer ${accessToken}`,
+        },
+      });
+      if (!response.ok) return undefined;
+      const profile = buddyResponseData((await response.json()) as unknown);
+      return nonEmptyTrimmedString(profile?.nickname);
+    } catch {
+      return undefined;
+    }
   }
 
   override async refresh(refreshToken: string, signal?: AbortSignal): Promise<OAuthTokenRefreshResult> {

package/src/providers/integrations/buddy/buddy-usage-store.ts

@@ -10,7 +10,7 @@
  * Deliberately not a request-path store: this is written by a maintenance pass
  * and read by the console. Nothing here can fail a dispatch.
  */
-import { and, desc, eq, inArray, sql } from "drizzle-orm";
+import { and, desc, eq, gte, inArray, sql } from "drizzle-orm";
 import type { CartethyiaDatabase } from "../../../persistence/db-handle";
 import { buddyUsageSnapshots } from "../../../persistence/schema";
 import type { BuddyUsageRow } from "./buddy-usage-shared";
@@ -23,6 +23,11 @@ export interface BuddyUsageSnapshotRow extends BuddyUsageRow {
 /** Days of usage retained. The upstream's own window is 30. */
 const RETENTION_DAYS = 30;
 
+/** Oldest day a stored bucket can hold, as the `YYYY-MM-DD` key the table uses. */
+function retentionCutoff(now: Date = new Date()): string {
+  return new Date(now.getTime() - RETENTION_DAYS * 86_400_000).toISOString().slice(0, 10);
+}
+
 /**
  * Upserts one account's usage buckets.
  *
@@ -72,7 +77,31 @@ export async function saveBuddyUsageSnapshots(
 }
 
 /**
- * Reads one account's stored usage, newest day first.
+ * Most (day, model) buckets one day can hold, used only to bound the read.
+ *
+ * The renderer keeps {@link DEFAULT_LIMIT_PER_ACCOUNT} entries per account plus
+ * every bucket of the newest day, so this is a ceiling on a pathological table
+ * rather than a number the page depends on. Set well above any real model count
+ * so the cap can only ever trigger on a table that grew without pruning.
+ */
+const MODELS_PER_DAY_CEILING = 64;
+
+/** Buckets per account the console renders. */
+const DEFAULT_LIMIT_PER_ACCOUNT = 30;
+
+/**
+ * Reads each account's stored usage, newest day first.
+ *
+ * Bounded on both axes, because it used to be bounded on neither: with no day
+ * filter and no `LIMIT`, an account fetched every bucket it had ever stored
+ * (~1500 rows for a 30-day window) to render 30 of them, on the route the
+ * dashboard polls.
+ *
+ * - The day window is semantic, not a truncation: {@link pruneBuddyUsageSnapshots}
+ *   already drops everything older, so no row it excludes could have been
+ *   rendered anyway.
+ * - The row ceiling is the backstop. It is sized per account, so one large
+ *   account cannot starve the others in a shared `LIMIT`.
  *
  * `numeric` comes back from the driver as a string, so the credit is parsed
  * rather than trusted; an unparseable row is reported as 0 instead of being
@@ -81,7 +110,7 @@ export async function saveBuddyUsageSnapshots(
 export async function readBuddyUsageSnapshots(
   db: CartethyiaDatabase,
   accountIds: readonly string[],
-  limitPerAccount = 30,
+  limitPerAccount = DEFAULT_LIMIT_PER_ACCOUNT,
 ): Promise<Map<string, readonly BuddyUsageSnapshotRow[]>> {
   const result = new Map<string, BuddyUsageSnapshotRow[]>();
   if (accountIds.length === 0) return result;
@@ -102,8 +131,14 @@ export async function readBuddyUsageSnapshots(
         syncedAt: buddyUsageSnapshots.syncedAt,
       })
       .from(buddyUsageSnapshots)
-      .where(inArray(buddyUsageSnapshots.accountId, [...accountIds]))
-      .orderBy(desc(buddyUsageSnapshots.dayKey));
+      .where(
+        and(
+          inArray(buddyUsageSnapshots.accountId, [...accountIds]),
+          gte(buddyUsageSnapshots.dayKey, retentionCutoff()),
+        ),
+      )
+      .orderBy(desc(buddyUsageSnapshots.dayKey))
+      .limit(accountIds.length * limitPerAccount * MODELS_PER_DAY_CEILING);
   } catch {
     return result;
   }

package/src/providers/integrations/buddy/codebuddy/provider.ts

@@ -109,8 +109,8 @@ export const CODEBUDDY_IMAGE_MODELS: readonly ModelDefinition[] = makeBuddyImage
 /**
  * CodeBuddy's video-generation rows (`seedance-2.5`).
  *
- * Reached through `/v1/videos/generations`, so the endpoint is the upstream
- * video path rather than a chat-completions path.
+ * Reached through `/videos/generations` on the `/v2` base, so the endpoint is
+ * the upstream video path rather than a chat-completions path.
  */
 export const CODEBUDDY_VIDEO_MODELS: readonly ModelDefinition[] = makeBuddyVideoModels(
   "cb",

package/src/providers/integrations/buddy/codebuddy/shared.ts

@@ -1,73 +1,106 @@
-import { withBearerAuthentication, type OpenAICompatibleAdapterConfig } from "../../../adapters/compatible-adapter";
-import type { CanonicalRequest } from "../../../../protocol/canonical-model";
-import type { ProviderDispatchContext, ProviderDispatchTarget, ProviderId } from "../../../provider-contracts";
-import { resolveInboundSessionId } from "../../../operations/session-resolution";
-import { buddyConversationHeaders } from "../buddy-conversation-headers";
-import { buildCodeBuddyUserAgent } from "../../../operations/client-versions";
-import { readBuddyDeviceToken } from "../workbuddy/shared";
-
-/** Client identity variant behind the per-request CodeBuddy headers. */
-export type CodeBuddyVariant = "IDE" | "CLI";
-
-export function codebuddyDomain(variant: CodeBuddyVariant): string {
-  return variant === "IDE" ? "www.codebuddy.ai" : "copilot.tencent.com";
-}
-
-
-/**
- * Per-request CodeBuddy headers — exact provider contract shared by the
- * international (IDE identity) and CN (CLI identity). The stable conversation
- * header is preserved from the client when available; request IDs rotate.
- */
-export async function codebuddyHeaders(
-  variant: CodeBuddyVariant,
-  context?: ProviderDispatchContext,
-  request?: CanonicalRequest,
-): Promise<Record<string, string>> {
-  const identity = variant === "IDE" ? "IDE" : "CLI";
-  const ua = buildCodeBuddyUserAgent(identity);
-  const deviceToken = readBuddyDeviceToken(context);
-  const conversationId = resolveInboundSessionId(context, request);
-  return {
-    accept: "text/event-stream",
-    "User-Agent": ua,
-    "X-Product": "SaaS",
-    "X-IDE-Type": identity,
-    "X-IDE-Name": identity,
-    "X-Domain": codebuddyDomain(variant),
-    "x-requested-with": "XMLHttpRequest",
-    "x-codebuddy-request": "1",
-    // Same family WorkBuddy sends: the upstream's channel check reads the
-    // turn-level aggregation key, and a chat request without it is refused with
-    // `400 · 11128 "conversation id missing"`.
-    ...buddyConversationHeaders({
-      ...(conversationId === undefined ? {} : { conversationId }),
-    }),
-    ...(deviceToken === undefined ? {} : { "X-Device-Token": deviceToken }),
-  };
-}
-
-/**
- * Shared OpenAI-compatible chat-adapter config for both CodeBuddy variants:
- * bearer auth, chat-only wire contract, per-request identity headers, and the
- * variant's payload hook.
- */
-export function codebuddyAdapterConfig(args: {
-  providerId: ProviderId;
-  baseUrl: string;
-  variant: CodeBuddyVariant;
-  prePayload: (
-    payload: Record<string, unknown>,
-    request: CanonicalRequest,
-    candidate: ProviderDispatchTarget,
-  ) => void;
-  fetchImpl?: typeof fetch;
-}): OpenAICompatibleAdapterConfig {
-  return withBearerAuthentication({
-    provider_id: args.providerId,
-    base_url: args.baseUrl,
-    buildExtraHeaders: (context, request) => codebuddyHeaders(args.variant, context, request),
-    prePayload: args.prePayload,
-    ...(args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}),
-  });
-}
+import { withBearerAuthentication, type OpenAICompatibleAdapterConfig } from "../../../adapters/compatible-adapter";
+import type { CanonicalRequest } from "../../../../protocol/canonical-model";
+import type { ProviderDispatchContext, ProviderDispatchTarget, ProviderId } from "../../../provider-contracts";
+import { resolveInboundSessionId } from "../../../operations/session-resolution";
+import { buddyConversationHeaders } from "../buddy-conversation-headers";
+import { buddyUserId, resolveBuddyIdentity } from "../buddy-identity";
+import { buildCodeBuddyUserAgent, getCodeBuddyCnVersion, getCodeBuddyVersion } from "../../../operations/client-versions";
+import { readBuddyDeviceToken } from "../workbuddy/shared";
+import { buddyCliHeaders, buddyCliTraceHeaders } from "../buddy-cli-headers";
+
+/** Client identity variant behind the per-request CodeBuddy headers. */
+export type CodeBuddyVariant = "IDE" | "CLI";
+
+export function codebuddyDomain(variant: CodeBuddyVariant): string {
+  return variant === "IDE" ? "www.codebuddy.ai" : "copilot.tencent.com";
+}
+
+
+/**
+ * Per-request CodeBuddy headers — exact provider contract shared by the
+ * international (IDE identity) and CN (CLI identity). The stable conversation
+ * header is preserved from the client when available; request IDs rotate.
+ *
+ * `cliIdentity` selects the real CLI contract rather than today's hybrid: the
+ * reference CLI is issued by the OpenAI Node SDK, so it carries no browser
+ * headers and no device token, and it adds the agent envelope. Left unset it
+ * keeps the current behaviour for every provider.
+ */
+export async function codebuddyHeaders(
+  variant: CodeBuddyVariant,
+  context?: ProviderDispatchContext,
+  request?: CanonicalRequest,
+  cliIdentity?: boolean,
+): Promise<Record<string, string>> {
+  const identity = variant === "IDE" ? "IDE" : "CLI";
+  const ua = buildCodeBuddyUserAgent(identity);
+  const deviceToken = readBuddyDeviceToken(context);
+  const conversationId = resolveInboundSessionId(context, request);
+  const conversation = buddyConversationHeaders({
+    ...(conversationId === undefined ? {} : { conversationId }),
+  });
+  if (resolveBuddyIdentity(context, cliIdentity) === "cli") {
+    return {
+      // The reference is explicit: the official CLI sends `Accept:
+      // application/json` and no browser header at all — no
+      // `X-Requested-With`, no `x-codebuddy-request`, no device token. A
+      // request carrying both halves is a hybrid no real client produces.
+      accept: "application/json",
+      "User-Agent": `CLI/${getCodeBuddyVersion()} CodeBuddy/${getCodeBuddyVersion()}`,
+      "X-Product": "SaaS",
+      "X-IDE-Type": "CLI",
+      "X-IDE-Name": "CLI",
+      "X-IDE-Version": getCodeBuddyVersion(),
+      "X-Domain": codebuddyDomain(variant),
+      ...conversation,
+      ...buddyCliTraceHeaders(conversation),
+      ...buddyCliHeaders({ userId: buddyUserId(context) }),
+    };
+  }
+  return {
+    accept: "text/event-stream",
+    "User-Agent": ua,
+    "X-Product": "SaaS",
+    "X-IDE-Type": identity,
+    "X-IDE-Name": identity,
+    // Every reference branch sends this, in both the desktop and the CLI
+    // product; its absence here is what made a CodeBuddy dispatch the only
+    // buddy caller with no client version on the wire.
+    "X-IDE-Version": identity === "CLI" ? getCodeBuddyCnVersion() : getCodeBuddyVersion(),
+    "X-Domain": codebuddyDomain(variant),
+    "x-requested-with": "XMLHttpRequest",
+    "x-codebuddy-request": "1",
+    // Same family WorkBuddy sends: the upstream's channel check reads the
+    // turn-level aggregation key, and a chat request without it is refused with
+    // `400 · 11-128 "conversation id missing"`.
+    ...conversation,
+    ...(deviceToken === undefined ? {} : { "X-Device-Token": deviceToken }),
+  };
+}
+
+/**
+ * Shared OpenAI-compatible chat-adapter config for both CodeBuddy variants:
+ * bearer auth, chat-only wire contract, per-request identity headers, and the
+ * variant's payload hook.
+ */
+export function codebuddyAdapterConfig(args: {
+  providerId: ProviderId;
+  baseUrl: string;
+  variant: CodeBuddyVariant;
+  prePayload: (
+    payload: Record<string, unknown>,
+    request: CanonicalRequest,
+    candidate: ProviderDispatchTarget,
+  ) => void;
+  fetchImpl?: typeof fetch;
+  cliIdentity?: boolean;
+}): OpenAICompatibleAdapterConfig {
+  return withBearerAuthentication({
+    provider_id: args.providerId,
+    base_url: args.baseUrl,
+    buildExtraHeaders: (context, request) =>
+      codebuddyHeaders(args.variant, context, request, args.cliIdentity),
+    prePayload: args.prePayload,
+    ...(args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}),
+  });
+}

package/src/providers/integrations/buddy/workbuddy/cn-provider.ts

@@ -5,7 +5,7 @@ import type { DiscoveryInput } from "../../../discovery/discovery-types";
 import type { ModelDefinition } from "../../../provider-model-definition";
 import { providerBaseUrl } from "../../../provider-metadata";
 import { getWorkBuddyCnClientVersion } from "../../../operations/client-versions";
-import { BUDDY_INTL_MODELS_PATH, fetchBuddyDirectoryModels } from "../buddy-discovery-shared";
+import { BUDDY_CN_MODELS_PATH, fetchBuddyDirectoryModels } from "../buddy-discovery-shared";
 import { CODEBUDDY_CN_MODELS } from "../codebuddy/cn-provider";
 import { workbuddyPrePayload, WORKBUDDY_SYSTEM_PROMPT } from "./provider";
 import { workbuddyAdapterConfig, workbuddyHeaders, WORKBUDDY_CHAT_PATH } from "./shared";
@@ -28,7 +28,10 @@ export async function discoverWorkBuddyCnModels(
     siteUrl: WORKBUDDY_CN_BASE_URL,
     providerId: WORKBUDDY_CN_PROVIDER_ID,
     credential: input.credential,
-    modelsPath: BUDDY_INTL_MODELS_PATH,
+    // The CN host answers the `/console/…` directory, exactly like the CodeBuddy
+    // CN host does; the international path was inherited from the intl provider
+    // and the CN edge answers it with a 500 rather than a 404.
+    modelsPath: BUDDY_CN_MODELS_PATH,
     endpoint: WORKBUDDY_CHAT_PATH,
     ...(input.signal ? { signal: input.signal } : {}),
     ...(input.fetcher ? { fetcher: input.fetcher } : {}),