cartethyia 2.4.5 → 2.5.0

package/src/console/providers/catalog/contracts.ts

@@ -87,6 +87,9 @@ const VALID_SERVICE_KINDS: Record<ServiceKind, true> = {
   websearch: true,
   imageGeneration: true,
   videoGeneration: true,
+  embedding: true,
+  audioTranscription: true,
+  audioSpeech: true,
 };
 
 export function isServiceKind(value: unknown): value is ServiceKind {
@@ -337,6 +340,24 @@ export interface ModelCatalogEntry {
    * so an operator can tell a measured window from a stand-in.
    */
   limitsEstimated?: boolean;
+  /**
+   * True when the provider refuses this model on a free plan, so the surface
+   * can mark it rather than letting an operator discover it from a dispatch
+   * failure.
+   *
+   * Absence is "tier unknown", not "served on a free plan" — most providers
+   * publish nothing about plan access, and a pill that renders unknown as free
+   * would mislabel every one of them.
+   */
+  proOnly?: boolean;
+  /**
+   * True when the provider publishes this row as free, so the surface can show
+   * the tier instead of an operator discovering it from the pricing.
+   *
+   * Absence is "tier unknown", not "not free": the flag is only set where the
+   * provider's own model directory states it.
+   */
+  freeTier?: boolean;
 }
 export interface FlatModelCatalogEntry {
   readonly providerId: string;
@@ -633,6 +654,16 @@ export interface ProviderResponse {
      * console offers an import path alongside the redirect and device flows.
      */
     readonly import: boolean;
+    /**
+     * The imported credential is a refreshable token pair rather than a static
+     * key: the client can both import and refresh.
+     *
+     * Import-only clients otherwise look identical to API-key providers — no
+     * redirect, no device code — and were grouped with them, which filed a
+     * refreshable OAuth account under "API Key Providers" where nothing
+     * explains that it expires and renews.
+     */
+    readonly refreshable: boolean;
     /** Fields the browser flow must collect before it starts. */
     readonly browserLoginFields: readonly ProviderLoginField[];
     /** Fields the device flow must collect before it starts. */

package/src/console/providers/catalog/provider-operations.ts

@@ -191,6 +191,14 @@ async function attachProviderCapabilities(
       // one, so the dashboard never renders a form whose submit the server
       // would refuse.
       import: typeof client.importCredential === "function",
+      // Both halves are required: an import-only client that cannot refresh
+      // (Alibaba Coding Plan, Cloudflare AI) stores a durable static key, while
+      // one that can (Trae) stores a token pair that expires and renews. The
+      // refresher comes from the registry rather than the login client because
+      // that is where `loadAuthentication` registers it.
+      refreshable:
+        typeof client.importCredential === "function" &&
+        (await registry.resolveRefresher(response.providerId)) !== undefined,
       browserLoginFields: (client.browserLoginFields ?? []).map(toProviderLoginField),
       deviceLoginFields: (client.deviceLoginFields ?? []).map(toProviderLoginField),
       importFields: (client.importFields ?? []).map(toProviderLoginField),

package/src/console/providers/catalog/public-model-store.ts

@@ -104,16 +104,6 @@ function commonCost(entries: readonly unknown[]): unknown {
   return present.every((entry) => costSignature(entry) === signature) ? present[0] : undefined;
 }
 
-function matchesModelPrefix(
-  modelPrefix: string | undefined,
-  bareModelId: string,
-  qualifiedModelId?: string,
-): boolean {
-  const prefix = modelPrefix?.trim();
-  if (!prefix) return true;
-  return bareModelId.startsWith(prefix) || qualifiedModelId?.startsWith(prefix) === true;
-}
-
 /** Catalog metadata mirrored onto an alias or combo entry. */
 export interface ModelMetadata {
   readonly contextLimit: number | null;
@@ -153,15 +143,42 @@ export function resolveTargetIds(
   name: string,
   aliasTargets: ReadonlyMap<string, string>,
   comboMembers: ReadonlyMap<string, readonly string[]>,
-  seen: ReadonlySet<string> = new Set(),
+  seen: Set<string> = new Set(),
+): string[] {
+  return collectTargetIds(name, aliasTargets, comboMembers, seen);
+}
+
+/**
+ * Walks alias → combo → member with one mutable visited set.
+ *
+ * The previous form copied the whole set per edge (`new Set(seen).add(name)`),
+ * which is called per alias and per combo row over the whole catalog. Adding
+ * and removing on one set keeps the same cycle protection — each branch still
+ * sees its own ancestors — without an allocation per step.
+ */
+function collectTargetIds(
+  name: string,
+  aliasTargets: ReadonlyMap<string, string>,
+  comboMembers: ReadonlyMap<string, readonly string[]>,
+  seen: Set<string>,
 ): string[] {
   if (seen.has(name) || seen.size >= MAX_TARGET_DEPTH) return [];
-  const next = new Set(seen).add(name);
-  const members = comboMembers.get(name);
-  if (members) return members.flatMap((m) => resolveTargetIds(m, aliasTargets, comboMembers, next));
-  const target = aliasTargets.get(name);
-  if (target !== undefined) return resolveTargetIds(target, aliasTargets, comboMembers, next);
-  return [name];
+  seen.add(name);
+  try {
+    const members = comboMembers.get(name);
+    if (members) {
+      return members.flatMap((m) => collectTargetIds(m, aliasTargets, comboMembers, seen));
+    }
+    const target = aliasTargets.get(name);
+    if (target !== undefined) {
+      return collectTargetIds(target, aliasTargets, comboMembers, seen);
+    }
+    return [name];
+  } finally {
+    // Removing on the way out keeps `seen` meaning "ancestors on this path",
+    // so a name reachable by two sibling branches still resolves in both.
+    seen.delete(name);
+  }
 }
 
 /**
@@ -339,10 +356,21 @@ export class PublicModelCatalogStore {
     return result;
   }
 
+  /**
+   * Lists the models this key may see.
+   *
+   * `modelPrefix` is accepted and currently has NO effect on the result. It
+   * used to feed a `matchesModelPrefix(...) || isModelAllowed(...)` disjunct
+   * that was immediately followed by `isModelAllowed(...)` on its own — so the
+   * prefix could never add a row, and dropping it changes nothing. The
+   * parameter is kept so the call sites and the auth shape stay stable; if a
+   * real prefix filter is wanted later it needs to be an AND, not the OR it
+   * was written as.
+   */
   async listPublicModels(
     tenantId: string | null,
     snapshot: ApiKeyAuthorizationSnapshot,
-    modelPrefix?: string,
+    _modelPrefix?: string,
   ): Promise<AllowedModelEntry[]> {
     const providerScope =
       tenantId === null
@@ -407,40 +435,46 @@ export class PublicModelCatalogStore {
       if (typeof combo.name === "string") comboNames.add(combo.name);
     }
 
-    const modelEntries: AllowedModelEntry[] = rows
-      .filter((row) => {
-        // A provider is listed only when the tenant has an active account for
-        // it — the same rule the console model picker applies. A no-auth
-        // provider with nothing configured is not "set", so it stays hidden
-        // until the operator adds an account.
-        if (tenantId === null) return row.providerRequiresAccount === false;
-        return activeProviderIds.has(row.providerId);
-      })
-      .filter((row) =>
-        matchesModelPrefix(modelPrefix, row.modelId, `${row.providerId}/${row.modelId}`) ||
-        isModelAllowed(snapshot, row.modelId, row.providerId),
-      )
-      .filter((m) => isModelAllowed(snapshot, m.modelId, m.providerId))
-      .filter((m) => !shadowsAliasOrCombo(m, aliasTargets, comboNames, snapshot))
-      .map((m) => {
-        const capabilities = normalizeModalities(m.modalities);
-        return {
-          id: `${m.providerId}/${m.modelId}`,
-          object: "model" as const,
-          created: Math.floor(Date.now() / 1000),
-          owned_by: m.providerId,
-          ...(m.contextLimit != null ? { context_length: m.contextLimit } : {}),
-          ...(m.outputLimit != null ? { max_completion_tokens: m.outputLimit } : {}),
-          ...(capabilities ? { capabilities } : {}),
-          ...(m.reasoning ? { reasoning: true } : {}),
-          ...(m.toolCall ? { tool_call: true } : {}),
-          ...(m.cost != null ? { cost: m.cost } : {}),
-          // Only a non-`llm` row is labelled: absence already means "chat wire".
-          ...(m.serviceKind && m.serviceKind !== "llm"
-            ? { service_kind: m.serviceKind }
-            : {}),
-        };
+    // One clock reading for the whole response: `created` is the same
+    // timestamp for every entry, and reading it per row made the field vary
+    // across a single listing.
+    const now = Math.floor(Date.now() / 1000);
+    const modelEntries: AllowedModelEntry[] = [];
+    for (const row of rows) {
+      // A provider is listed only when the tenant has an active account for
+      // it — the same rule the console model picker applies. A no-auth
+      // provider with nothing configured is not "set", so it stays hidden
+      // until the operator adds an account.
+      const listed =
+        tenantId === null ? row.providerRequiresAccount === false : activeProviderIds.has(row.providerId);
+      if (!listed) continue;
+      const qualified = `${row.providerId}/${row.modelId}`;
+      // The prefix test is deliberately gone from this path: the chain used to
+      // be `(prefixMatch || isAllowed)` followed by `isAllowed`, which reduces
+      // to `isAllowed` alone — the prefix disjunct could never change the
+      // outcome, only cost a second full pass over the catalog. Collapsing the
+      // four chained filters into one loop also drops the three intermediate
+      // arrays they materialized.
+      if (!isModelAllowed(snapshot, row.modelId, row.providerId)) continue;
+      if (shadowsAliasOrCombo(row, aliasTargets, comboNames, snapshot)) continue;
+      const capabilities = normalizeModalities(row.modalities);
+      modelEntries.push({
+        id: qualified,
+        object: "model" as const,
+        created: now,
+        owned_by: row.providerId,
+        ...(row.contextLimit != null ? { context_length: row.contextLimit } : {}),
+        ...(row.outputLimit != null ? { max_completion_tokens: row.outputLimit } : {}),
+        ...(capabilities ? { capabilities } : {}),
+        ...(row.reasoning ? { reasoning: true } : {}),
+        ...(row.toolCall ? { tool_call: true } : {}),
+        ...(row.cost != null ? { cost: row.cost } : {}),
+        // Only a non-`llm` row is labelled: absence already means "chat wire".
+        ...(row.serviceKind && row.serviceKind !== "llm"
+          ? { service_kind: row.serviceKind }
+          : {}),
       });
+    }
 
     // Expose tenant model aliases and combos as first-class public models.
     // `aliasRows`/`comboRows` were loaded above for the shadow filter.
@@ -465,9 +499,10 @@ export class PublicModelCatalogStore {
       ].flat();
       const targetMeta = await this.modelMetadataById(tenantId, targetIds);
 
-      const now = Math.floor(Date.now() / 1000);
+
       for (const a of aliasRows) {
-        if (!matchesModelPrefix(modelPrefix, a.alias) && !isModelAllowed(snapshot, a.alias)) continue;
+        // `!A && !B` followed by `!B` — the second subsumes the first, so the
+        // prefix test never changed the outcome. Collapsed to the real gate.
         if (!isModelAllowed(snapshot, a.alias)) continue;
         const target = advertisedMetadata(resolveTargetIds(a.targetModel, aliasTargets, comboMembers), targetMeta);
         const capabilities = normalizeModalities(target.modalities);
@@ -486,7 +521,6 @@ export class PublicModelCatalogStore {
       }
 
       for (const c of comboRows) {
-        if (!matchesModelPrefix(modelPrefix, c.name) && !isModelAllowed(snapshot, c.name)) continue;
         if (!isModelAllowed(snapshot, c.name)) continue;
         const target = advertisedMetadata(resolveTargetIds(c.name, aliasTargets, comboMembers), targetMeta);
         const capabilities = normalizeModalities(target.modalities);
@@ -648,12 +682,9 @@ export class PublicModelCatalogStore {
         )
         .limit(1);
       const row = rows[0];
-      if (
-        row &&
-        (matchesModelPrefix(modelPrefix, row.modelId, `${row.providerId}/${row.modelId}`) ||
-          isModelAllowed(snapshot, row.modelId, row.providerId)) &&
-        isModelAllowed(snapshot, row.modelId, row.providerId)
-      ) {
+      // Same reduction as the listing path: `(prefix || allowed) && allowed`
+      // is just `allowed`, and the prefix disjunct cost a redundant call.
+      if (row && isModelAllowed(snapshot, row.modelId, row.providerId)) {
         const capabilities = normalizeModalities(row.modalities);
         return {
           id: `${row.providerId}/${row.modelId}`,