cartethyia 2.4.5 → 2.5.0

package/src/providers/integrations/buddy/buddy-cli-headers.ts

@@ -0,0 +1,88 @@
+/**
+ * The header family only the CLI identity sends.
+ *
+ * Everything here comes from the two reference gateways, which agree: the
+ * desktop product sends conversation/tracing headers and browser transport,
+ * while the CLI sends the agent envelope plus the OpenAI Node SDK fingerprint
+ * and no browser headers at all. A request carrying both halves is a hybrid no
+ * real client produces, which is what risk control keys on.
+ *
+ * Two references, two fingerprints: the hub derives OS/arch and a Node version
+ * from its own host, and codebuddy2api pins a fixed Linux/x64/v24.21.0 set.
+ * Neither can be right for every deployment, so the values here follow the
+ * host this gateway actually runs on — they are a fingerprint of the process,
+ * not a claim about a remote machine.
+ */
+
+/** OpenAI Node SDK 6.25.0 `x-stainless-*` fingerprint; both references agree. */
+const STAINLESS_PACKAGE_VERSION = "6.25.0";
+
+function hostOs(): string {
+  return process.platform === "win32" ? "Windows" : process.platform === "darwin" ? "MacOS" : "Linux";
+}
+
+function hostArch(): string {
+  return process.arch === "arm64" || process.arch === "ia32" ? process.arch : "x64";
+}
+
+/**
+ * The SDK fingerprint headers.
+ *
+ * `x-stainless-timeout` is in the hub only and `x-stainless-retry-count` is in
+ * both; the SDK sends both, so both go out.
+ */
+export function buddyStainlessHeaders(): Record<string, string> {
+  return {
+    "x-stainless-lang": "js",
+    "x-stainless-package-version": STAINLESS_PACKAGE_VERSION,
+    "x-stainless-os": hostOs(),
+    "x-stainless-arch": hostArch(),
+    "x-stainless-runtime": "node",
+    "x-stainless-runtime-version": process.version,
+    "x-stainless-retry-count": "0",
+    "x-stainless-timeout": "1200",
+  };
+}
+
+/**
+ * The trace family the CLI carries as a child span.
+ *
+ * The desktop product omits the parent (`with_parent=False` in the reference);
+ * the CLI conversation request is a child span, so it also sends `b3`'s fourth
+ * field and `X-B3-ParentSpanId`. `buddyConversationHeaders` already produces
+ * `traceparent`, `b3`, and the `X-B3-*` set, so only the parent is added here.
+ */
+export function buddyCliTraceHeaders(
+  conversation: Readonly<Record<string, string>>,
+): Record<string, string> {
+  const traceId = conversation["x-trace-id"] ?? conversation["x-b3-traceid"];
+  const spanId = conversation["x-b3-spanid"];
+  if (traceId === undefined) return {};
+  const b3 = `${traceId}-${spanId ?? traceId.slice(0, 16)}-1-${traceId.slice(0, 16)}`;
+  return { ...(spanId === undefined ? {} : { "X-B3-ParentSpanId": spanId }), b3 };
+}
+
+/**
+ * The full CLI identity envelope, minus what each caller already supplies.
+ *
+ * The caller keeps ownership of `User-Agent`, `X-IDE-*`, `X-Domain`, and the
+ * conversation family, because those vary by provider and realm: only the
+ * headers that are the same for every CLI dispatch are built here.
+ */
+export function buddyCliHeaders(args: { readonly userId: string }): Record<string, string> {
+  return {
+    "X-Agent-Intent": "craft",
+    "X-Agent-Type": "main",
+    // The reference enum is local-agent / cloud-agent / agent-agent, and its
+    // parser returns "other" for anything unknown or absent. A gateway is none
+    // of the three, so "other" is the honest value rather than a guess.
+    "X-Agent-Runtime": "other",
+    "X-User-Id": args.userId,
+    // Personal accounts are not an enterprise and the reference sends the flag
+    // either way (`true` only for an enterprise id), so the non-enterprise
+    // default goes out here. Step 3 replaces this with the account's real
+    // enterprise id once discovery carries one.
+    "X-Private-Data": "false",
+    ...buddyStainlessHeaders(),
+  };
+}

package/src/providers/integrations/buddy/buddy-conversation-headers.ts

@@ -81,14 +81,31 @@ export function buddyConversationHeaders(
     "x-request-id": messageId,
     "x-root-request-id": conversationRequestId,
     "x-trace-id": traceId,
+    // W3C trace context alongside the B3 set below: the upstream reads both,
+    // and every reference request carries `traceparent`, so sending only the
+    // B3 half leaves a header the channel check expects absent.
+    traceparent: `00-${b3TraceId}-${messageId.slice(0, 16)}-01`,
     "x-b3-traceid": b3TraceId,
     "x-b3-spanid": messageId.slice(0, 16),
     "x-b3-sampled": "1",
   };
-  // Only when the client actually gave one: inventing a conversation id makes
-  // the upstream build a session the caller never had.
-  if (ids.conversationId !== undefined && ids.conversationId.trim().length > 0) {
-    headers["x-conversation-id"] = ids.conversationId.trim();
-  }
+  // Always sent, invented when the caller gave none.
+  //
+  // This used to be omitted unless the client supplied one. That was wrong:
+  // `x-conversation-id` is mandatory, and a chat request without it is refused
+  // with `400 · 11-128 "request illegal"` — an error that names neither the
+  // header nor the channel, and which reads like a block rather than a missing
+  // field. Isolated against the live API by removing one header at a time:
+  // only `x-conversation-id`, `x-conversation-request-id` and
+  // `x-conversation-message-id` are required; the B3/W3C trace set, the
+  // stainless set, the agent block and the IDE block are all optional.
+  //
+  // Inventing one when the caller has none is still the right default: the id
+  // is per-dispatch here, so a caller with no session is not claiming a session
+  // it never had — and withholding the header only guarantees a refusal.
+  headers["x-conversation-id"] =
+    ids.conversationId !== undefined && ids.conversationId.trim().length > 0
+      ? ids.conversationId.trim()
+      : newMessageId();
   return headers;
 }

package/src/providers/integrations/buddy/buddy-discovery-shared.ts

@@ -37,6 +37,18 @@ export const BUDDY_CN_MODELS_PATH = "/console/enterprises/personal/models" as co
  */
 export const BUDDY_INTL_MODELS_PATH = "/v2/enterprises/personal/models" as const;
 
+/**
+ * Remote config path, answered on every realm's chat host.
+ *
+ * Both reference gateways treat this as the primary model catalog and the
+ * personal-models paths above as the narrower fallback: `/v3/config` carries
+ * the same `{ code, msg, data: { models, agents } }` envelope plus the
+ * per-product rosters the personal path does not always publish. It is tried
+ * first, and a failure falls through to the path the caller already passes, so
+ * a host that does not answer it behaves exactly as it does today.
+ */
+export const BUDDY_CONFIG_PATH = "/v3/config" as const;
+
 /** Envelope code the console directory answers on success. */
 const BUDDY_OK_CODE = 0;
 
@@ -92,13 +104,33 @@ export async function fetchBuddyDirectoryModels(args: {
   readonly fetcher?: typeof fetch | undefined;
 }): Promise<readonly ModelDefinition[] | null> {
   const fetcher = args.fetcher ?? globalThis.fetch;
+  const primary = await fetchBuddyDirectoryOnce(args, fetcher, BUDDY_CONFIG_PATH);
+  if (primary !== null) return primary;
+  // Both references rank `/v3/config` above the personal-models path, but this
+  // repo has only ever called the latter, so the fallback keeps today's
+  // behaviour intact for a host that answers one and not the other.
+  return await fetchBuddyDirectoryOnce(args, fetcher, args.modelsPath);
+}
+
+/** Reads one directory path; `null` on any transport, status, or shape miss. */
+async function fetchBuddyDirectoryOnce(
+  args: {
+    readonly siteUrl: string;
+    readonly providerId: string;
+    readonly credential: string;
+    readonly endpoint: string | undefined;
+    readonly signal?: AbortSignal | undefined;
+  },
+  fetcher: typeof fetch,
+  path: string,
+): Promise<readonly ModelDefinition[] | null> {
   // The directory scores by account: an access token's `sub` is the uid. An
   // opaque API key carries no identity, and the endpoint still answers for it,
   // so the header is declared absent rather than guessed.
   const uid = buddyAccountUid(args.credential);
   let response: Response;
   try {
-    response = await fetcher(`${siteOrigin(args.siteUrl)}${args.modelsPath}`, {
+    response = await fetcher(`${siteOrigin(args.siteUrl)}${path}`, {
       method: "GET",
       headers: {
         accept: "application/json",

package/src/providers/integrations/buddy/buddy-identity.ts

@@ -0,0 +1,46 @@
+import type { ProviderDispatchContext } from "../../provider-contracts";
+
+/**
+ * Which upstream client a buddy provider presents itself as.
+ *
+ * `desktop` is what every buddy provider sends today and stays the default for
+ * all four. `cli` is the identity the reference gateways use for CLI traffic: a
+ * different header set, a different User-Agent formula, and a different CN
+ * upstream.
+ *
+ * Nothing flips to `cli` implicitly. Being wrong here is what gets an account
+ * blocked upstream, so a provider changes identity only when an operator or an
+ * account says so.
+ */
+export type BuddyIdentity = "desktop" | "cli";
+
+/**
+ * Resolves the identity one buddy dispatch presents.
+ *
+ * Precedence is account then provider: an account authorized as a CLI keeps
+ * that identity even when the provider default changes, because the upstream
+ * recorded it at login. The provider-level flag is
+ * `compatibilityProfile.cli_identity`, already declared, validated, and
+ * defaulted — it just never reached these adapters before.
+ */
+export function resolveBuddyIdentity(
+  context: ProviderDispatchContext | undefined,
+  profileIdentity?: boolean | undefined,
+): BuddyIdentity {
+  const accountRaw = context?.credential.auth_state?.["cliIdentity"];
+  if (accountRaw === true) return "cli";
+  if (accountRaw === false) return "desktop";
+  return profileIdentity === true ? "cli" : "desktop";
+}
+
+/**
+ * The upstream's `X-User-Id` for a buddy dispatch.
+ *
+ * The reference CLI sends the literal `anonymous` when it has no uid rather
+ * than omitting the header, so an unauthenticated dispatch still looks like a
+ * client rather than like a caller that forgot a header.
+ */
+export function buddyUserId(context?: ProviderDispatchContext): string {
+  const accountId = context?.credential.account_id;
+  return accountId !== undefined && accountId.length > 0 ? accountId : "anonymous";
+}

package/src/providers/integrations/buddy/buddy-oauth-shared.ts

@@ -280,7 +280,43 @@ export class BuddyOAuthClient extends OAuthDeviceFlow {
         reason: `${this.#variant.providerId} token response omitted accessToken`,
       };
     }
-    return { status: "complete", result: tokenResult(this.#variant, payload) };
+    // The profile nickname is a second, authorized request the reference makes
+    // once the token lands — the JWT carries the email but not always a
+    // display name. Best-effort by design: a login must not fail because the
+    // profile endpoint was unreachable, so every miss falls back to the label
+    // the token itself yields.
+    const nickname = await this.fetchAccountNickname(deviceAuthId, access);
+    if (nickname === undefined) return { status: "complete", result: tokenResult(this.#variant, payload) };
+    const result = tokenResult(this.#variant, payload);
+    return {
+      status: "complete",
+      result: { ...result, accountLabel: result.accountLabel ?? nickname },
+    };
+  }
+
+  /** Reads the account profile nickname, or `undefined` on any miss. */
+  private async fetchAccountNickname(
+    deviceAuthId: string,
+    accessToken: string,
+  ): Promise<string | undefined> {
+    try {
+      // Both references call `/v2/plugin/login/account` with the token after
+      // the poll succeeds; the poll URL is the same versioned plugin root, so
+      // the profile path is derived from it rather than declared per variant.
+      const url = `${this.#variant.devicePollUrl.replace("/plugin/auth/token", "/plugin/login/account")}?state=${encodeURIComponent(deviceAuthId)}`;
+      const response = await this.fetchFn(url, {
+        method: "GET",
+        headers: {
+          ...(await devicePollHeaders(this.#variant)),
+          authorization: `Bearer ${accessToken}`,
+        },
+      });
+      if (!response.ok) return undefined;
+      const profile = buddyResponseData((await response.json()) as unknown);
+      return nonEmptyTrimmedString(profile?.nickname);
+    } catch {
+      return undefined;
+    }
   }
 
   override async refresh(refreshToken: string, signal?: AbortSignal): Promise<OAuthTokenRefreshResult> {

package/src/providers/integrations/buddy/buddy-usage-store.ts

@@ -10,7 +10,7 @@
  * Deliberately not a request-path store: this is written by a maintenance pass
  * and read by the console. Nothing here can fail a dispatch.
  */
-import { and, desc, eq, inArray, sql } from "drizzle-orm";
+import { and, desc, eq, gte, inArray, sql } from "drizzle-orm";
 import type { CartethyiaDatabase } from "../../../persistence/db-handle";
 import { buddyUsageSnapshots } from "../../../persistence/schema";
 import type { BuddyUsageRow } from "./buddy-usage-shared";
@@ -23,6 +23,11 @@ export interface BuddyUsageSnapshotRow extends BuddyUsageRow {
 /** Days of usage retained. The upstream's own window is 30. */
 const RETENTION_DAYS = 30;
 
+/** Oldest day a stored bucket can hold, as the `YYYY-MM-DD` key the table uses. */
+function retentionCutoff(now: Date = new Date()): string {
+  return new Date(now.getTime() - RETENTION_DAYS * 86_400_000).toISOString().slice(0, 10);
+}
+
 /**
  * Upserts one account's usage buckets.
  *
@@ -72,7 +77,31 @@ export async function saveBuddyUsageSnapshots(
 }
 
 /**
- * Reads one account's stored usage, newest day first.
+ * Most (day, model) buckets one day can hold, used only to bound the read.
+ *
+ * The renderer keeps {@link DEFAULT_LIMIT_PER_ACCOUNT} entries per account plus
+ * every bucket of the newest day, so this is a ceiling on a pathological table
+ * rather than a number the page depends on. Set well above any real model count
+ * so the cap can only ever trigger on a table that grew without pruning.
+ */
+const MODELS_PER_DAY_CEILING = 64;
+
+/** Buckets per account the console renders. */
+const DEFAULT_LIMIT_PER_ACCOUNT = 30;
+
+/**
+ * Reads each account's stored usage, newest day first.
+ *
+ * Bounded on both axes, because it used to be bounded on neither: with no day
+ * filter and no `LIMIT`, an account fetched every bucket it had ever stored
+ * (~1500 rows for a 30-day window) to render 30 of them, on the route the
+ * dashboard polls.
+ *
+ * - The day window is semantic, not a truncation: {@link pruneBuddyUsageSnapshots}
+ *   already drops everything older, so no row it excludes could have been
+ *   rendered anyway.
+ * - The row ceiling is the backstop. It is sized per account, so one large
+ *   account cannot starve the others in a shared `LIMIT`.
  *
  * `numeric` comes back from the driver as a string, so the credit is parsed
  * rather than trusted; an unparseable row is reported as 0 instead of being
@@ -81,7 +110,7 @@ export async function saveBuddyUsageSnapshots(
 export async function readBuddyUsageSnapshots(
   db: CartethyiaDatabase,
   accountIds: readonly string[],
-  limitPerAccount = 30,
+  limitPerAccount = DEFAULT_LIMIT_PER_ACCOUNT,
 ): Promise<Map<string, readonly BuddyUsageSnapshotRow[]>> {
   const result = new Map<string, BuddyUsageSnapshotRow[]>();
   if (accountIds.length === 0) return result;
@@ -102,8 +131,14 @@ export async function readBuddyUsageSnapshots(
         syncedAt: buddyUsageSnapshots.syncedAt,
       })
       .from(buddyUsageSnapshots)
-      .where(inArray(buddyUsageSnapshots.accountId, [...accountIds]))
-      .orderBy(desc(buddyUsageSnapshots.dayKey));
+      .where(
+        and(
+          inArray(buddyUsageSnapshots.accountId, [...accountIds]),
+          gte(buddyUsageSnapshots.dayKey, retentionCutoff()),
+        ),
+      )
+      .orderBy(desc(buddyUsageSnapshots.dayKey))
+      .limit(accountIds.length * limitPerAccount * MODELS_PER_DAY_CEILING);
   } catch {
     return result;
   }

package/src/providers/integrations/buddy/codebuddy/cn-provider.ts

@@ -106,6 +106,10 @@ export const CODEBUDDY_CN_RAW: readonly BuddyRawEntry[] = [
   ["glm-5.3-flash", "GLM 5.3 Flash", true, true, 1_000_000, 131_072],
   ["glm-5v-turbo", "GLM 5v Turbo", true, true, 200_000, 131_072],
   ["minimax-m3", "MiniMax M3", true, true, 512_000, 512_000],
+  // 1M context, reasoning always on (upstream states both); vision inherited
+  // from the M3 row, which is the same family.
+  ["minimax-m3.1-flash", "MiniMax M3.1 Flash", true, true, 1_000_000, 512_000],
+  ["mimo-v2.6-pro", "MiMo V2.6 Pro", true, true, 1_000_000, 512_000],
   ["kimi-k2.8-preview", "Kimi K2.8 Preview", true, true, 1_048_576, 65_536],
   ["kimi-k2.7", "Kimi K2.7", true, true, 256_000, 65_536],
   ["kimi-k2.6", "Kimi K2.6", true, true, 256_000, 262_144],