cartethyia 2.4.5 → 2.5.0

package/src/providers/operations/client-versions.ts

@@ -25,11 +25,65 @@ async function qoderVersion(response: Response): Promise<string | null> {
   }
 }
 
+/**
+ * Newest Trae IDE version from the official changelog.
+ *
+ * Trae publishes no npm package and no release API, so the changelog is the
+ * only machine-readable source of the current client version. It matters
+ * upstream: intl `llm_raw_chat` answers `4015` unless the request carries the
+ * *current* client version, so a stale pin is an outage, not a cosmetic drift.
+ *
+ * The page embeds its content as JSON, and its newest entry is the first dated
+ * heading — not the highest semver, because this vendor's hotfix line numbers
+ * past its feature line (3.5.104 shipped after 3.5.97). Taking `max(semver)`
+ * would report an old build as current, so this walks the document in order and
+ * returns the first version following a dated release heading.
+ */
+async function traeVersion(response: Response): Promise<string | null> {
+  try {
+    const text = await response.text();
+    const heading =
+      /"insert":"((?:January|February|March|April|May|June|July|August|September|October|November|December)\s+\d{1,2},\s*\d{4}\s*\([^)]*\))\\n"/g;
+    for (const match of text.matchAll(heading)) {
+      const window = text.slice(match.index ?? 0, (match.index ?? 0) + 900);
+      const found = window.match(/TraeCode\s+v?(\d+\.\d+\.\d+)|v?(\d+\.\d+\.\d+)\s+is\s+released/i);
+      const version = found?.[1] ?? found?.[2];
+      if (version && isSemverish(version)) return version.trim();
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
 async function clineClientVersion(response: Response): Promise<string | null> {
   const data = (await response.json()) as { version?: unknown };
   return isSemverish(data.version) ? data.version.trim() : null;
 }
 
+/**
+ * Newest Cursor build from the official download API, as the IDE's own header
+ * spells it.
+ *
+ * Cursor's `x-cursor-client-version` is not the IDE semver on its own: the wire
+ * value is `cli-<version>-<sha7>` (observed live as `cli-2026.10.19-6bbf2c4`).
+ * The download API is the only source that returns both halves — `version` and
+ * `commitSha` — so they are joined here rather than guessed. A semver alone
+ * would be a different identity than the one the IDE sends.
+ */
+async function cursorVersion(response: Response): Promise<string | null> {
+  try {
+    const data = (await response.json()) as { version?: unknown; commitSha?: unknown };
+    const version = data.version;
+    if (!isSemverish(version)) return null;
+    const sha = typeof data.commitSha === "string" ? data.commitSha.trim() : "";
+    const short = sha.length >= 7 ? sha.slice(0, 7) : "";
+    return short.length > 0 ? `cli-${version.trim()}-${short}` : version.trim();
+  } catch {
+    return null;
+  }
+}
+
 async function clineSdkVersion(response: Response): Promise<string | null> {
   const data = (await response.json()) as {
     version?: unknown;
@@ -177,7 +231,7 @@ export const VERSION_SOURCES = {
   },
   qoder: {
     key: "qoder",
-    fallback: "1.1.73",
+    fallback: "1.1.74",
     sources: [
       {
         url: "https://registry.npmjs.org/@qoder-ai/qodercli/latest",
@@ -222,6 +276,11 @@ export const VERSION_SOURCES = {
     fallback: "0.0.95",
     sources: [{ url: "https://registry.npmjs.org/@cline/sdk/latest", extract: clineSdkVersion }],
   },
+  clineCli: {
+    key: "cline-cli",
+    fallback: "3.0.73",
+    sources: [{ url: "https://registry.npmjs.org/cline/latest", extract: clineSdkVersion }],
+  },
   codex: {
     key: "codex",
     fallback: "0.163.0",
@@ -257,7 +316,7 @@ export const VERSION_SOURCES = {
   },
   workbuddyCli: {
     key: "workbuddy",
-    fallback: "2.168.2",
+    fallback: "2.169.0",
     sources: [
       { url: "https://registry.npmjs.org/@tencent-ai/codebuddy-code/latest" },
       { url: "https://registry.npmmirror.com/@tencent-ai/codebuddy-code/latest" },
@@ -284,7 +343,7 @@ export const VERSION_SOURCES = {
   },
   codebuddy: {
     key: "codebuddy",
-    fallback: "2.168.2",
+    fallback: "2.169.0",
     sources: [
       { url: "https://registry.npmjs.org/@tencent-ai/codebuddy-code/latest" },
       { url: "https://registry.npmmirror.com/@tencent-ai/codebuddy-code/latest" },
@@ -342,6 +401,46 @@ export const VERSION_SOURCES = {
     fallback: "1.4.10-R6427.1",
     sources: [{ url: "https://api.meta.ai/muse-code/channels/muse-stable" }],
   },
+  trae: {
+    key: "trae",
+    // Fallback = the donor's last observed client version. Discovery replaces
+    // it within one monitor tick; it is only what a cold process sends before
+    // the first successful fetch.
+    fallback: "3.6.2",
+    sources: [
+      {
+        url: "https://docs.trae.ai/ide/changelog?_lang=en",
+        extract: traeVersion,
+      },
+    ],
+  },
+  cursor: {
+    key: "cursor",
+    // Fallback = the last observed wire version. Discovery replaces it within
+    // one monitor tick; it is only what a cold process sends before the first
+    // successful fetch.
+    fallback: "cli-2026.10.19-6bbf2c4",
+    sources: [
+      {
+        url: "https://cursor.com/api/download?platform=win32-x64-user&releaseTrack=stable",
+        extract: cursorVersion,
+      },
+    ],
+  },
+  hermes: {
+    key: "hermes",
+    // Hermes DOES publish a semver: the GitHub release tag is `v0.22.2`. The
+    // comment this replaced claimed no semver existed and pinned a date tag
+    // (`v2026.9.24`) as the version — a tag, not a release, and not the
+    // identity the client sends.
+    fallback: "0.22.2",
+    sources: [
+      {
+        url: "https://api.github.com/repos/NousResearch/hermes-agent/releases/latest",
+        extract: githubReleaseVersion,
+      },
+    ],
+  },
   zcode: {
     key: "zcode",
     fallback: "3.14.3",
@@ -357,11 +456,15 @@ export const VERSION_SOURCES = {
 const resolvers = {
   antigravity: createClientVersionResolver({ ...VERSION_SOURCES.antigravity, client: "antigravity" }),
   qoder: createClientVersionResolver({ ...VERSION_SOURCES.qoder, client: "qoder" }),
+  hermes: createClientVersionResolver({ ...VERSION_SOURCES.hermes, client: "hermes" }),
+  trae: createClientVersionResolver({ ...VERSION_SOURCES.trae, client: "trae" }),
+  cursor: createClientVersionResolver({ ...VERSION_SOURCES.cursor, client: "cursor" }),
   opencode: createClientVersionResolver({ ...VERSION_SOURCES.opencode, client: "opencode" }),
   commandcode: createClientVersionResolver({ ...VERSION_SOURCES.commandcode, client: "command-code" }),
   grok: createClientVersionResolver({ ...VERSION_SOURCES.grok, client: "grok" }),
   clineClient: createClientVersionResolver({ ...VERSION_SOURCES.clineClient, client: "cline" }),
   clineSdk: createClientVersionResolver({ ...VERSION_SOURCES.clineSdk, client: "cline-sdk" }),
+  clineCli: createClientVersionResolver({ ...VERSION_SOURCES.clineCli, client: "cline-cli" }),
   codex: createClientVersionResolver({ ...VERSION_SOURCES.codex, client: "codex" }),
   workbuddyClient: createClientVersionResolver({ ...VERSION_SOURCES.workbuddyClient, client: "workbuddy" }),
   workbuddyCnClient: createClientVersionResolver({ ...VERSION_SOURCES.workbuddyCnClient, client: "workbuddy-cn" }),
@@ -384,9 +487,16 @@ const PROVIDER_VERSION_RESOLVERS: Readonly<Record<string, ClientVersionResolver>
   opencode: resolvers.opencode,
   "opencode-zen": resolvers.opencode,
   "opencode-go": resolvers.opencode,
-  cline: resolvers.clineClient,
+  // The identity this provider is dispatched under is the CLI's, so the route
+  // identity reports the CLI version. `clineClient` (the VS Code extension
+  // manifest) is no longer the client this provider claims to be.
+  cline: resolvers.clineCli,
   codex: resolvers.codex,
   qoder: resolvers.qoder,
+  hermes: resolvers.hermes,
+  trae: resolvers.trae,
+  traecn: resolvers.trae,
+  cursor: resolvers.cursor,
   commandcode: resolvers.commandcode,
   workbuddy: resolvers.workbuddyClient,
   workbuddycn: resolvers.workbuddyCnClient,
@@ -484,6 +594,8 @@ function accessor<K extends keyof typeof resolvers>(name: K): {
 }
 
 export const getQoderVersion = accessor("qoder").get;
+export const getHermesVersion = accessor("hermes").get;
+export const getTraeVersion = accessor("trae").get;
 export const getAntigravityVersion = accessor("antigravity").get;
 
 export const getOpenCodeVersion = accessor("opencode").get;
@@ -503,8 +615,10 @@ export function buildGrokAuthUserAgent(version = getGrokVersion()): string {
 
 export const getClineClientVersion = accessor("clineClient").get;
 export const getClineSdkVersion = accessor("clineSdk").get;
+export const getClineCliVersion = accessor("clineCli").get;
 export const _resetClineClientVersionCache = accessor("clineClient").reset;
 export const _resetClineSdkVersionCache = accessor("clineSdk").reset;
+export const _resetClineCliVersionCache = accessor("clineCli").reset;
 
 export const getCodexVersion = accessor("codex").get;
 
@@ -513,9 +627,16 @@ export const getWorkBuddyCnClientVersion = accessor("workbuddyCnClient").get;
 export const getWorkBuddyCliVersion = accessor("workbuddyCli").get;
 
 export function buildWorkBuddyUserAgent(
+  identity = "WB",
   clientVersion = getWorkBuddyClientVersion(),
   cliVersion = getWorkBuddyCliVersion(),
 ): string {
+  // 1:1 with codebuddy2api. The CLI profile is `CLI/<v> CodeBuddy/<v>` and the
+  // WorkBuddy profile is `WorkBuddy/<wb> WorkBuddy AI/<wb> CLI/<cli>`, which
+  // sends NO SDK headers — two separate profiles, not one string with a switch.
+  // Whether SDK headers ride along is decided by `workbuddyHeaders`, not here, so
+  // this builder only decides the UA text.
+  if (identity === "CLI") return `CLI/${cliVersion} CodeBuddy/${cliVersion}`;
   return `WorkBuddy/${clientVersion} WorkBuddy AI/${clientVersion} CLI/${cliVersion}`;
 }
 
@@ -525,11 +646,27 @@ export const getKimiCliVersion = accessor("kimiCli").get;
 
 export const getCodeBuddyVersion = accessor("codebuddy").get;
 export const getCodeBuddyCnVersion = accessor("codebuddyCn").get;
+/**
+ * The CodeBuddy User-Agent.
+ *
+ * Both identities share the CLI *package* version, which is why `codebuddy`
+ * (the npm `@tencent-ai/codebuddy-code` pin, `2.169.0` — the value both
+ * references use for CLI) is the version for each. `codebuddyCn` is the CN
+ * *desktop* build (`4.12.2.…`), and using it here produced
+ * `CLI/4.12.2.41207131 CodeBuddy/4.12.2.41207131` — a CLI claiming a desktop
+ * version, which no official client emits.
+ */
 export function buildCodeBuddyUserAgent(
   identity: "IDE" | "CLI",
-  version = identity === "CLI" ? getCodeBuddyCnVersion() : getCodeBuddyVersion(),
+  version = getCodeBuddyVersion(),
+  cnVersion = getCodeBuddyCnVersion(),
 ): string {
-  return `${identity}/${version} CodeBuddy/${version}`;
+  // 1:1 with codebuddy2api's identity_headers(): the CLI profile uses ONE version
+  // (the npm CLI package pin) for both halves, and the IDE profile uses the other
+  // product's version. This previously always used `version`, so "CLI" produced
+  // `CLI/<ide> CodeBuddy/<ide>` — a CLI claiming the desktop build.
+  const resolved = identity === "CLI" ? cnVersion : version;
+  return `${identity}/${resolved} CodeBuddy/${resolved}`;
 }
 
 export const _resetCodeBuddyVersionCache = accessor("codebuddy").reset;

package/src/providers/operations/model-catalog-cache.ts

@@ -14,10 +14,14 @@ import { cachedRead } from "../../console/shared/read-through-cache";
 
 /**
  * Provider entries retained before the least-recently-used catalog is evicted.
- * One entry per provider is tiny, but an unbounded cache would pin every
- * catalog for the process lifetime.
+ *
+ * Must clear the bundled provider count — there are **73** of them — because a
+ * cap below it thrashes: a catalog rebuild evicts a provider it is about to
+ * need again, so `bundledModelCatalog()` re-imports a module it already had.
+ * Sized above that count with room for BYOK rows. One entry is a model list, so
+ * the bound still matters; it just has to be the right one.
  */
-export const MODEL_CATALOG_CACHE_MAX_ENTRIES = 64;
+export const MODEL_CATALOG_CACHE_MAX_ENTRIES = 128;
 
 /**
  * Cross-instance tier lifetime. Static provider catalogs change only on a
@@ -82,3 +86,14 @@ export function getCachedModels(
 export function resetModelCatalogCacheForTesting(): void {
   catalogCache.clear();
 }
+
+/**
+ * Live entry count, for the `/metrics` gauge.
+ *
+ * Exported so a rebuild that saturates the cap is visible from outside the
+ * process: before this, every in-process cache except the quota tier was
+ * invisible, and growth could only be found with a heap dump.
+ */
+export function modelCatalogCacheSize(): number {
+  return catalogCache.size;
+}

package/src/providers/operations/provider-catalog-seeder.ts

@@ -1,86 +1,95 @@
-/** Durable materialization of bundled provider model metadata. */
-import { and, eq, sql } from "drizzle-orm";
-import type { CartethyiaDatabase } from "../../persistence/db-handle";
-import { models } from "../../persistence/schema";
-import type { ModelDefinition } from "../provider-model-definition";
-
-/** Persists compiled provider model metadata and reconciles drifted capability flags. */
-export async function seedBundledModels(
-  db: CartethyiaDatabase,
-  builtinModels: ReadonlyMap<string, readonly ModelDefinition[]>,
-): Promise<void> {
-  for (const [providerId, definitions] of builtinModels) {
-    if (definitions.length === 0) continue;
-    // Drop builtin rows the current catalog no longer declares, including rows
-    // whose model id is still present but whose endpoint path drifted (e.g. a
-    // provider that moved from `/chat/completions` to `/v2/chat/completions`).
-    // The unique key is (provider, model, endpoint), so a changed endpoint
-    // would otherwise insert a second row and leave the stale route behind —
-    // the model list would then show duplicates and probes could hit the dead
-    // path. Composite `NOT IN` keeps exactly the (model, endpoint) pairs the
-    // catalog owns.
-    const pairs = definitions.map(
-      (definition) => sql`(${definition.modelId}, ${definition.endpointPath})`,
-    );
-    await db
-      .delete(models)
-      .where(
-        and(
-          eq(models.providerId, providerId),
-          eq(models.source, "builtin"),
-          sql`(${models.modelId}, ${models.endpointPath}) NOT IN (${sql.join(pairs, sql`, `)})`,
-        ),
-      );
-  }
-  const now = new Date();
-  const seen = new Set<string>();
-  const rows = [...builtinModels.entries()].flatMap(([providerId, definitions]) =>
-    definitions.flatMap((definition) => {
-      const key = `${providerId}\u0000${definition.modelId}\u0000${definition.endpointPath}`;
-      if (seen.has(key)) return [];
-      seen.add(key);
-      return [
-        {
-          providerId,
-          modelId: definition.modelId,
-          wireFamily: definition.wireFamily,
-          serviceKind: definition.serviceKind ?? "llm",
-          endpointPath: definition.endpointPath,
-          contextLimit: definition.contextLimit,
-          outputLimit: definition.outputLimit,
-          modalities: definition.modalities,
-          reasoning: definition.reasoning,
-          toolCall: definition.toolCall,
-          cost: definition.cost,
-          source: "builtin",
-          sourceUpdatedAt: now,
-          enabled: true,
-        },
-      ];
-    }),
-  );
-  if (rows.length === 0) return;
-  // Reconcile static metadata on conflict rather than skipping: capability
-  // flags (toolCall/reasoning/webSearch), wire family, limits, and cost can
-  // drift on a pre-existing row (e.g. a discovery seeded `tool_call=false`
-  // before the static catalog was corrected). `source` is forced back to
-  // `builtin`: a fetch upsert may have flipped a builtin row to `discovered`,
-  // and the static catalog owns these ids. `enabled` is operator-owned and
-  // must never be reset here.
-  await db.insert(models).values(rows).onConflictDoUpdate({
-    target: [models.providerId, models.modelId, models.endpointPath],
-    set: {
-      wireFamily: sql`excluded.wire_family`,
-      serviceKind: sql`excluded.service_kind`,
-      endpointPath: sql`excluded.endpoint_path`,
-      contextLimit: sql`excluded.context_limit`,
-      outputLimit: sql`excluded.output_limit`,
-      modalities: sql`excluded.modalities`,
-      reasoning: sql`excluded.reasoning`,
-      toolCall: sql`excluded.tool_call`,
-      cost: sql`excluded.cost`,
-      source: sql`'builtin'`,
-      sourceUpdatedAt: sql`excluded.source_updated_at`,
-    },
-  });
-}
+/** Durable materialization of bundled provider model metadata. */
+import { and, eq, sql } from "drizzle-orm";
+import type { CartethyiaDatabase } from "../../persistence/db-handle";
+import { models } from "../../persistence/schema";
+import type { ModelDefinition } from "../provider-model-definition";
+
+/** Persists compiled provider model metadata and reconciles drifted capability flags. */
+export async function seedBundledModels(
+  db: CartethyiaDatabase,
+  builtinModels: ReadonlyMap<string, readonly ModelDefinition[]>,
+): Promise<void> {
+  for (const [providerId, definitions] of builtinModels) {
+    if (definitions.length === 0) continue;
+    // Drop builtin rows the current catalog no longer declares, including rows
+    // whose model id is still present but whose endpoint path drifted (e.g. a
+    // provider that moved from `/chat/completions` to `/v2/chat/completions`).
+    // The unique key is (provider, model, endpoint), so a changed endpoint
+    // would otherwise insert a second row and leave the stale route behind —
+    // the model list would then show duplicates and probes could hit the dead
+    // path. Composite `NOT IN` keeps exactly the (model, endpoint) pairs the
+    // catalog owns.
+    const pairs = definitions.map(
+      (definition) => sql`(${definition.modelId}, ${definition.endpointPath})`,
+    );
+    await db
+      .delete(models)
+      .where(
+        and(
+          eq(models.providerId, providerId),
+          eq(models.source, "builtin"),
+          sql`(${models.modelId}, ${models.endpointPath}) NOT IN (${sql.join(pairs, sql`, `)})`,
+        ),
+      );
+  }
+  const now = new Date();
+  const seen = new Set<string>();
+  const rows = [...builtinModels.entries()].flatMap(([providerId, definitions]) =>
+    definitions.flatMap((definition) => {
+      const key = `${providerId}\u0000${definition.modelId}\u0000${definition.endpointPath}`;
+      if (seen.has(key)) return [];
+      seen.add(key);
+      return [
+        {
+          providerId,
+          modelId: definition.modelId,
+          wireFamily: definition.wireFamily,
+          serviceKind: definition.serviceKind ?? "llm",
+          endpointPath: definition.endpointPath,
+          contextLimit: definition.contextLimit,
+          outputLimit: definition.outputLimit,
+          modalities: definition.modalities,
+          reasoning: definition.reasoning,
+          toolCall: definition.toolCall,
+          cost: definition.cost,
+          // A static row either knows it is refused on a free plan or says
+          // nothing. Never coerced to false: the column is three-valued, and
+          // "nobody established it" is not the same claim as "served on free".
+          proOnly: definition.proOnly ?? null,
+          // Same three-valued rule for the inverse: the provider's directory
+          // states the tier, so the flag is carried rather than derived.
+          freeTier: definition.freeTier ?? null,
+          source: "builtin",
+          sourceUpdatedAt: now,
+          enabled: true,
+        },
+      ];
+    }),
+  );
+  if (rows.length === 0) return;
+  // Reconcile static metadata on conflict rather than skipping: capability
+  // flags (toolCall/reasoning/webSearch), wire family, limits, and cost can
+  // drift on a pre-existing row (e.g. a discovery seeded `tool_call=false`
+  // before the static catalog was corrected). `source` is forced back to
+  // `builtin`: a fetch upsert may have flipped a builtin row to `discovered`,
+  // and the static catalog owns these ids. `enabled` is operator-owned and
+  // must never be reset here.
+  await db.insert(models).values(rows).onConflictDoUpdate({
+    target: [models.providerId, models.modelId, models.endpointPath],
+    set: {
+      wireFamily: sql`excluded.wire_family`,
+      serviceKind: sql`excluded.service_kind`,
+      endpointPath: sql`excluded.endpoint_path`,
+      contextLimit: sql`excluded.context_limit`,
+      outputLimit: sql`excluded.output_limit`,
+      modalities: sql`excluded.modalities`,
+      reasoning: sql`excluded.reasoning`,
+      toolCall: sql`excluded.tool_call`,
+      cost: sql`excluded.cost`,
+      proOnly: sql`excluded.pro_only`,
+      freeTier: sql`excluded.free_tier`,
+      source: sql`'builtin'`,
+      sourceUpdatedAt: sql`excluded.source_updated_at`,
+    },
+  });
+}

package/src/providers/operations/provider-catalog-service.ts

@@ -20,6 +20,57 @@ import { GATEWAY_USER_AGENT } from "./gateway-user-agent";
 import { isIP } from "node:net";
 import { isAddressAllowed } from "../../network/ssrf";
 import type { SsrfPolicy } from "../../config/network";
+
+/**
+ * Revision of the compiled provider catalog, and the last one materialized.
+ *
+ * The snapshot builder re-seeds on **every** rebuild, and a re-seed is a
+ * `DELETE` per provider plus a full `INSERT … ON CONFLICT DO UPDATE` of the
+ * compiled catalog. That is correct work when the catalog changed and pure
+ * waste when it did not — and the invalidation that triggers it is a timer
+ * (`account-health-sweep`), so the waste lands on a proxy request.
+ *
+ * Only the paths that can actually change the compiled catalog bump this: a
+ * provider registered, edited, or retired. A cooldown recovery changes account
+ * health, not the catalog, so it must not.
+ */
+let catalogRevision = 0;
+let lastSeededCatalogRevision = -1;
+
+/** Current catalog revision. */
+export function currentCatalogRevision(): number {
+  return catalogRevision;
+}
+
+/** Bumps the revision after a change to the compiled catalog. */
+export function bumpCatalogRevision(): number {
+  catalogRevision += 1;
+  return catalogRevision;
+}
+
+/**
+ * Forces the next re-seed to run even when the revision is unchanged.
+ *
+ * For the boot path and for tests: the compiled catalog has to be materialized
+ * once for the current process regardless of what an earlier call already
+ * applied, because a fresh database or a fresh registry is not a revision
+ * change.
+ */
+export function invalidateCatalogSeed(): void {
+  lastSeededCatalogRevision = -1;
+}
+
+/**
+ * Records that the caller has just materialized the current catalog itself, so
+ * the next `refreshActiveProviderCatalogs` is a no-op.
+ *
+ * The boot path seeds directly rather than through the gate — it must always
+ * run, against a database and a registry that are both fresh — and without this
+ * the first snapshot build would pay for a second identical seed.
+ */
+export function markCatalogSeeded(): void {
+  lastSeededCatalogRevision = catalogRevision;
+}
 /**
  * Idempotently materializes every shipped provider in the database catalog.
  * The canonical provider definition supplies identity and routing defaults;
@@ -60,6 +111,9 @@ export async function seedBundledProviders(db: CartethyiaDatabase): Promise<void
         ),
       },
     });
+  // The compiled catalog is derived from the registry, and this is the path
+  // that reconciles the bundle's own rows into it.
+  bumpCatalogRevision();
 }
 
 /**
@@ -94,6 +148,9 @@ export async function retireUnbundledProviders(db: CartethyiaDatabase): Promise<
     .delete(providers)
     .where(and(isNull(providers.tenantId), notInArray(providers.id, bundledIds)))
     .returning({ id: providers.id });
+  // Deleting a provider removes it from the compiled catalog, so the next
+  // re-seed must run even though no revision bumped on this path otherwise.
+  if (retired.length > 0) bumpCatalogRevision();
   return retired.length;
 }
 
@@ -172,13 +229,22 @@ export async function bundledModelCatalog(
  * boot. Seeding is no longer account-gated, so this is now simply the same walk
  * as at boot; it exists because an account makes the rows routable and the
  * snapshot must reflect that without waiting for a restart.
+ *
+ * Gated on {@link currentCatalogRevision}: this is the seeder the snapshot
+ * builder calls on every rebuild, and the invalidation that triggers it is a
+ * 30 s timer, so an ungated re-seed could be pushed onto the next proxy
+ * request for a catalog that had not changed. The paths that do change the
+ * catalog bump the revision; everything else is a no-op here.
  */
 export async function refreshActiveProviderCatalogs(
   db: CartethyiaDatabase,
   registry: ProviderRegistry,
 ): Promise<void> {
+  const revision = currentCatalogRevision();
+  if (revision === lastSeededCatalogRevision) return;
   const catalog = await bundledModelCatalog(registry);
   await seedBundledModels(db, catalog.modelsByProvider);
+  lastSeededCatalogRevision = revision;
 }
 
 
@@ -217,6 +283,7 @@ export async function registerByokProviders(
     .from(providers)
     .where(and(isNotNull(providers.baseUrl), eq(providers.enabled, true)));
   const hosts = new Map<string, ByokUpstreamHost>();
+  let registered = false;
   for (const row of rows) {
     if (!row.baseUrl) continue;
     const baseUrl = row.baseUrl;
@@ -307,7 +374,13 @@ export async function registerByokProviders(
         }),
     });
     byokRegistrationFingerprints.set(providerId, fingerprint);
+    registered = true;
   }
+  // A changed BYOK registration changes what the compiled catalog contains, so
+  // the next re-seed must run. An unchanged one deliberately does not: this
+  // function is called on every console provider mutation, most of which do not
+  // alter the registration at all.
+  if (registered) bumpCatalogRevision();
   return hosts;
 }
 
@@ -341,6 +414,9 @@ export async function syncByokProvider(
   if (host === undefined && fingerprintBefore !== undefined) {
     registry.unregister(normalized);
     byokRegistrationFingerprints.delete(normalized);
+    // The provider left the registry, so the compiled catalog no longer
+    // contains it: the next re-seed must run to prune its rows.
+    bumpCatalogRevision();
   }
   return host;
 }