cartethyia 2.5.1 → 2.5.3

package/src/providers/integrations/openrouter/provider.ts

@@ -24,21 +24,11 @@ const OPENROUTER_REQUIRED_HEADERS: Readonly<Record<string, string>> = {
  * served by the native System One route, never by the chat surface.
  */
 export const OPENROUTER_MODELS: readonly ModelDefinition[] = [
-  // The router, and only the router. A hand-kept catalog of specific ids was a
-  // snapshot of one afternoon: OpenRouter adds and pulls models within days, so
-  // every committed row outside this one drifts out of truth. Discovery is the
-  // authority, and the free roster below is the offline floor.
-  defineModel({
-    id: "openrouter/auto",
-    providerId: OPENROUTER_PROVIDER_ID,
-    wireFamily: "chat",
-    endpoint: "/chat/completions",
-    // The catalog publishes no limits for a router (pricing is -1, meaning
-    // "decided at dispatch"), so this is the largest window it may select into.
-    ctx: 2_000_000,
-    out: 128_000,
-    reasoning: true,
-  }),
+  // No committed chat rows. OpenRouter adds and pulls models within days, so a
+  // hand-kept list of ids drifts out of truth and discovery is the authority;
+  // the free roster below stays as the offline floor. `openrouter/auto` was the
+  // last committed chat row and went with the rest of the static catalog — it
+  // publishes no limits of its own anyway, since a router's pricing is -1.
   // Not a chat row: it answers `{answers}` to a `{state, questions}` body, and
   // is served by the native System One route. Kept because deleting it removes
   // that route, which is a capability, not a stale catalog entry.

package/src/providers/integrations/tokenharbor.ts

@@ -35,7 +35,7 @@ export const TOKENHARBOR_FALLBACK_MODELS: readonly ModelDefinition[] = [
   defineModel({ id: "muse-spark-1.2", providerId: "tokenharbor", ctx: 1_048_576, reasoning: true, vision: true }),
   defineModel({ id: "muse-spark-1-3", providerId: "tokenharbor", ctx: 1_048_576, reasoning: true, vision: true }),
   defineModel({ id: "gpt-6-astra", providerId: "tokenharbor", ctx: 1_050_000, reasoning: true, vision: true }),
-  defineModel({ id: "deepseek-v4.1-flash", providerId: "tokenharbor", ctx: 1_048_576, reasoning: true }),
+  defineModel({ id: "deepseek-v4.1-flash", providerId: "tokenharbor", ctx: 1_048_576, reasoning: true, vision: true }),
   defineModel({ id: "gemini-3.6-flash", providerId: "tokenharbor", ctx: 1_000_000, reasoning: true, vision: true }),
   defineModel({ id: "glm-5.2", providerId: "tokenharbor", ctx: 1_000_000, reasoning: true }),
   defineModel({ id: "gpt-5.6-luna", providerId: "tokenharbor", reasoning: true, vision: true }),
@@ -62,7 +62,7 @@ export const TOKENHARBOR_FALLBACK_MODELS: readonly ModelDefinition[] = [
   defineModel({ id: "mimo-v2.6-pro", providerId: "tokenharbor", ctx: 1_048_576, reasoning: true, vision: true }),
   defineModel({ id: "mimo-v2.5:free", providerId: "tokenharbor", ctx: 1_048_576, reasoning: true, vision: true, free: true }),
   defineModel({ id: "deepseek-v4-flash:free", providerId: "tokenharbor", reasoning: true, free: true }),
-  defineModel({ id: "deepseek-v4.1-flash:free", providerId: "tokenharbor", ctx: 1_048_576, reasoning: true, free: true }),
+  defineModel({ id: "deepseek-v4.1-flash:free", providerId: "tokenharbor", ctx: 1_048_576, reasoning: true, vision: true, free: true }),
   defineModel({ id: "qwen3.8-flash:free", providerId: "tokenharbor", reasoning: true, free: true }),
   defineModel({ id: "mimo-v2.6-flash:free", providerId: "tokenharbor", ctx: 1_048_576, reasoning: true, vision: true, free: true }),
 ];

package/src/providers/integrations/trae/trae-catalog.ts

@@ -79,7 +79,9 @@ const TRAE_CN_ROWS: readonly TraeModelRow[] = [
  * (DeepSeek-V4 rows: 200k active, 1M selectable), so reading `dev` makes a
  * client under-request the window it is entitled to. The maximum is per model
  * and is **not** uniform: the GPT rows cap at 272k and Kimi-K2.5 / MiniMax-M2.7
- * offer no selectable upgrade at all, staying at 200k.
+ * offer no selectable upgrade at all, staying at 200k. `gpt-5.4` is the
+ * exception: upstream raised its selectable maximum to 1M, so it is filed at
+ * 1M while the rest of the GPT rows stay at 272k.
  *
  * `out` is what the same model is filed at in the CodeBuddy roster where that
  * roster carries it (DeepSeek-V4 384k, MiniMax-M3 512k, Kimi-K2.5 262k,
@@ -98,13 +100,13 @@ const TRAE_CN_ROWS: readonly TraeModelRow[] = [
  * one.
  */
 const TRAE_INTL_ROWS: readonly TraeModelRow[] = [
-  { id: "gpt-5.4", displayName: "GPT-5.4", ctx: 272000, out: 128_000, vision: true, reasoning: true, surface: "agent" },
+  { id: "gpt-5.4", displayName: "GPT-5.4", ctx: 1_000_000, out: 128_000, vision: true, reasoning: true, surface: "agent" },
   { id: "gpt-5.2", displayName: "GPT-5.2", ctx: 272000, out: 128_000, vision: true, reasoning: true, surface: "agent" },
   { id: "gpt-5.2-codex-paygo", displayName: "GPT-5.2-Codex", ctx: 272000, out: 128_000, vision: true, reasoning: true, surface: "agent" },
   { id: "gpt-5.1-paygo", displayName: "GPT-5.1", ctx: 272000, out: 128_000, vision: true, reasoning: true, surface: "agent" },
   { id: "gpt-5-paygo", displayName: "GPT-5", ctx: 272000, out: 128_000, vision: true, reasoning: true, surface: "agent" },
   { id: "Dola-Seed-2.0-Code", displayName: "Seed-2.1-Turbo", ctx: 1000000, out: 131_072, vision: true, reasoning: true, surface: "agent" },
-  { id: "deepseek-v4.1-flash", displayName: "DeepSeek-V4.1-Flash", ctx: 1000000, out: 384_000, vision: false, reasoning: true, surface: "agent" },
+  { id: "deepseek-v4.1-flash", displayName: "DeepSeek-V4.1-Flash", ctx: 1000000, out: 384_000, vision: true, reasoning: true, surface: "agent" },
   { id: "deepseek-v4-flash-0731", displayName: "DeepSeek-V4-Flash", ctx: 1000000, out: 384_000, vision: false, reasoning: true, surface: "agent" },
   { id: "deepseek-v4-pro-0813", displayName: "DeepSeek-V4-Pro", ctx: 1000000, out: 384_000, vision: false, reasoning: true, surface: "agent" },
   { id: "kimi-k3", displayName: "Kimi-K3", ctx: 1000000, out: 131_072, vision: true, reasoning: true, surface: "agent" },

package/src/providers/operations/account-health-service.ts

@@ -637,11 +637,33 @@ export function classifyAccountError(
       lower.includes("no access to model") ||
       lower.includes("model_not_supported") ||
       lower.includes("not available in your region"));
+  /**
+   * The upstream accepted the request and put it in a queue behind other
+   * callers — it is busy, not rejecting the caller's credential.
+   *
+   * Qoder answers `403 {"code":"10605","message":"{\"isQueued\":true,
+   * \"modelKey\":\"dfmodel\",\"queueCount\":1395,...}"}`. The 403 is what made
+   * this misclassify: the generic `(401 || 403) && accountEvidence` arm claimed
+   * it as `auth_invalidated`, so a healthy account was parked as "Re-login
+   * required" purely because the provider was busy, and an operator was sent
+   * to re-authenticate a credential that was never rejected.
+   *
+   * Matched on the queue evidence rather than on the bare `10605`, so an
+   * unrelated 403 that happens to share the code is not swept in. The bodies
+   * are nested JSON, so the tell is the key, not a parse of the envelope.
+   */
+  const queuedUpstream =
+    providerCode === "10605" ||
+    lower.includes("isqueued") ||
+    lower.includes("queuecount") ||
+    lower.includes("queuetype") ||
+    (lower.includes("queue") && lower.includes("modelkey"));
   const authSignal =
     !quotaSignal &&
     !policyRejection &&
     !hostedToolFailure &&
     !modelEntitlementFailure &&
+    !queuedUpstream &&
     (providerCode === "authentication_failed" ||
       folded.includes("invalid api key") ||
       folded.includes("incorrect api key") ||
@@ -805,6 +827,7 @@ export function classifyAccountError(
     statusCode === 503 ||
     statusCode === 529 ||
     providerCode === "model_capacity" ||
+    queuedUpstream ||
     lower.includes("model overloaded") ||
     lower.includes("capacity exceeded") ||
     lower.includes("temporarily unavailable");

package/src/providers/operations/client-versions.ts

@@ -632,12 +632,19 @@ export function buildWorkBuddyUserAgent(
   cliVersion = getWorkBuddyCliVersion(),
 ): string {
   // 1:1 with codebuddy2api. The CLI profile is `CLI/<v> CodeBuddy/<v>` and the
-  // WorkBuddy profile is `WorkBuddy/<wb> WorkBuddy AI/<wb> CLI/<cli>`, which
+  // WorkBuddy profile is `WorkBuddy/<wb> workbuddy-ai/<wb> CLI/<cli>`, which
   // sends NO SDK headers — two separate profiles, not one string with a switch.
   // Whether SDK headers ride along is decided by `workbuddyHeaders`, not here, so
   // this builder only decides the UA text.
+  //
+  // The second token is the wire spelling `workbuddy-ai`, NOT the display
+  // brand `WorkBuddy AI`. This is what an official client actually sends; the
+  // product is branded with a space in the UI and in docs, and copying that
+  // branding into the header produced a UA no real client emits — which the
+  // intl gateway answers with 403 `11140`, the same refusal it gives a
+  // wrong-brand header. Product name ≠ wire token.
   if (identity === "CLI") return `CLI/${cliVersion} CodeBuddy/${cliVersion}`;
-  return `WorkBuddy/${clientVersion} WorkBuddy AI/${clientVersion} CLI/${cliVersion}`;
+  return `WorkBuddy/${clientVersion} workbuddy-ai/${clientVersion} CLI/${cliVersion}`;
 }
 
 export const _resetWorkBuddyCnClientVersionCache = accessor("workbuddyCnClient").reset;

package/src/providers/provider-metadata.ts

@@ -86,6 +86,9 @@ const RAW_BUNDLED_PROVIDER_METADATA = [
     serviceKinds: ["llm", "websearch", "imageGeneration"],
     credentialUrl: "https://antigravity.google",
     credentialHint: "Signed in with a Google account through the Antigravity login flow.",
+    // Per-account credential, so rotating the egress address buys nothing —
+    // the same reason Hermes, InferHub and Cline skip.
+    defaultSkipProxy: true,
   },
   { id: "muse", displayName: "Muse Code", baseUrl: "https://api.meta.ai" },
   {
@@ -109,6 +112,7 @@ const RAW_BUNDLED_PROVIDER_METADATA = [
     baseUrl: "https://q.us-east-1.amazonaws.com",
     bespokeWire: true,
     hasAdapterUserAgent: true,
+    defaultSkipProxy: true,
     credentialUrl: "https://kiro.dev",
     credentialHint: "Sign in with Google or GitHub in the browser, or use the device-code login with an Identity Center organization, then paste a Kiro API key if you prefer. Prompt caching is not reliably working for Kiro: the upstream recomputes the prompt on every turn, so cached-token savings should not be expected.",
   },
@@ -331,6 +335,7 @@ const RAW_BUNDLED_PROVIDER_METADATA = [
     displayName: "Kilo Code",
     baseUrl: "https://api.kilo.ai/api/openrouter",
     credentialUrl: "https://app.kilo.ai/device-auth",
+    defaultSkipProxy: true,
   },
   {
     // Command Code's adapter stamps its own client identity headers
@@ -366,7 +371,7 @@ const RAW_BUNDLED_PROVIDER_METADATA = [
     credentialUrl: `${QODER_REALMS.cn.website}/account/integrations`,
     credentialHint: "Paste a Personal Access Token (pt-...) from the Qoder CN integrations page, or sign in with your Qoder China account.",
   },
-  { id: "trae", displayName: "Trae", baseUrl: `${TRAE_REALMS.intl.core}${TRAE_CHAT_PATH}`, hasAdapterUserAgent: true, credentialUrl: "https://www.trae.ai/", credentialHint: "Paste a Trae account export (accessToken + refreshToken) or the raw access token from an international Trae account." },
+  { id: "trae", displayName: "Trae", baseUrl: `${TRAE_REALMS.intl.core}${TRAE_CHAT_PATH}`, hasAdapterUserAgent: true, defaultSkipProxy: true, credentialUrl: "https://www.trae.ai/", credentialHint: "Paste a Trae account export (accessToken + refreshToken) or the raw access token from an international Trae account." },
   // A separate provider, not a region flag on `trae`: the China deployment has
   // its own core host, authorization scheme, and model roster, and a CN account
   // dispatched to the intl host is refused rather than degraded.
@@ -392,6 +397,7 @@ const RAW_BUNDLED_PROVIDER_METADATA = [
     baseUrl: "https://api.individual.githubcopilot.com",
     hasAdapterUserAgent: true,
     credentialUrl: "https://github.com/settings/copilot",
+    defaultSkipProxy: true,
   },
   { id: "perplexity", displayName: "Perplexity", baseUrl: "https://api.perplexity.ai", credentialUrl: "https://www.perplexity.ai/settings/api" },
   // Native web-search providers expose only the search service. Their catalog

package/src/security/api-key-auth.ts

@@ -305,6 +305,29 @@ export interface ResolvedApiKey {
   /** Share-template id whose remote CLI mappings are inherited by this child. */
   readonly cliMappingOwnerId?: string;
 }
+
+/**
+ * The 401 a caller gets when a key resolves to nothing.
+ *
+ * One function, not a message repeated at each boundary: three surfaces refuse
+ * an unknown key, and any wording drift between them is a caller guessing which
+ * surface it hit. Unknown, revoked and expired stay deliberately
+ * indistinguishable — distinguishing them would let a caller confirm that a
+ * guessed token once existed — so there is no variant carrying a reason.
+ *
+ * The rotate instruction is unconditional for the same reason. The key that
+ * fails is usually the one seeded at first boot, which cannot be deleted and
+ * only rotates, and an operator hitting this on a personal key loses nothing by
+ * being told the same thing.
+ */
+export function unknownApiKeyError(): GatewayError {
+  return new GatewayError(
+    "authentication_failed",
+    401,
+    "Invalid API key. Rotate the default Cartethyia API key in API Keys and send the new key as: Authorization: Bearer <key>.",
+  );
+}
+
 /** Extracts exactly one supported credential source, preserving public auth statuses. */
 export function requestToken(headers: Headers | Record<string, string>): string {
   const get = (name: string): string | null =>

package/src/transport/dispatch/attempt-finalize.ts

@@ -39,6 +39,27 @@ export async function shouldCaptureProviderBody(
   return payloadCaptureKeepsBodies(db, tenantId);
 }
 
+/**
+ * Per-stage cap for the provider request/response tee at one capture depth.
+ *
+ * The tee is what the drawer's "Provider Request" and "Provider Response"
+ * panels read, so its cap is the most a provider panel can ever show. It used
+ * to be a flat 256 KiB at every depth: on a large request the translated
+ * provider body was clipped to 256 KiB before the shared record budget ever
+ * ran, so a tenant who raised the depth to Maximum — 16 MiB — still saw a
+ * quarter-megabyte provider request and an empty provider response. Derived
+ * from the same depth tiers as the record budget, so raising the depth now
+ * raises both.
+ *
+ * Capped at a quarter of the depth's total budget: four panels share it, and
+ * one of them must never be able to spend the whole thing.
+ */
+export function providerCaptureMaxBytes(depth?: TelemetryPayloadDepth): number {
+  if (depth === "moderate") return 2 * 1024 * 1024;
+  if (depth === "maximum") return 4 * 1024 * 1024;
+  return 256 * 1024;
+}
+
 /**
  * Same answer as {@link shouldCaptureProviderBody}, memoized on the request.
  *
@@ -62,6 +83,28 @@ export async function shouldCaptureProviderBodyForRequest(
   return resolved.ok === true && resolved.mode === "full";
 }
 
+/**
+ * The tenant's capture depth, memoized on the request like the mode above.
+ *
+ * Read *after* {@link shouldCaptureProviderBodyForRequest} has populated the
+ * memo, so the two answers come from one preference read. It sizes the
+ * provider tee: a tenant who raised the depth is asking for more of every
+ * panel, and a flat cap would answer with the same clipped body regardless.
+ */
+export async function resolveCaptureDepthForRequest(
+  db: CartethyiaDatabase,
+  tenantId: string | null,
+  state: { payloadCapturePreference?: unknown },
+): Promise<TelemetryPayloadDepth> {
+  if (state.payloadCapturePreference === undefined) {
+    state.payloadCapturePreference = await resolvePayloadCapture(db, tenantId);
+  }
+  const resolved = state.payloadCapturePreference as
+    | { readonly ok: true; readonly depth: TelemetryPayloadDepth }
+    | { readonly ok: false };
+  return resolved.ok === true ? resolved.depth : "minimum";
+}
+
 /**
  * Combined body cap for one capture depth. Fixed size tiers: every depth
  * stores all four drawer panels (client request, translated provider
@@ -103,7 +146,6 @@ export function parseCapturedBody(value: unknown): unknown {
   }
 }
 
-const PROVIDER_CAPTURE_MAX_BYTES = 256 * 1024;
 const PROVIDER_CAPTURE_AWAIT_MS = 2_000;
 const CAPTURABLE_RESPONSE_TYPES = /^(text\/|application\/(json|x-ndjson|sse))/i;
 
@@ -258,6 +300,7 @@ export function captureProviderExchange(
   inner: ValidatedOutboundFetch,
   sink: ProviderExchangeCapture,
   captureBody = true,
+  maxBytes = providerCaptureMaxBytes(),
 ): ValidatedOutboundFetch {
   return async (input, init) => {
     const url =
@@ -276,14 +319,12 @@ export function captureProviderExchange(
       // unbounded translated request body per attempt — up to `maxAttempts` of
       // them, all alive until the loop returns — costs more than it can tell
       // an operator.
-      ...(rawBody === null
-        ? {}
-        : { body: parseCapturedBody(rawBody.slice(0, PROVIDER_CAPTURE_MAX_BYTES)) }),
+      ...(rawBody === null ? {} : { body: parseCapturedBody(rawBody.slice(0, maxBytes)) }),
     };
     const response = await inner(input, init);
     sink.response =
       captureBody && shouldCaptureProviderResponse(response)
-        ? readBoundedBody(response.clone(), PROVIDER_CAPTURE_MAX_BYTES).then(parseCapturedBody)
+        ? readBoundedBody(response.clone(), maxBytes).then(parseCapturedBody)
         : Promise.resolve(null);
     // Read regardless of `captureBody`: this is metadata about the dispatch, not
     // payload retention, so a tenant in `metadata` mode still records which

package/src/transport/dispatch/proxy-request.ts

@@ -28,6 +28,8 @@ import {
   completionContext,
   estimatedUsage,
   parseCapturedBody,
+  providerCaptureMaxBytes,
+  resolveCaptureDepthForRequest,
   shouldCaptureProviderBodyForRequest,
   terminalFailure,
 } from "./attempt-finalize";
@@ -239,6 +241,13 @@ export async function handleProviderProxyRequest(
                   prepared.authorization.snapshot.tenant_id,
                   state,
                 ),
+                providerCaptureMaxBytes(
+                  await resolveCaptureDepthForRequest(
+                    deps.db,
+                    prepared.authorization.snapshot.tenant_id,
+                    state,
+                  ),
+                ),
               ),
             }
           : {}),

package/src/transport/dispatch/streaming/stream.ts

@@ -43,7 +43,12 @@ import type { AdmissionLease } from "../../../security/admission/contracts";
 import type { NetworkPoolSelector } from "../../../network/pool/selector";
 import type { TelemetryBatchBuffer } from "../../../observability/telemetry-buffer";
 import type { ProviderExchangeCapture } from "../attempt-finalize";
-import { captureProviderExchange, shouldCaptureProviderBodyForRequest } from "../attempt-finalize";
+import {
+  captureProviderExchange,
+  providerCaptureMaxBytes,
+  resolveCaptureDepthForRequest,
+  shouldCaptureProviderBodyForRequest,
+} from "../attempt-finalize";
 import { proxySuccessHeaders, buildUpstreamDispatchContext } from "../upstream";
 import type { AttemptLeaseOwnership } from "../leases";
 import type { ProviderContinuationScope } from "../../../providers/provider-contracts";
@@ -165,11 +170,20 @@ export async function dispatchStreamingAttempt(input: StreamingDispatchInput): P
     networkPoolId,
     prepared.authorization.snapshot.tenant_id,
   );
+  const captureBody = outboundFetch
+    ? await shouldCaptureProviderBodyForRequest(deps.db, prepared.authorization.snapshot.tenant_id, state)
+    : false;
+  const captureDepth = await resolveCaptureDepthForRequest(
+    deps.db,
+    prepared.authorization.snapshot.tenant_id,
+    state,
+  );
   const wrappedOutboundFetch = outboundFetch
     ? captureProviderExchange(
         outboundFetch,
         providerCapture,
-        await shouldCaptureProviderBodyForRequest(deps.db, prepared.authorization.snapshot.tenant_id, state),
+        captureBody,
+        providerCaptureMaxBytes(captureDepth),
       )
     : undefined;
   const dispatchContext = buildUpstreamDispatchContext({

package/src/transport/guards/auth-guard.ts

@@ -6,7 +6,7 @@ import { GatewayError } from "../../protocol/gateway-error";
 import type { ProxyRequestStateStore } from "../request/state";
 import { fastPathname } from "../pathname";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
-import { requestToken, resolveApiKeyAuthorization } from "../../security/api-key-auth";
+import { requestToken, resolveApiKeyAuthorization, unknownApiKeyError } from "../../security/api-key-auth";
 import {
   deniedClientRouter,
   detectClientRouter,
@@ -65,8 +65,7 @@ export function createApiKeyAuthenticationMiddleware(deps: {
           "cartethyia",
         );
       });
-      if (!authorization)
-        throw new GatewayError("invalid_request", 401, "This API key is unknown, revoked, or expired. Issue a new key and send it as: Authorization: Bearer <key>.");
+      if (!authorization) throw unknownApiKeyError();
       const decision = createAccessDecision({
         id: authorization.id,
         tenantId: authorization.tenantId,