cartethyia 2.5.2 → 2.5.4

package/src/providers/discovery/openrouter-free-roster.ts

@@ -1,11 +1,12 @@
 /**
  * The free tier shared by the OpenRouter-backed providers.
  *
- * Cline, Kilo Code and OpenRouter serve one model catalog: the same 469 ids,
- * and the same 9 of them carrying a `:free` suffix. Verified against all three
- * live listings — every id below is present under `openrouter`, `kilo` and
- * `cline` — so this roster is a catalog fact, not a per-provider guess, and it
- * lives in one place rather than being restated three times.
+ * Cline, Kilo Code and OpenRouter serve one model catalog, and every id below
+ * was verified to exist under `openrouter`, `kilo` and `cline` — so this
+ * roster is a catalog fact, not a per-provider guess, and it lives in one
+ * place rather than being restated three times. Dropping a row here unlists
+ * it from all three providers' seeded catalog at the next boot; live
+ * discovery will still find it, which is the intended prune.
  *
  * The limits, modalities and capability flags are read from OpenRouter's own
  * `/api/v1/models`, which states `context_length`,
@@ -13,6 +14,10 @@
  * `supported_parameters`. That is the serving catalog's declaration, so these
  * are measurements rather than defaults.
  *
+ * The set is curated: a 2.6B toy (`liquid/lfm-2.5-2.6b:free`) and the
+ * upstream content-safety classifier (`nvidia/nemotron-3.5-content-safety:free`)
+ * are deliberately not seeded — a prefill classifier is not a chat model.
+ *
  * This is a floor, not the authority: each provider also discovers live, and a
  * row the listing carries that this roster does not is still found there. The
  * roster exists so a fresh install has a usable free tier before any fetch, and
@@ -32,15 +37,16 @@ interface FreeRow {
   readonly ctx: number;
   readonly out: number;
   readonly vision?: boolean;
-  /** `supported_parameters` omits `tools` on the safety classifier only. */
+  /** `false` only when `supported_parameters` omits `tools`. */
   readonly toolCall?: boolean;
 }
 
 /**
- * The 9 `:free` ids, with the limits the catalog states for each.
+ * The shared `:free` ids still worth seeding, with the limits the catalog
+ * states for each.
  *
- * Every row declares `reasoning`: `supported_parameters` lists it on all
- * nine. `toolCall` is `true` unless stated otherwise, because a row that
+ * Every row declares `reasoning`: `supported_parameters` lists it on every
+ * entry. `toolCall` is `true` unless stated otherwise, because a row that
  * advertises tools must keep them — a false `toolCall` makes the preflight
  * strip `tools` from the request, which is a wrong capability rather than a
  * conservative one.
@@ -48,7 +54,6 @@ interface FreeRow {
 const FREE_ROWS: readonly FreeRow[] = [
   { id: "cohere/north-mini-code:free", ctx: 256_000, out: 64_000 },
   { id: "dots-studio/dots-3-note-preview:free", ctx: 512_000, out: 460_800, vision: true },
-  { id: "liquid/lfm-2.5-2.6b:free", ctx: 65_536, out: 8_192 },
   { id: "minimax/minimax-m3.1-flash:free", ctx: 1_000_000, out: 524_288, vision: true },
   {
     id: "nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:free",
@@ -57,13 +62,6 @@ const FREE_ROWS: readonly FreeRow[] = [
     vision: true,
   },
   { id: "nvidia/nemotron-3-ultra-550b-a55b:free", ctx: 1_000_000, out: 65_536 },
-  {
-    id: "nvidia/nemotron-3.5-content-safety:free",
-    ctx: 128_000,
-    out: 8_192,
-    vision: true,
-    toolCall: false,
-  },
   { id: "nvidia/nemotron-3.5-lightning:free", ctx: 1_000_000, out: 65_536 },
   { id: "nvidia/nemotron-3.5-super-vl:free", ctx: 1_000_000, out: 131_072, vision: true },
 ];

package/src/providers/integrations/antigravity/antigravity-quota.ts

@@ -189,12 +189,20 @@ function parseModelQuotas(payload: Record<string, unknown>): ProviderQuotaWindow
     const family = modelFamily(collapseAntigravityVariant(modelId));
     const familyLabel = FAMILY_LABELS[family.key] ?? family.label;
     for (const entry of modelQuotaEntries(model)) {
-      const fraction = number(entry.info.remainingFraction);
-      if (fraction === null) continue;
+      // A bucket with no fraction but a reset time is exhausted, not unknown:
+      // the upstream omits the field when there is nothing left to report, so
+      // dropping it let a healthy sibling window mask a lane that is blocked
+      // until reset. Only a bucket with neither signal is genuinely unknown.
+      // This matches what the summary path already does for a disabled bucket.
+      const reported = number(entry.info.remainingFraction);
+      const resetAt = isoDate(entry.info.resetTime);
+      const exhausted = reported === null && resetAt !== null;
+      if (reported === null && !exhausted) continue;
+      const fraction = reported ?? 0;
       const kind = entry.kind ?? summaryWindowKind(entry.info);
       const label = kind === undefined ? familyLabel : `${familyLabel} (${SUMMARY_WINDOW_LABELS[kind]})`;
       const key = `${family.key}:${kind ?? "model"}`;
-      const window = fractionWindow(key, label, fraction, isoDate(entry.info.resetTime));
+      const window = fractionWindow(key, label, fraction, resetAt);
       grouped.set(key, keepWorse(grouped.get(key), window));
     }
   }

package/src/providers/integrations/buddy/buddy-catalog-shared.ts

@@ -257,8 +257,8 @@ export const BUDDY_SHARED_RAW: readonly BuddyRawEntry[] = [
   ["claude-opus-4.6", "Claude Opus 4.6", true, true, 200_000, 64_000],
   ["claude-opus-4.7-1m", "Claude Opus 4.7 1M", true, true, 1_000_000, 64_000],
   ["claude-sonnet-4.6", "Claude Sonnet 4.6", true, true, 200_000, 32_000],
-  ["deepseek-v4.1-flash", "DeepSeek V4.1 Flash", true, false, 1_000_000, 384_000],
-  ["deepseek-v4.1-flash-sg", "DeepSeek V4.1 Flash SG", true, false, 1_000_000, 128_000],
+  ["deepseek-v4.1-flash", "DeepSeek V4.1 Flash", true, true, 1_000_000, 384_000],
+  ["deepseek-v4.1-flash-sg", "DeepSeek V4.1 Flash SG", true, true, 1_000_000, 128_000],
   ["deepseek-v4.1-pro", "DeepSeek V4.1 Pro", true, false, 1_000_000, 384_000],
   ["gemini-2.5-flash-image", "Gemini 2.5 Flash Image", true, true, 1_000_000, 64_000],
   ["gemini-3.0-pro-image", "Gemini 3.0 Pro Image", true, true, 1_000_000, 64_000],
@@ -286,8 +286,8 @@ export const BUDDY_SHARED_RAW: readonly BuddyRawEntry[] = [
   ["grok-4.7", "Grok 4.7", true, true, 500_000, 500_000],
   ["hy3", "Hy3", true, false, 192_000, 64_000, true],
   ["hy3-preview", "Hy3 Preview", true, false, 262_144, 64_000],
-  ["hy4-preview", "Hy4 Preview", true, false, 1_000_000, 64_000, true],
-  ["hy4-preview-f", "Hy4 Preview F", true, false, 1_000_000, 64_000, true],
+  ["hy4-preview", "Hy4 Preview", true, true, 1_000_000, 64_000, true],
+  ["hy4-preview-f", "Hy4 Preview F", true, true, 1_000_000, 64_000, true],
   ["kimi-k2.5", "Kimi K2.5", true, false, 164_000, 262_144],
   ["kimi-k2.6", "Kimi K2.6", true, false, 256_000, 262_144],
   ["kimi-k2.7", "Kimi K2.7", true, false, 256_000, 65_536],

package/src/providers/integrations/buddy/workbuddy/shared.ts

@@ -1,200 +1,201 @@
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-
-import type { OpenAICompatibleAdapterConfig } from "../../../adapters/compatible-adapter";
-import { withBearerAuthentication } from "../../../adapters/compatible-adapter";
-import type { CanonicalRequest } from "../../../../protocol/canonical-model";
-import type { ProviderDispatchContext, ProviderDispatchTarget, ProviderId } from "../../../provider-contracts";
-import { resolveInboundSessionId } from "../../../operations/session-resolution";
-import { buddyConversationHeaders } from "../buddy-conversation-headers";
-import { buddyCliHeaders, buddyCliTraceHeaders } from "../buddy-cli-headers";
-import { buddyUserId, resolveBuddyIdentity } from "../buddy-identity";
-import {
-  buildWorkBuddyUserAgent,
-  getWorkBuddyClientVersion,
-  getWorkBuddyCliVersion,
-} from "../../../operations/client-versions";
-
-/**
- * WorkBuddy serves chat from a versioned path on a base URL that carries no
- * version segment (billing uses the unversioned `/billing/…` path), so both the
- * adapter config and the static catalog rows must state it. The generic
- * `/chat/completions` default would join into
- * `https://www.workbuddy.ai/chat/completions`, which that upstream answers with
- * a 405 HTML error page.
- */
-export const WORKBUDDY_CHAT_PATH = "/v2/chat/completions" as const;
-
-export {
-  buildWorkBuddyUserAgent,
-  getWorkBuddyClientVersion,
-  getWorkBuddyCliVersion,
-};
-
-/** WorkBuddy international gateway domain (Origin/Referer/X-Domain). */
-export const WORKBUDDY_DOMAIN = "www.workbuddy.ai";
-
-/**
- * Stable per-account device identifiers.
- *
- * WorkBuddy's desktop client presents one fixed virtual device per account.
- * Deriving `X-Machine-ID` / `X-Session-ID` from the account id (sha256, 36 hex)
- * keeps them constant across restarts while staying distinct per account, so
- * multiple pooled accounts are not correlated by a missing or drifting device
- * fingerprint. Mirrors the reference gateway's `wb2a:<purpose>:<uid>` scheme.
- */
-function deriveAccountStableId(accountId: string, purpose: string): string {
-  const sum = createHash("sha256").update(`wb2a:${purpose}:${accountId}`).digest("hex");
-  return sum.slice(0, 36);
-}
-
-/**
- * Per-request WorkBuddy chat headers — the exact desktop-client contract.
- *
- * The international gateway gates chat on the desktop `User-Agent` (platform
- * brand `WorkBuddy AI`; the wrong brand trips 403 code 11140), plus the
- * `X-CodeBuddy-Request` risk gate and the account-scoped device headers.
- * The background client-version monitor keeps this value fresh; dispatch only
- * reads the cached value and never waits on a version endpoint.
- *
- * `cliIdentity` selects the reference CLI contract instead. The two are not
- * variations of one set: the CLI drops every browser header and the device
- * token, and adds the agent envelope. Left unset, nothing changes.
- */
-export async function workbuddyHeaders(
-  context?: ProviderDispatchContext,
-  request?: CanonicalRequest,
-  domain = WORKBUDDY_DOMAIN,
-  clientVersion = getWorkBuddyClientVersion(),
-  cliIdentity?: boolean,
-): Promise<Record<string, string>> {
-  const conversation = buddyConversationHeaders({
-    ...(resolveInboundSessionId(context, request) === undefined
-      ? {}
-      : { conversationId: resolveInboundSessionId(context, request) }),
-  });
-  const accountId = context?.credential.account_id;
-  if (resolveBuddyIdentity(context, cliIdentity) === "cli") {
-    // The reference CLI: issued by the OpenAI Node SDK, so no browser header
-    // and no device token, and the machine/session device pair does not
-    // exist — only `X-User-Id`, which is `anonymous` without a uid.
-    return {
-      accept: "application/json",
-      "user-agent": `CLI/${getWorkBuddyCliVersion()} CodeBuddy/${getWorkBuddyCliVersion()}`,
-      "x-domain": domain,
-      "x-agent-purpose": "conversation",
-      "x-ide-name": "CLI",
-      "x-ide-type": "CLI",
-      "x-ide-version": getWorkBuddyCliVersion(),
-      "x-product": "SaaS",
-      "x-no-enterprise-id": "1",
-      ...conversation,
-      ...buddyCliTraceHeaders(conversation),
-      ...buddyCliHeaders({ userId: buddyUserId(context) }),
-    };
-  }
-  const headers: Record<string, string> = {
-    accept: "application/json, text/event-stream",
-    "user-agent": buildWorkBuddyUserAgent(clientVersion, getWorkBuddyCliVersion()),
-    origin: `https://${domain}`,
-    referer: `https://${domain}/`,
-    "accept-language": "en-US",
-    "x-requested-with": "XMLHttpRequest",
-    "x-codebuddy-request": "1",
-    "x-domain": domain,
-    "x-agent-purpose": "conversation",
-    "x-ide-name": "WorkBuddy",
-    "x-ide-type": "WorkBuddy",
-    "x-ide-version": clientVersion,
-    // Both references send the literal `SaaS` here. `WorkBuddy` was a value
-    // this repo invented; the desktop product name belongs in `x-ide-name`,
-    // and the CN test below compares the two realms against each other rather
-    // than to a hard-coded string.
-    "x-product": "SaaS",
-    // Personal international accounts carry no enterprise id: declare it
-    // explicitly so upstream risk control does not treat the omission as
-    // suspicious.
-    "x-no-enterprise-id": "1",
-  };
-  // The conversation/tracing family the upstream's channel check looks for. A
-  // live request carrying only `x-session-id` was refused for a missing
-  // conversation id; the aggregation key below is the one the reference marks
-  // mandatory.
-  Object.assign(headers, conversation);
-  if (accountId) {
-    headers["x-user-id"] = accountId;
-    headers["x-machine-id"] = deriveAccountStableId(accountId, "machine");
-    headers["x-session-id"] = deriveAccountStableId(accountId, "session");
-  }
-  const deviceToken = readBuddyDeviceToken(context);
-  if (deviceToken !== undefined) headers["x-device-token"] = deviceToken;
-  return headers;
-}
-
-/**
- * Desktop risk token, sent only when the account actually has one.
- *
- * The account's own `auth_state` wins. When it carries none, a file the
- * desktop client writes (`CARTETHYIA_DEVICE_TOKEN_FILE`, default
- * `/app/data/device_token`) is read instead — cached for five minutes, and
- * ignored when it is larger than 1 KB, because a token file that size is not
- * a token. A missing file is the normal case and reads as "no token".
- */
-const DEVICE_TOKEN_FILE_MAX_BYTES = 1024;
-const DEVICE_TOKEN_FILE_TTL_MS = 5 * 60_000;
-let deviceTokenFileCache: { readonly value: string | undefined; readonly readAt: number } | undefined;
-
-export function readBuddyDeviceToken(context?: ProviderDispatchContext): string | undefined {
-  const state = context?.credential.auth_state;
-  const value = state?.["deviceToken"] ?? state?.["device_token"];
-  if (typeof value === "string" && value.trim().length > 0) return value.trim();
-  return readDeviceTokenFile();
-}
-
-function readDeviceTokenFile(): string | undefined {
-  const now = Date.now();
-  if (deviceTokenFileCache !== undefined && now - deviceTokenFileCache.readAt < DEVICE_TOKEN_FILE_TTL_MS) {
-    return deviceTokenFileCache.value;
-  }
-  const path = process.env["CARTETHYIA_DEVICE_TOKEN_FILE"] ?? "/app/data/device_token";
-  let value: string | undefined;
-  try {
-    const raw = readFileSync(path);
-    if (raw.byteLength > 0 && raw.byteLength <= DEVICE_TOKEN_FILE_MAX_BYTES) {
-      const text = raw.toString("utf8").trim();
-      if (text.length > 0) value = text;
-    }
-  } catch {
-    value = undefined;
-  }
-  deviceTokenFileCache = { value, readAt: now };
-  return value;
-}
-
-/**
- * Shared OpenAI-compatible chat-adapter config for WorkBuddy: bearer auth
- * (api_key and oauth both use `Authorization: Bearer`), `/v2/chat/completions`
- * endpoint, per-request desktop-client headers, and the payload hook.
- */
-export function workbuddyAdapterConfig(args: {
-  providerId: ProviderId;
-  baseUrl: string;
-  domain?: string;
-  prePayload: (
-    payload: Record<string, unknown>,
-    request: CanonicalRequest,
-    candidate: ProviderDispatchTarget,
-  ) => void;
-  fetchImpl?: typeof fetch;
-  cliIdentity?: boolean;
-}): OpenAICompatibleAdapterConfig {
-  return withBearerAuthentication({
-    provider_id: args.providerId,
-    base_url: args.baseUrl,
-    endpoint_paths_by_wire_family: { chat: WORKBUDDY_CHAT_PATH },
-    buildExtraHeaders: (context, request) =>
-      workbuddyHeaders(context, request, args.domain ?? WORKBUDDY_DOMAIN, undefined, args.cliIdentity),
-    prePayload: args.prePayload,
-    ...(args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}),
-  });
-}
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+
+import type { OpenAICompatibleAdapterConfig } from "../../../adapters/compatible-adapter";
+import { withBearerAuthentication } from "../../../adapters/compatible-adapter";
+import type { CanonicalRequest } from "../../../../protocol/canonical-model";
+import type { ProviderDispatchContext, ProviderDispatchTarget, ProviderId } from "../../../provider-contracts";
+import { resolveInboundSessionId } from "../../../operations/session-resolution";
+import { buddyConversationHeaders } from "../buddy-conversation-headers";
+import { buddyCliHeaders, buddyCliTraceHeaders } from "../buddy-cli-headers";
+import { buddyUserId, resolveBuddyIdentity } from "../buddy-identity";
+import {
+  buildWorkBuddyUserAgent,
+  getWorkBuddyClientVersion,
+  getWorkBuddyCliVersion,
+} from "../../../operations/client-versions";
+
+/**
+ * WorkBuddy serves chat from a versioned path on a base URL that carries no
+ * version segment (billing uses the unversioned `/billing/…` path), so both the
+ * adapter config and the static catalog rows must state it. The generic
+ * `/chat/completions` default would join into
+ * `https://www.workbuddy.ai/chat/completions`, which that upstream answers with
+ * a 405 HTML error page.
+ */
+export const WORKBUDDY_CHAT_PATH = "/v2/chat/completions" as const;
+
+export {
+  buildWorkBuddyUserAgent,
+  getWorkBuddyClientVersion,
+  getWorkBuddyCliVersion,
+};
+
+/** WorkBuddy international gateway domain (Origin/Referer/X-Domain). */
+export const WORKBUDDY_DOMAIN = "www.workbuddy.ai";
+
+/**
+ * Stable per-account device identifiers.
+ *
+ * WorkBuddy's desktop client presents one fixed virtual device per account.
+ * Deriving `X-Machine-ID` / `X-Session-ID` from the account id (sha256, 36 hex)
+ * keeps them constant across restarts while staying distinct per account, so
+ * multiple pooled accounts are not correlated by a missing or drifting device
+ * fingerprint. Mirrors the reference gateway's `wb2a:<purpose>:<uid>` scheme.
+ */
+function deriveAccountStableId(accountId: string, purpose: string): string {
+  const sum = createHash("sha256").update(`wb2a:${purpose}:${accountId}`).digest("hex");
+  return sum.slice(0, 36);
+}
+
+/**
+ * Per-request WorkBuddy chat headers — the exact desktop-client contract.
+ *
+ * The international gateway gates chat on the desktop `User-Agent` (platform
+ * brand `WorkBuddy AI`, carried on the wire as the token `workbuddy-ai`;
+ * the wrong token trips 403 code 11140), plus the `X-CodeBuddy-Request` risk
+ * gate and the account-scoped device headers.
+ * The background client-version monitor keeps this value fresh; dispatch only
+ * reads the cached value and never waits on a version endpoint.
+ *
+ * `cliIdentity` selects the reference CLI contract instead. The two are not
+ * variations of one set: the CLI drops every browser header and the device
+ * token, and adds the agent envelope. Left unset, nothing changes.
+ */
+export async function workbuddyHeaders(
+  context?: ProviderDispatchContext,
+  request?: CanonicalRequest,
+  domain = WORKBUDDY_DOMAIN,
+  clientVersion = getWorkBuddyClientVersion(),
+  cliIdentity?: boolean,
+): Promise<Record<string, string>> {
+  const conversation = buddyConversationHeaders({
+    ...(resolveInboundSessionId(context, request) === undefined
+      ? {}
+      : { conversationId: resolveInboundSessionId(context, request) }),
+  });
+  const accountId = context?.credential.account_id;
+  if (resolveBuddyIdentity(context, cliIdentity) === "cli") {
+    // The reference CLI: issued by the OpenAI Node SDK, so no browser header
+    // and no device token, and the machine/session device pair does not
+    // exist — only `X-User-Id`, which is `anonymous` without a uid.
+    return {
+      accept: "application/json",
+      "user-agent": `CLI/${getWorkBuddyCliVersion()} CodeBuddy/${getWorkBuddyCliVersion()}`,
+      "x-domain": domain,
+      "x-agent-purpose": "conversation",
+      "x-ide-name": "CLI",
+      "x-ide-type": "CLI",
+      "x-ide-version": getWorkBuddyCliVersion(),
+      "x-product": "SaaS",
+      "x-no-enterprise-id": "1",
+      ...conversation,
+      ...buddyCliTraceHeaders(conversation),
+      ...buddyCliHeaders({ userId: buddyUserId(context) }),
+    };
+  }
+  const headers: Record<string, string> = {
+    accept: "application/json, text/event-stream",
+    "user-agent": buildWorkBuddyUserAgent(clientVersion, getWorkBuddyCliVersion()),
+    origin: `https://${domain}`,
+    referer: `https://${domain}/`,
+    "accept-language": "en-US",
+    "x-requested-with": "XMLHttpRequest",
+    "x-codebuddy-request": "1",
+    "x-domain": domain,
+    "x-agent-purpose": "conversation",
+    "x-ide-name": "WorkBuddy",
+    "x-ide-type": "WorkBuddy",
+    "x-ide-version": clientVersion,
+    // Both references send the literal `SaaS` here. `WorkBuddy` was a value
+    // this repo invented; the desktop product name belongs in `x-ide-name`,
+    // and the CN test below compares the two realms against each other rather
+    // than to a hard-coded string.
+    "x-product": "SaaS",
+    // Personal international accounts carry no enterprise id: declare it
+    // explicitly so upstream risk control does not treat the omission as
+    // suspicious.
+    "x-no-enterprise-id": "1",
+  };
+  // The conversation/tracing family the upstream's channel check looks for. A
+  // live request carrying only `x-session-id` was refused for a missing
+  // conversation id; the aggregation key below is the one the reference marks
+  // mandatory.
+  Object.assign(headers, conversation);
+  if (accountId) {
+    headers["x-user-id"] = accountId;
+    headers["x-machine-id"] = deriveAccountStableId(accountId, "machine");
+    headers["x-session-id"] = deriveAccountStableId(accountId, "session");
+  }
+  const deviceToken = readBuddyDeviceToken(context);
+  if (deviceToken !== undefined) headers["x-device-token"] = deviceToken;
+  return headers;
+}
+
+/**
+ * Desktop risk token, sent only when the account actually has one.
+ *
+ * The account's own `auth_state` wins. When it carries none, a file the
+ * desktop client writes (`CARTETHYIA_DEVICE_TOKEN_FILE`, default
+ * `/app/data/device_token`) is read instead — cached for five minutes, and
+ * ignored when it is larger than 1 KB, because a token file that size is not
+ * a token. A missing file is the normal case and reads as "no token".
+ */
+const DEVICE_TOKEN_FILE_MAX_BYTES = 1024;
+const DEVICE_TOKEN_FILE_TTL_MS = 5 * 60_000;
+let deviceTokenFileCache: { readonly value: string | undefined; readonly readAt: number } | undefined;
+
+export function readBuddyDeviceToken(context?: ProviderDispatchContext): string | undefined {
+  const state = context?.credential.auth_state;
+  const value = state?.["deviceToken"] ?? state?.["device_token"];
+  if (typeof value === "string" && value.trim().length > 0) return value.trim();
+  return readDeviceTokenFile();
+}
+
+function readDeviceTokenFile(): string | undefined {
+  const now = Date.now();
+  if (deviceTokenFileCache !== undefined && now - deviceTokenFileCache.readAt < DEVICE_TOKEN_FILE_TTL_MS) {
+    return deviceTokenFileCache.value;
+  }
+  const path = process.env["CARTETHYIA_DEVICE_TOKEN_FILE"] ?? "/app/data/device_token";
+  let value: string | undefined;
+  try {
+    const raw = readFileSync(path);
+    if (raw.byteLength > 0 && raw.byteLength <= DEVICE_TOKEN_FILE_MAX_BYTES) {
+      const text = raw.toString("utf8").trim();
+      if (text.length > 0) value = text;
+    }
+  } catch {
+    value = undefined;
+  }
+  deviceTokenFileCache = { value, readAt: now };
+  return value;
+}
+
+/**
+ * Shared OpenAI-compatible chat-adapter config for WorkBuddy: bearer auth
+ * (api_key and oauth both use `Authorization: Bearer`), `/v2/chat/completions`
+ * endpoint, per-request desktop-client headers, and the payload hook.
+ */
+export function workbuddyAdapterConfig(args: {
+  providerId: ProviderId;
+  baseUrl: string;
+  domain?: string;
+  prePayload: (
+    payload: Record<string, unknown>,
+    request: CanonicalRequest,
+    candidate: ProviderDispatchTarget,
+  ) => void;
+  fetchImpl?: typeof fetch;
+  cliIdentity?: boolean;
+}): OpenAICompatibleAdapterConfig {
+  return withBearerAuthentication({
+    provider_id: args.providerId,
+    base_url: args.baseUrl,
+    endpoint_paths_by_wire_family: { chat: WORKBUDDY_CHAT_PATH },
+    buildExtraHeaders: (context, request) =>
+      workbuddyHeaders(context, request, args.domain ?? WORKBUDDY_DOMAIN, undefined, args.cliIdentity),
+    prePayload: args.prePayload,
+    ...(args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}),
+  });
+}