cartethyia 2.5.9 → 2.6.0

package/src/providers/discovery/probe-phases.ts

@@ -36,6 +36,8 @@ import { OpenAICompatibleAdapter } from "../adapters/compatible-adapter";
 import { resolveByokWireProfile } from "../operations/byok-wire-profile";
 import { recordAccountFailure, recordAccountSuccess } from "../operations/account-health-service";
 import { buildCapabilityProfile } from "../../transport/routing/route-catalog";
+import { payloadRetentionMs, resolvePayloadCapture } from "../../observability/payload-capture";
+import type { TelemetryPayloadDepth } from "../../console/settings/contracts";
 import { classifyUpstreamFailure } from "../../transport/failure-policy";
 import { terminalFailure } from "../../transport/dispatch/attempt-finalize";
 import { GatewayError } from "../../protocol/gateway-error";
@@ -448,7 +450,23 @@ export interface ProbeReasoning {
 /** Tenant probe preferences that shape the request and telemetry. */
 export interface ProbePreferences {
   readonly probeReasoning: ProbeReasoning | undefined;
-  readonly payloadCaptureEnabled: boolean;
+  /**
+   * The tenant's resolved capture policy for the probe, through the same
+   * `resolvePayloadCapture` path every dispatched request uses.
+   *
+   * `none` (and a failed preference read — capture fails closed) captures
+   * nothing; `metadata` captures stage presence only; `full` keeps bodies at
+   * the tenant's own depth and retention. The previous boolean collapsed all
+   * three into "capture on", so a probe teed bodies at the flat deployment
+   * cap for a tenant whose choice was `metadata` — and whose live requests
+   * stored none.
+   */
+  readonly payloadCapture: {
+    readonly enabled: boolean;
+    readonly mode: "none" | "metadata" | "full";
+    readonly depth: TelemetryPayloadDepth;
+    readonly retentionMs: number;
+  };
 }
 
 /**
@@ -465,7 +483,12 @@ export async function loadProbePreferences(args: {
 }): Promise<ProbePreferences> {
   const { db, tenantId, wireFamily, request } = args;
   let probeReasoning: ProbeReasoning | undefined;
-  let payloadCaptureEnabled = false;
+  let payloadCapture: ProbePreferences["payloadCapture"] = {
+    enabled: false,
+    mode: "none",
+    depth: "minimum",
+    retentionMs: payloadRetentionMs(),
+  };
   // `auto` (and an omitted effort) means "send no reasoning intent": the probe
   // must reflect what the route does by itself, and a model that does not
   // support reasoning would otherwise fail a probe that should have passed.
@@ -483,10 +506,23 @@ export async function loadProbePreferences(args: {
     const raw = preferences?.responsesReasoningSummary;
     const mode: "auto" | "concise" | "detailed" =
       raw === "auto" || raw === "concise" || raw === "detailed" ? raw : "detailed";
-    // Unset matches the settings default: off. Only an explicit choice captures.
-    payloadCaptureEnabled =
-      preferences?.telemetryPayloads === "full" ||
-      preferences?.telemetryPayloads === "metadata";
+    // Unset matches the settings default: off. Only an explicit choice
+    // captures, and at the tenant's own depth/retention — the same resolution
+    // `resolvePayloadCapture` performs for dispatched requests, read from the
+    // same preferences row this phase already loaded.
+    const captureMode = preferences?.telemetryPayloads;
+    if (captureMode === "full" || captureMode === "metadata") {
+      const resolved = await resolvePayloadCapture(db, tenantId);
+      payloadCapture = resolved.ok
+        ? {
+            enabled: true,
+            mode: resolved.mode,
+            depth: resolved.depth,
+            retentionMs: resolved.retentionMs,
+          }
+        : // Failed preference read: capture fails closed.
+          { enabled: false, mode: "none", depth: "minimum", retentionMs: payloadRetentionMs() };
+    }
     if (wireFamily === "responses" && requestedEffort !== undefined) {
       probeReasoning = {
         effort: requestedEffort,
@@ -501,7 +537,7 @@ export async function loadProbePreferences(args: {
       };
     }
   }
-  return { probeReasoning, payloadCaptureEnabled };
+  return { probeReasoning, payloadCapture };
 }
 
 /**

package/src/providers/discovery/probing-service.ts

@@ -1,4 +1,12 @@
-import { captureProviderExchange, type ProviderExchangeCapture } from "../../transport/dispatch/attempt-finalize";
+import {
+  captureProviderExchange,
+  providerRequestMetadataOnly,
+  type ProviderExchangeCapture,
+} from "../../transport/dispatch/attempt-finalize";
+import {
+  captureDepthMaxBytes,
+  providerCaptureMaxBytes,
+} from "../../transport/dispatch/capture-policy";
 import { globalOrOwnedBy } from "../../persistence/tenant-scope";
 /**
  * Provider probing and model-discovery orchestration.
@@ -221,7 +229,7 @@ export class ProviderProbingService {
       };
     }
 
-    const { probeReasoning, payloadCaptureEnabled } = await loadProbePreferences({
+    const { probeReasoning, payloadCapture } = await loadProbePreferences({
       db: this.db,
       tenantId,
       wireFamily,
@@ -273,14 +281,19 @@ export class ProviderProbingService {
       };
       // The same wrapper a real dispatch uses, so the probe reads the model the
       // upstream named from the raw bytes rather than from a synthesized event.
+      // Body capture follows the tenant's mode: `metadata` tees the request
+      // line and stage presence without slicing bodies (the same
+      // `captureBody=false` path a live metadata-mode dispatch uses), `full`
+      // tees bodies at the tenant's own depth cap. `none` still wraps — the
+      // reported-model read is dispatch metadata, not payload retention, and
+      // runs regardless of capture mode.
       const probeFetch = createProbeFetch(
-        // Body capture on, unlike a live dispatch: a probe is one-shot and
-        // operator-initiated, so it exists to be inspected. With it off, the
-        // provider-response tee resolved to null and every probe row reported
-        // the middle two stages as absent — a constant, not a measurement,
-        // which made the stage markers useless for the diagnosis they exist
-        // for. The 256 KiB cap in the tee bounds the cost.
-        captureProviderExchange(outbound.fetch, probeCapture, true),
+        captureProviderExchange(
+          outbound.fetch,
+          probeCapture,
+          payloadCapture.mode === "full",
+          providerCaptureMaxBytes(payloadCapture.depth),
+        ),
       );
       try {
         if (serviceKind === "websearch") {
@@ -506,29 +519,54 @@ export class ProviderProbingService {
       ...(usage ? { usage } : {}),
       ...(tokensPerSec !== undefined ? { tokensPerSec } : {}),
     });
-    if (this.telemetryBuffer && payloadCaptureEnabled) {
-      // All four surfaces, so the row's stage markers mean the same thing here
-      // as they do on a live request: which hop actually produced bytes.
-      const providerRequest = probeCapture?.request ?? null;
-      const providerResponse = await probeCapture?.response.catch(() => null) ?? null;
-      await this.payloadCapture
-        .capture({
-          tenantId,
-          requestId,
-          requestBody: capturedRequest,
-          // `events` is what the *client* receives, so it belongs in the client
-          // surface. Passing it as `responseBody` lit the client bit on probes
-          // whose event list was empty, over a body that was never captured.
-          // The legacy alias is explicitly absent here; `null` leaves bit 8 to
-          // be decided by the real client body alone.
-          responseBody: null,
-          ...(events === undefined ? {} : { clientResponseBody: events }),
-          ...(providerRequest === null ? {} : { providerRequestBody: providerRequest }),
-          ...(providerResponse === null ? {} : { providerResponseBody: providerResponse }),
-          scope: "tenant",
-          tenantOptIn: true,
-        })
-        .catch(() => undefined);
+    if (this.telemetryBuffer && payloadCapture.enabled) {
+      if (payloadCapture.mode === "metadata") {
+        // Stage presence only: the provider request line (method, URL,
+        // headers, body_present/body_bytes) is exactly what `metadata` mode
+        // keeps for a live request. No bodies anywhere.
+        const providerRequest = providerRequestMetadataOnly(probeCapture?.request ?? null);
+        if (providerRequest !== null) {
+          await this.payloadCapture
+            .capture({
+              tenantId,
+              requestId,
+              requestBody: null,
+              responseBody: null,
+              providerRequestBody: providerRequest,
+              retentionMs: payloadCapture.retentionMs,
+              scope: "tenant",
+              tenantOptIn: true,
+            })
+            .catch(() => undefined);
+        }
+      } else {
+        // All four surfaces, so the row's stage markers mean the same thing
+        // here as they do on a live request: which hop actually produced bytes.
+        // Depth and retention are the tenant's own, resolved through the same
+        // preference path a dispatched request uses.
+        const providerRequest = probeCapture?.request ?? null;
+        const providerResponse = await probeCapture?.response.catch(() => null) ?? null;
+        await this.payloadCapture
+          .capture({
+            tenantId,
+            requestId,
+            requestBody: capturedRequest,
+            // `events` is what the *client* receives, so it belongs in the
+            // client surface. Passing it as `responseBody` lit the client bit
+            // on probes whose event list was empty, over a body that was never
+            // captured. The legacy alias is explicitly absent here; `null`
+            // leaves bit 8 to be decided by the real client body alone.
+            responseBody: null,
+            ...(events === undefined ? {} : { clientResponseBody: events }),
+            ...(providerRequest === null ? {} : { providerRequestBody: providerRequest }),
+            ...(providerResponse === null ? {} : { providerResponseBody: providerResponse }),
+            maxBytes: captureDepthMaxBytes(payloadCapture.depth),
+            retentionMs: payloadCapture.retentionMs,
+            scope: "tenant",
+            tenantOptIn: true,
+          })
+          .catch(() => undefined);
+      }
     }
 
     const sample = extractSample(events);

package/src/providers/integrations/antigravity/antigravity.ts

@@ -44,6 +44,7 @@ import {
   getAntigravityModelWireProfile,
   getAntigravityUserAgent,
   loadAntigravityProject,
+  normalizeAntigravityToolSchemas,
 } from "./antigravity-protocol";
 import type { ImageGenerationOutcome, ProviderDispatchTarget, ProviderAdapter, ProviderDispatchContext, WebSearchOutcome, WebSearchResult } from "../../provider-contracts";
 import { providerBaseUrl } from "../../provider-metadata";
@@ -878,7 +879,7 @@ export function failoverAntigravityUrl(url: string, baseUrl: string): string | u
  * envelope `model`, while the Gemini `contents`/`tools`/`generationConfig`
  * ride inside `request` with Antigravity's `labels` telemetry.
  */
-function buildAntigravityEnvelope(
+export function buildAntigravityEnvelope(
   request: CanonicalRequest,
   projectId: string | undefined,
   wireModelId: string,
@@ -886,7 +887,13 @@ function buildAntigravityEnvelope(
   state: AntigravitySessionState,
   sessionSeed: string,
 ): Record<string, unknown> {
-  const geminiPayload = buildGeminiPayload(request);
+  // Tools first: a declaration whose real schema is nested under
+  // `parametersJsonSchema` (the spelling Cloud Code Assist sends) must be
+  // unwrapped *before* the shared Gemini builder, whose sanitizer has no entry
+  // for that key and would drop both the wrapper and the schema inside it —
+  // the tool would ship as `{"type":"object"}` with every property gone.
+  // Rewriting after the payload is built leaves nothing to recover.
+  const geminiPayload = buildGeminiPayload(normalizeAntigravityToolSchemas(request));
   const profile = getAntigravityModelWireProfile(wireModelId);
 
   const generationConfig = isRecord(geminiPayload["generationConfig"])

package/src/providers/integrations/buddy/buddy-catalog-shared.ts

@@ -65,6 +65,10 @@ const BUDDY_IMAGE_MODEL_IDS: readonly { id: string; endpoint: string; ctx: numbe
   { id: "gemini-3.1-flash-image", endpoint: "/chat/completions", ctx: 1_000_000, out: 64_000 },
   { id: "gpt-image-2", endpoint: "/chat/completions", ctx: 400_000, out: 128_000 },
   { id: "gpt-image-2.5-sunburst", endpoint: "/chat/completions", ctx: 400_000, out: 128_000 },
+  // Published by /v3/config only, tagged `text-to-image` + `image-to-image`.
+  // Upstream declares no token limits for it, so the roster floor is used
+  // rather than inventing a number the upstream never sent.
+  { id: "hy-image-3.5", endpoint: "/chat/completions", ctx: 1_000_000, out: 64_000 },
 ];
 
 /**
@@ -79,6 +83,11 @@ const BUDDY_IMAGE_MODEL_IDS: readonly { id: string; endpoint: string; ctx: numbe
  */
 const BUDDY_VIDEO_MODEL_IDS: readonly { id: string; endpoint: string; ctx: number; out: number }[] = [
   { id: "seedance-2.5", endpoint: "/videos/generations", ctx: 1_000_000, out: 128_000 },
+  // Published by /v3/config only, tagged `text-to-video` + `image-to-video`.
+  // Upstream declares capabilities in a `videoGeneration` block instead of
+  // token limits (720P/1080P/4K, 16:9/9:16/1:1, 3-15s, switchable audio,
+  // first/last-frame control), so the token columns carry the roster floor.
+  { id: "kling-video-v3", endpoint: "/videos/generations", ctx: 1_000_000, out: 128_000 },
 ];
 
 /**
@@ -92,6 +101,52 @@ export const BUDDY_IMAGE_MODEL_ID_SET: ReadonlySet<string> = new Set(
   BUDDY_IMAGE_MODEL_IDS.map((entry) => entry.id),
 );
 
+/**
+ * The CN realm's image-generation ids.
+ *
+ * Separate from {@link BUDDY_IMAGE_MODEL_IDS} because the realms do not share
+ * a roster: `hunyuan-image-alpha` is published by the CN `/v3/config` only, and
+ * the intl image ids are not served there. Sharing one list would either leak
+ * CN-only ids onto the international catalogs or force a realm check into
+ * every consumer.
+ *
+ * `hunyuan-image-alpha-edit` carries `image-to-image` and is deliberately NOT
+ * here: it is not in the CLI roster, so it is not a routable generation model.
+ */
+const BUDDY_CN_IMAGE_MODEL_IDS: readonly { id: string; ctx: number; out: number }[] = [
+  { id: "hunyuan-image-alpha", ctx: 1_000_000, out: 64_000 },
+];
+
+/** The CN analogue of {@link BUDDY_IMAGE_MODEL_ID_SET}. */
+export const BUDDY_CN_IMAGE_MODEL_ID_SET: ReadonlySet<string> = new Set(
+  BUDDY_CN_IMAGE_MODEL_IDS.map((entry) => entry.id),
+);
+
+/**
+ * Builds the CN image-generation rows for one buddy CN provider.
+ *
+ * Same shape as {@link makeBuddyImageModels}, scoped to the CN roster.
+ */
+export function makeBuddyCnImageModels(
+  providerId: string,
+  endpoint: string,
+): readonly ModelDefinition[] {
+  return BUDDY_CN_IMAGE_MODEL_IDS.map((entry) =>
+    defineModel({
+      id: entry.id,
+      providerId,
+      serviceKind: "imageGeneration",
+      wireFamily: "chat",
+      endpoint,
+      ctx: entry.ctx,
+      out: entry.out,
+      vision: true,
+      output: ["image"],
+      toolCall: false,
+    }),
+  );
+}
+
 /**
  * Ids the buddy facade refuses on a free plan.
  *
@@ -124,6 +179,10 @@ export const BUDDY_PRO_ONLY_MODEL_IDS: ReadonlySet<string> = new Set([
   "grok-4.6",
   "grok-4.7",
   "kimi-k3.1-pro-highspeed",
+  // The Opus rows: both are refused on free while Sonnet 4.6 at the same
+  // 1M window is served, so this is the tier rather than the size.
+  "claude-opus-4.6",
+  "claude-opus-4.7-1m",
 ]);
 
 /**
@@ -254,11 +313,19 @@ export function makeBuddyModel(
  * output ceilings), so it keeps its own table.
  */
 export const BUDDY_SHARED_RAW: readonly BuddyRawEntry[] = [
-  ["auto", "Auto", true, true, 168_000, null],
+  ["auto", "Auto", false, true, 176_000, 24_000],
+  // The three named tiers and `gpt-6-astra` are published by /v3/config and sit
+  // in the CLI roster, but had no static row: a client asking for
+  // `fast-model` resolved to nothing and the model was invisible. Added with
+  // the limits upstream declares for them.
+  ["fast-model", "Fast", true, true, 200_000, 32_000, true],
+  ["balanced-model", "Balanced", true, true, 256_000, 32_000, true],
+  ["primary-model", "Primary", true, true, 272_000, 72_000, true],
+  ["gpt-6-astra", "GPT-6 Astra", true, true, 1_000_000, 128_000],
   ["claude-opus-4.6", "Claude Opus 4.6", true, true, 200_000, 64_000],
   ["claude-opus-4.7-1m", "Claude Opus 4.7 1M", true, true, 1_000_000, 64_000],
   ["claude-sonnet-4.6", "Claude Sonnet 4.6", true, true, 200_000, 32_000],
-  ["deepseek-v4.1-flash", "DeepSeek V4.1 Flash", true, true, 1_000_000, 384_000],
+  ["deepseek-v4.1-flash", "DeepSeek V4.1 Flash", true, true, 1_000_000, 128_000],
   ["deepseek-v4.1-flash-sg", "DeepSeek V4.1 Flash SG", true, true, 1_000_000, 128_000],
   ["gemini-2.5-flash-image", "Gemini 2.5 Flash Image", true, true, 1_000_000, 64_000],
   ["gemini-3.0-pro-image", "Gemini 3.0 Pro Image", true, true, 1_000_000, 64_000],
@@ -267,23 +334,23 @@ export const BUDDY_SHARED_RAW: readonly BuddyRawEntry[] = [
   ["gemini-3.5-flash", "Gemini 3.5 Flash", true, true, 1_048_576, 65_536],
   ["gemini-3.8-flash", "Gemini 3.8 Flash", true, true, 1_000_000, 65_536, true],
   ["glm-5.1", "GLM-5.1", true, false, 200_000, 131_072],
-  ["glm-5.2", "GLM-5.2", true, false, 1_000_000, 131_072],
-  ["glm-5.3", "GLM-5.3", true, false, 1_000_000, 131_072],
-  ["glm-5.3-flash", "GLM-5.3 Flash", true, false, 1_000_000, 131_072],
+  ["glm-5.2", "GLM-5.2", true, true, 1_000_000, 48_000],
+  ["glm-5.3", "GLM-5.3", true, true, 1_000_000, 48_000],
+  ["glm-5.3-flash", "GLM-5.3 Flash", true, true, 1_000_000, 32_000],
   ["glm-5v-turbo", "GLM-5V Turbo", true, true, 200_000, 131_072],
   ["gpt-5.3-codex", "GPT-5.3 Codex", true, true, 400_000, 128_000],
-  ["gpt-5.4", "GPT-5.4", true, true, 1_050_000, 128_000],
-  ["gpt-5.5", "GPT-5.5", true, true, 1_050_000, 128_000],
-  ["gpt-5.6-luna", "GPT-5.6 Luna", true, true, 1_050_000, 128_000],
-  ["gpt-5.6-sol", "GPT-5.6 Sol", true, true, 1_050_000, 128_000],
-  ["gpt-5.6-terra", "GPT-5.6 Terra", true, true, 1_050_000, 128_000],
-  ["gpt-6-luna", "GPT-6 Luna", true, true, 1_050_000, 128_000],
+  ["gpt-5.4", "GPT-5.4", true, true, 272_000, 72_000],
+  ["gpt-5.5", "GPT-5.5", true, true, 1_000_000, 128_000],
+  ["gpt-5.6-luna", "GPT-5.6 Luna", true, true, 1_000_000, 128_000],
+  ["gpt-5.6-sol", "GPT-5.6 Sol", true, true, 1_000_000, 128_000],
+  ["gpt-5.6-terra", "GPT-5.6 Terra", true, true, 1_000_000, 128_000],
+  ["gpt-6-luna", "GPT-6 Luna", true, true, 1_000_000, 128_000],
   ["gpt-6-sol", "GPT-6 Sol", true, true, 1_000_000, 128_000, true],
-  ["gpt-6.1-sol", "GPT-6.1 Sol", true, true, 1_050_000, 128_000],
+  ["gpt-6.1-sol", "GPT-6.1 Sol", true, true, 1_000_000, 128_000],
   ["gpt-image-2", "GPT-Image-2", true, true, 400_000, 128_000],
   ["grok-4.6", "Grok 4.6", true, true, 500_000, 500_000],
-  ["grok-4.7", "Grok 4.7", true, true, 500_000, 500_000],
-  ["hy3", "Hy3", true, false, 192_000, 64_000, true],
+  ["grok-4.7", "Grok 4.7", true, true, 500_000, 128_000],
+  ["hy3", "Hy3", true, true, 192_000, 64_000, true],
   ["hy3-preview", "Hy3 Preview", true, false, 262_144, 64_000],
   ["hy4-preview", "Hy4 Preview", true, true, 1_000_000, 64_000, true],
   ["hy4-preview-f", "Hy4 Preview F", true, true, 1_000_000, 64_000, true],
@@ -291,9 +358,10 @@ export const BUDDY_SHARED_RAW: readonly BuddyRawEntry[] = [
   ["kimi-k2.6", "Kimi K2.6", true, false, 256_000, 262_144],
   ["kimi-k2.7", "Kimi K2.7", true, false, 256_000, 65_536],
   ["kimi-k2.8-preview", "Kimi K2.8 Preview", true, false, 1_048_576, 65_536],
-  ["kimi-k3", "Kimi K3", true, false, 1_048_576, 131_072],
-  ["kimi-k3.1-pro", "Kimi K3.1 Pro", true, true, 1_000_000, 64_000],
-  ["kimi-k3.1-pro-highspeed", "Kimi K3.1 Pro Highspeed", true, true, 1_000_000, 64_000],
+  ["kimi-k3", "Kimi K3", true, true, 1_000_000, 32_000],
+  ["kimi-k3.1-pro", "Kimi K3.1 Pro", true, true, 1_000_000, 32_000],
+  ["kimi-k3.1-pro-highspeed", "Kimi K3.1 Pro Highspeed", true, true, 1_000_000, 32_000],
   ["minimax-m3", "MiniMax-M3", true, false, 512_000, 512_000],
+  ["minimax-m3.1-flash", "MiniMax-M3.1 Flash", true, true, 1_000_000, 128_000],
   ["step-5-preview", "Step-5-Preview", true, true, 1_000_000, 64_000, true],
 ];