cartethyia 2.6.2 → 2.6.3

package/src/console/backup/store.ts

@@ -559,6 +559,7 @@ async function insertRows(
     readonly keyOf?: (row: BackupRow) => string;
     readonly conflictTarget?: readonly Column[];
     readonly ignoreConflicts?: boolean;
+    readonly tenantId?: string;
   } = {},
 ): Promise<number> {
   // Normalise rows up front: filter skips, drop empty-value rows (no
@@ -570,6 +571,7 @@ async function insertRows(
       continue;
     }
     const values = toValues(table, row);
+    if (options.tenantId !== undefined && "tenantId" in values) values.tenantId = options.tenantId;
     if (Object.keys(values).length === 0) continue;
     prepared.push(values);
   }
@@ -828,6 +830,7 @@ export async function applyRestore(
           : entry.rows;
       restored[tableName(table)] = await insertRows(scoped, table, rows, {
         ...(ownership.kind === "authored" ? { conflictTarget: ownership.keyColumns } : {}),
+        tenantId,
       });
     }
 
@@ -837,8 +840,12 @@ export async function applyRestore(
       const entry = validation.tables.get(table);
       if (entry === undefined) continue;
       if (table === telemetryEvents) {
+        // The payload rows are remapped to the restoring tenant before the
+        // idempotency filter runs, so the dedupe keys and the appended file
+        // rows are owned by the receiving tenant, not the backup's tenant.
+        const remapped = entry.rows.map((row) => ({ ...row, tenant_id: tenantId }));
         const existing = await existingEventFileKeys(db, tenantId, entry.rows);
-        const fresh = entry.rows.filter((row) => !existing.has(telemetryKey(row)));
+        const fresh = remapped.filter((row) => !existing.has(telemetryKey(row)));
         await appendRestoredEvents(fresh);
         restored[tableName(table)] = fresh.length;
         skipped[tableName(table)] = entry.rows.length - fresh.length;
@@ -850,11 +857,12 @@ export async function applyRestore(
             telemetryUsageTotals.entityId,
           ],
           ignoreConflicts: true,
+          tenantId,
         });
         restored[tableName(table)] = restoredCount;
         skipped[tableName(table)] = entry.rows.length - restoredCount;
       } else {
-        restored[tableName(table)] = await insertRows(scoped, table, entry.rows);
+        restored[tableName(table)] = await insertRows(scoped, table, entry.rows, { tenantId });
       }
     }
   });

package/src/providers/integrations/buddy/buddy-chat-shared.ts

@@ -308,6 +308,107 @@ function rewriteBlockedCodeField(message: Record<string, unknown>, field: string
   }
 }
 
+const BUDDY_ZWSP = "\u200b";
+
+function escapeBuddyRegexLiteral(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/**
+ * Builds a matcher that tolerates the zero-width spaces upstream interleaves
+ * between characters, so an identity template is still recognized after a
+ * normalizer has split it apart.
+ */
+function buddyTemplateSource(text: string): string {
+  const words = text
+    .split(" ")
+    .map((word) => [...word].map(escapeBuddyRegexLiteral).join(`${BUDDY_ZWSP}*`));
+  return words.join(`[\\s${BUDDY_ZWSP}]+`) + `${BUDDY_ZWSP}*`;
+}
+
+function buddyTemplatePattern(text: string): RegExp {
+  return new RegExp(`(?<!\\w)${buddyTemplateSource(text)}(?!\\w)`, "i");
+}
+
+// DeepSeek Harness (DSH) role identities. DSH is the harness behind WorkBuddy;
+// a history that still carries its self-description reads to the upstream as a
+// foreign channel, so the hardened client rewrites it back to the WorkBuddy
+// identity rather than forwarding a competing one.
+const DSH_CODING_PATTERN = new RegExp(
+  `(?<!\\w)${buddyTemplateSource("You are a coding agent powered by the")}` +
+    `[\\s${BUDDY_ZWSP}]+([^\\r\\n]{1,200}?)[\\s${BUDDY_ZWSP}]+` +
+    `${buddyTemplateSource("model")}(?!\\w)`,
+  "i",
+);
+const DSH_CHANNEL_IDENTITY_PATTERN = buddyTemplatePattern(
+  "You are an AI agent powered by DeepSeek Harness",
+);
+const DSH_MINIMAL_PATTERN = buddyTemplatePattern("You are a helpful software engineer assistant");
+const DSH_DIRECT_PATTERN = buddyTemplatePattern("You are DeepSeek Harness");
+const DSH_WEB_GUI_PATTERN = buddyTemplatePattern("DeepSeek Harness Web GUI");
+
+/** The identity DSH role prompts are rewritten to; matches the donor gateway. */
+const DSH_WORKBUDDY_IDENTITY = "You are WorkBuddy, a powerful AI assistant";
+
+/**
+ * Rewrites DeepSeek Harness role identities in one message's text back to the
+ * WorkBuddy identity. Port of the donor gateway's always-on
+ * `desensitize_channel_body`, scoped to text the wire actually carries.
+ *
+ * This normalizes a replayed history (or a surviving system turn) that still
+ * claims the DSH harness, so a WorkBuddy request never advertises a competing
+ * channel identity upstream. The coding persona keeps the model it named:
+ * "You are a coding agent powered by the X model" becomes the WorkBuddy
+ * identity plus "powered by the X model".
+ */
+export function scrubBuddyChannelIdentityText(text: string): string {
+  if (!text) return text;
+  const withCodingPersona = text.replace(
+    DSH_CODING_PATTERN,
+    (_match, model: string) =>
+      `${DSH_WORKBUDDY_IDENTITY}. This conversation is powered by the ${model.trim()} model`,
+  );
+  return withCodingPersona
+    .replace(DSH_CHANNEL_IDENTITY_PATTERN, DSH_WORKBUDDY_IDENTITY)
+    .replace(DSH_MINIMAL_PATTERN, DSH_WORKBUDDY_IDENTITY)
+    .replace(DSH_DIRECT_PATTERN, DSH_WORKBUDDY_IDENTITY)
+    .replace(DSH_WEB_GUI_PATTERN, "WorkBuddy Web GUI");
+}
+
+function scrubBuddyMessageText(message: Record<string, unknown>, field: string): void {
+  const value = message[field];
+  if (typeof value === "string") {
+    const scrubbed = scrubBuddyChannelIdentityText(value);
+    if (scrubbed !== value) message[field] = scrubbed;
+    return;
+  }
+  if (!Array.isArray(value)) return;
+  for (const part of value) {
+    if (!isRecord(part)) continue;
+    const text = part["text"];
+    if (typeof text === "string") {
+      const scrubbed = scrubBuddyChannelIdentityText(text);
+      if (scrubbed !== text) part["text"] = scrubbed;
+    }
+  }
+}
+
+/**
+ * Applies the DSH identity scrub across a buddy conversation: every
+ * `system`/`developer`/`assistant` turn's text and `reasoning_content` is
+ * normalized, so a replayed harness history cannot carry a competing channel
+ * identity upstream.
+ */
+export function scrubBuddyChannelIdentity(messages: Array<Record<string, unknown>>): void {
+  for (const message of messages) {
+    if (!isRecord(message)) continue;
+    const role = message["role"];
+    if (role !== "system" && role !== "developer" && role !== "assistant") continue;
+    scrubBuddyMessageText(message, "content");
+    scrubBuddyMessageText(message, "reasoning_content");
+  }
+}
+
 /**
  * Payload prefix shared by the buddy pre-payload hooks: force `stream=true`,
  * apply the provider's DeepSeek thinking contract, opt `reasoning_summary` in
@@ -370,6 +471,10 @@ export function buddyPrePayloadCommon(
     repackBuddyToolResultBlocks(arr);
     cleanupBuddyOrphanToolPairs(arr);
     coalesceConsecutiveAssistantMessages(arr);
+    // Normalize a replayed harness history before the blocked-code rewrite
+    // below: DSH role identities are replaced with the WorkBuddy identity, so
+    // a WorkBuddy-family request never forwards a competing channel identity.
+    scrubBuddyChannelIdentity(arr);
     // After every merge: a quoted `11128` in any surviving text blocks the
     // whole request, and the merges above are what produce the final text.
     rewriteBuddyBlockedCode(payload);

package/src/providers/integrations/buddy/buddy-cli-headers.ts

@@ -2,43 +2,47 @@
  * The header family only the CLI identity sends.
  *
  * Everything here comes from the two reference gateways, which agree: the
- * desktop product sends conversation/tracing headers and browser transport,
- * while the CLI sends the agent envelope plus the OpenAI Node SDK fingerprint
- * and no browser headers at all. A request carrying both halves is a hybrid no
- * real client produces, which is what risk control keys on.
+ * desktop product sends conversation/tracing headers and a device token, while
+ * the CLI sends the agent envelope plus the OpenAI Node SDK fingerprint. The
+ * CLI still drops the browser *transport* headers (`origin`, `referer`,
+ * `accept-language`) and the device token, but keeps the request-shape markers
+ * (`x-requested-with`, `x-codebuddy-request`) the reference sends on every call
+ * regardless of transport — see the CLI branches in each provider's
+ * `*-shared.ts`.
  *
- * Two references, two fingerprints: the hub derives OS/arch and a Node version
- * from its own host, and codebuddy2api pins a fixed Linux/x64/v24.21.0 set.
- * Neither can be right for every deployment, so the values here follow the
- * host this gateway actually runs on — they are a fingerprint of the process,
- * not a claim about a remote machine.
+ * The SDK fingerprint is pinned, not host-derived. Both references pin a fixed
+ * set (codebuddy2api pins Linux/x64/v24.21.0); this gateway pins the macOS set
+ * instead, so every CLI dispatch presents one consistent client fingerprint no
+ * matter which machine the gateway runs on. A host-derived fingerprint would
+ * advertise whatever OS the process happens to run under — a value no upstream
+ * risk model has seen for this client brand, and an easy outlier to key on.
  */
 
 /** OpenAI Node SDK 6.25.0 `x-stainless-*` fingerprint; both references agree. */
 const STAINLESS_PACKAGE_VERSION = "6.25.0";
 
-function hostOs(): string {
-  return process.platform === "win32" ? "Windows" : process.platform === "darwin" ? "MacOS" : "Linux";
-}
-
-function hostArch(): string {
-  return process.arch === "arm64" || process.arch === "ia32" ? process.arch : "x64";
-}
+/**
+ * The pinned Node runtime the fingerprint claims. Held constant across
+ * dispatches: a drifting `process.version` would advertise a different Node
+ * build per deployment, which is not what one installed client looks like.
+ */
+const STAINLESS_RUNTIME_VERSION = "v24.21.0";
 
 /**
  * The SDK fingerprint headers.
  *
  * `x-stainless-timeout` is in the hub only and `x-stainless-retry-count` is in
- * both; the SDK sends both, so both go out.
+ * both; the SDK sends both, so both go out. The OS/arch pair is the pinned
+ * macOS fingerprint rather than this process's host.
  */
 export function buddyStainlessHeaders(): Record<string, string> {
   return {
     "x-stainless-lang": "js",
     "x-stainless-package-version": STAINLESS_PACKAGE_VERSION,
-    "x-stainless-os": hostOs(),
-    "x-stainless-arch": hostArch(),
+    "x-stainless-os": "MacOS",
+    "x-stainless-arch": "x64",
     "x-stainless-runtime": "node",
-    "x-stainless-runtime-version": process.version,
+    "x-stainless-runtime-version": STAINLESS_RUNTIME_VERSION,
     "x-stainless-retry-count": "0",
     "x-stainless-timeout": "1200",
   };

package/src/providers/integrations/buddy/buddy-conversation-headers.ts

@@ -34,6 +34,11 @@ function newMessageId(): string {
   return crypto.randomUUID().replaceAll("-", "");
 }
 
+/** Renders a 32-char hex id as a dashed UUID (`8-4-4-4-12`). */
+function toUuidHex(hex: string): string {
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+
 /** True when `value` is a valid B3 trace id: 16 or 32 hex characters. */
 function isValidTraceId(value: string): boolean {
   if (value.length !== 16 && value.length !== 32) return false;
@@ -53,6 +58,18 @@ export interface BuddyConversationIds {
   readonly conversationRequestId?: string | undefined;
   /** Inbound trace id to pass through; falls back to the conversation request id. */
   readonly traceId?: string | undefined;
+  /**
+   * Wire format for the two message-scoped ids (`x-conversation-message-id`,
+   * `x-request-id`).
+   *
+   * The reference emits these as dashed UUIDs on the WorkBuddy desktop product
+   * and as 32-hex on CLI traffic (`build_attempt_headers` converts only the
+   * message/request ids, and only for the WorkBuddy profiles). The turn
+   * aggregation key (`x-conversation-request-id` / `x-root-request-id`) and the
+   * B3/W3C trace ids stay hex in both styles, because B3's spec accepts only
+   * hex. Default `"hex"`.
+   */
+  readonly messageIdStyle?: "hex" | "uuid" | undefined;
 }
 
 /**
@@ -71,14 +88,17 @@ export function buddyConversationHeaders(
       ? ids.conversationRequestId.trim()
       : newMessageId();
   const messageId = newMessageId();
+  // The message-scoped ids may render as a dashed UUID (WorkBuddy desktop) or
+  // as 32-hex (CLI); the raw hex is still what the B3/W3C trace ids derive from.
+  const messageHeaderValue = ids.messageIdStyle === "uuid" ? toUuidHex(messageId) : messageId;
   const traceId =
     ids.traceId && ids.traceId.trim().length > 0 ? ids.traceId.trim() : conversationRequestId;
   const b3TraceId = isValidTraceId(conversationRequestId) ? conversationRequestId : messageId;
 
   const headers: Record<string, string> = {
     "x-conversation-request-id": conversationRequestId,
-    "x-conversation-message-id": messageId,
-    "x-request-id": messageId,
+    "x-conversation-message-id": messageHeaderValue,
+    "x-request-id": messageHeaderValue,
     "x-root-request-id": conversationRequestId,
     "x-trace-id": traceId,
     // W3C trace context alongside the B3 set below: the upstream reads both,

package/src/providers/integrations/buddy/codebuddy/provider.ts

@@ -48,24 +48,24 @@ export const CODEBUDDY_BASE_URL = providerBaseUrl("cb");
 /**
  * Leading system turn for this variant.
  *
- * The upstream validates that the wire *opens* with a `system` turn (code
- * `11128`) but does not check its text — the CN variant installs a plain
- * engineering-assistant sentence in the same slot and the gateway accepts it.
- * So this text is a product choice rather than a wire contract, and the
- * previous vendor-branded line ("You are CodeBuddy Code.") made every request
- * claim an identity the caller never chose, while also discarding whatever
- * system prompt the caller actually sent.
+ * The wire contract is that the request *opens* with a `system` turn (code
+ * `11128`); the gateway replaces any caller `system`/`developer` turn with this
+ * fixed prompt. The text is the CodeBuddy CLI's own leading prompt — the same
+ * one the reference client (and the donor gateway's `prepend` prompt mode)
+ * sends — so a proxied request is byte-faithful to an official client rather
+ * than a neutral stand-in.
  *
- * The prompt is therefore a neutral assistant identity with an explicit
- * persona: pragmatic, direct, and honest — no sycophancy, no hedging, no
- * invented certainty.
+ * Keeping the official identity is forward-compatible: the upstream is not
+ * observed to validate this text today, but a proxy that claims the real
+ * client's identity cannot be caught out if it starts to. A previous neutral
+ * persona ("You are a pragmatic and direct software engineering assistant…")
+ * worked, but diverged from every request the official CLI emits.
  */
 export const CODEBUDDY_SYSTEM_PROMPT =
-  "You are a pragmatic and direct software engineering assistant. " +
-  "Be honest and truthful: state what you know, say plainly when you are unsure " +
-  "or do not know, and never claim to have done something you have not done. " +
-  "Prefer concrete answers over filler, and say so when a request is ambiguous " +
-  "instead of guessing silently.";
+  "You are CodeBuddy Code.\n\n" +
+  "You are an interactive CLI tool that helps users with software engineering tasks. " +
+  "Use the instructions below and the tools available to you to assist the user. " +
+  "Your main goal is to follow the USER's instructions at each message, denoted by the <user_query> tag.";
 
 function codeBuddyIntlPrePayload(
   payload: Record<string, unknown>,

package/src/providers/integrations/buddy/codebuddy/shared.ts

@@ -41,11 +41,11 @@ export async function codebuddyHeaders(
   });
   if (resolveBuddyIdentity(context, cliIdentity) === "cli") {
     return {
-      // The CLI sends `Accept: application/json` and no device token. The
-      // browser-shaped pair (`X-Requested-With`, `x-codebuddy-request`) stays
-      // off this branch: a request carrying both halves is a hybrid no real
-      // client produces, and that is a fidelity choice, not a requirement —
-      // the live API answers either way.
+      // The CLI sends `Accept: application/json` and no device token. It keeps
+      // the request-shape markers (`X-Requested-With`, `X-CodeBuddy-Request`)
+      // the reference sends on every call regardless of transport, but drops
+      // the browser *transport* header (`accept: text/event-stream`) — so the
+      // identity is still CLI, not the desktop hybrid.
       accept: "application/json",
       "User-Agent": `CLI/${getCodeBuddyVersion()} CodeBuddy/${getCodeBuddyVersion()}`,
       "X-Product": "SaaS",
@@ -53,6 +53,8 @@ export async function codebuddyHeaders(
       "X-IDE-Name": "CLI",
       "X-IDE-Version": getCodeBuddyVersion(),
       "X-Domain": codebuddyDomain(variant),
+      "x-requested-with": "XMLHttpRequest",
+      "x-codebuddy-request": "1",
       // The conversation purpose the reference client states. Not required —
       // verified against the live API that a request succeeds without it — but
       // it is part of the client's real request, and matching the client is the

package/src/providers/integrations/buddy/workbuddy/provider.ts

@@ -49,20 +49,21 @@ export const WORKBUDDY_BASE_URL = providerBaseUrl("workbuddy");
 /**
  * Leading system turn for this variant.
  *
- * The upstream does validate the leading system turn's *text*, not just that
- * the wire opens with one: sending caller text in its place answers
- * `400 · 11128 "Illegal API invocation from an unapproved channel"` on
- * CodeBuddy, which treats that prompt as the calling channel's identity. So
- * this prompt is a wire contract, not merely a product choice — see the
- * sibling in `codebuddy.ts`. The previous line named the vendor product, which
- * made every request claim an identity the caller never chose.
+ * The upstream validates that the wire opens with a `system` turn and treats
+ * that prompt as the calling channel's identity: forwarding caller text in its
+ * place answers `400 · 11128 "Illegal API invocation from an unapproved
+ * channel"`. So this prompt is a wire contract, not merely a product choice —
+ * see the sibling in `codebuddy.ts`.
+ *
+ * The text is WorkBuddy's own leading prompt, matching what the official client
+ * (and the donor gateway's `prepend` prompt mode) sends, so a proxied request
+ * carries the real client's identity instead of a neutral stand-in. A previous
+ * neutral persona was accepted but diverged from every request the official
+ * desktop client emits.
  */
 export const WORKBUDDY_SYSTEM_PROMPT =
-  "You are a pragmatic and direct software engineering assistant. " +
-  "Be honest and truthful: state what you know, say plainly when you are unsure " +
-  "or do not know, and never claim to have done something you have not done. " +
-  "Prefer concrete answers over filler, and say so when a request is ambiguous " +
-  "instead of guessing silently.";
+  "You are WorkBuddy, a powerful AI assistant.\n\n" +
+  "Your main goal is to follow the USER's instructions at each message, denoted by the <user_query> tag.";
 
 /**
  * Reconstructs generic function declarations when a later tool-history turn

package/src/providers/integrations/buddy/workbuddy/shared.ts

@@ -69,19 +69,29 @@ export async function workbuddyHeaders(
   clientVersion = getWorkBuddyClientVersion(),
   cliIdentity?: boolean,
 ): Promise<Record<string, string>> {
+  const identity = resolveBuddyIdentity(context, cliIdentity);
   const conversation = buddyConversationHeaders({
     ...(resolveInboundSessionId(context, request) === undefined
       ? {}
       : { conversationId: resolveInboundSessionId(context, request) }),
+    // The reference emits dashed-UUID message/request ids on the WorkBuddy
+    // desktop product and 32-hex on CLI traffic (build_attempt_headers converts
+    // only the message/request ids, and only for the WorkBuddy profiles).
+    messageIdStyle: identity === "desktop" ? "uuid" : "hex",
   });
   const accountId = context?.credential.account_id;
-  if (resolveBuddyIdentity(context, cliIdentity) === "cli") {
-    // The reference CLI: issued by the OpenAI Node SDK, so no browser header
-    // and no device token, and the machine/session device pair does not
-    // exist — only `X-User-Id`, which is `anonymous` without a uid.
+  if (identity === "cli") {
+    // The reference CLI: issued by the OpenAI Node SDK, so no browser
+    // *transport* header (origin/referer/accept-language) and no device token,
+    // and the machine/session device pair does not exist — only `X-User-Id`,
+    // which is `anonymous` without a uid. It keeps the request-shape markers
+    // (`x-requested-with`, `x-codebuddy-request`) the reference sends on every
+    // call regardless of transport.
     return {
       accept: "application/json",
       "user-agent": `CLI/${getWorkBuddyCliVersion()} CodeBuddy/${getWorkBuddyCliVersion()}`,
+      "x-requested-with": "XMLHttpRequest",
+      "x-codebuddy-request": "1",
       "x-domain": domain,
       "x-agent-purpose": "conversation",
       "x-ide-name": "CLI",