cartethyia 2.7.0 → 2.7.1

package/src/providers/integrations/qoder/qoder.ts

@@ -1,1458 +1,1641 @@
-// Factory-blocked (Phase C4): PAT-to-jobToken session handshake, COSY
-// AES/RSA request signing, alphabet-scrambled binary body, enveloped SSE
-// frames — session/crypto protocol outside factory reach; stays bespoke.
-import { constants, createCipheriv, createHash, publicEncrypt, randomUUID } from "node:crypto";
-import {
-  classifyUpstreamError,
-  extractUpstreamMessage,
-  isUpstreamQueued,
-  mapUpstreamHttpError,
-  queueRetryAfterMs,
-  upstreamErrorIdentifier,
-} from "../../../transport/failure-policy";
-import { GatewayError } from "../../../protocol/gateway-error";
-import type {
-  CanonicalEvent,
-  CanonicalRequest,
-  CanonicalStopReason,
-  ContentPart,
-  ToolChoice,
-  ToolDefinition,
-} from "../../../protocol/canonical-model";
-import { toolResultParts } from "../../../protocol/canonical-model";
-import { decodeSseEvents } from "../../../protocol/sse-decoder";
-import { usageFromProvider, readReasoningText } from "../../provider-usage";
-import { readCredentialSecret, type ProviderDispatchTarget, type ProviderAdapter, type ProviderDispatchContext, type ProviderId } from "../../provider-contracts";
-import type { ModelDefinition } from "../../provider-model-definition";
-import { parseQoderOAuthState } from "./qoder-oauth";
-import { getQoderVersion } from "../../operations/client-versions";
-import { abortGatewayError, createUpstreamDeadlineLifecycle } from "../../operations/upstream-deadline";
-import { qoderMachineOs } from "../../operations/cli-platform";
-import { qoderGatewayCandidates, QODER_CHAT_PATH, QODER_REALMS, type QoderRealm } from "./qoder-realm";
-import { QODER_CN_MODEL_CONFIGS, QODER_INTL_MODEL_CONFIGS, QODER_INTL_MODELS } from "./qoder-catalog";
-import { isQoderVirtualModel, qoderDispatchModelId } from "./qoder-virtual";
-
-interface QoderModeProfile {
-  readonly chatUrl: string;
-  readonly businessProduct: string;
-  readonly businessType: string;
-  readonly businessVersion: string;
-  readonly cosyScene: string;
-  readonly mirrorTopLevelSystem: boolean;
-  readonly sendBusinessHeaders: boolean;
-  readonly sendModelSourceHeaders: boolean;
-  readonly emptyAliyunUserType: boolean;
-}
-
-export const MODERN_PROFILE: QoderModeProfile = {
-  chatUrl: "https://api2.qoder.sh/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common&Encode=1",
-  businessProduct: "cli",
-  businessType: "agent",
-  businessVersion: "1.0.22",
-  cosyScene: "assistant",
-  mirrorTopLevelSystem: true,
-  sendBusinessHeaders: true,
-  sendModelSourceHeaders: true,
-  emptyAliyunUserType: true,
-};
-
-const QODER_PROVIDER_ID = "qoder" as const;
-
-export const QODER_MODEL_CONFIGS: Record<
-  string,
-  { id: string; display_name: string; max_input_tokens: number; max_output_tokens?: number; is_vl: boolean; is_reasoning: boolean; source?: string }
-> = {
-  auto: { id: "auto", display_name: "Auto", max_input_tokens: 180000, is_vl: true, is_reasoning: false },
-  ultimate: { id: "ultimate", display_name: "Ultimate", max_input_tokens: 180000, is_vl: true, is_reasoning: true },
-  performance: { id: "performance", display_name: "Performance", max_input_tokens: 272000, is_vl: true, is_reasoning: false },
-  efficient: { id: "efficient", display_name: "Efficient", max_input_tokens: 180000, is_vl: true, is_reasoning: false },
-  lite: { id: "lite", display_name: "Lite", max_input_tokens: 180000, is_vl: false, is_reasoning: true },
-  qmodel: { id: "qmodel", display_name: "Qwen 3.6 Plus", max_input_tokens: 180000, is_vl: true, is_reasoning: false },
-  qmodel_latest: { id: "qmodel_latest", display_name: "Qwen 3.7 Max", max_input_tokens: 1000000, is_vl: true, is_reasoning: false },
-  qmodel_preview: { id: "qmodel_preview", display_name: "Qwen 3.8 Max", max_input_tokens: 1000000, is_vl: true, is_reasoning: false },
-  dmodel: { id: "dmodel", display_name: "DeepSeek V4 Pro", max_input_tokens: 180000, is_vl: true, is_reasoning: true },
-  dfmodel: { id: "dfmodel", display_name: "DeepSeek V4 Flash", max_input_tokens: 180000, is_vl: true, is_reasoning: true },
-  gm51model: { id: "gm51model", display_name: "GLM 5.1", max_input_tokens: 180000, is_vl: true, is_reasoning: true },
-  kmodel: { id: "kmodel", display_name: "Kimi K2.6", max_input_tokens: 256000, is_vl: true, is_reasoning: false },
-  mmodel: { id: "mmodel", display_name: "MiniMax M2.7", max_input_tokens: 180000, is_vl: true, is_reasoning: false },
-  kmodel_latest: { id: "kmodel_latest", display_name: "Kimi K2.7 Latest", max_input_tokens: 256000, is_vl: true, is_reasoning: false },
-};
-
-const QODER_APPCODE = "cosy";
-const QODER_SIG_SECRET = "d2FyLCB3YXIgbmV2ZXIgY2hhbmdlcw==";
-/**
- * Where a PAT is exchanged for a short-lived job token, per realm.
- *
- * The job token is realm-bound: one minted on the global host answers "Login
- * expired" on the China gateway. Exchanging against the wrong host therefore
- * looks like a dead credential rather than a routing bug, which is why the
- * URL is derived from the realm table instead of being one constant.
- *
- * `intl` keeps its historical `center.qoder.sh` v3 endpoint. `cn` uses the
- * openapi host the donor's `PATH_JOB_EXCHANGE` describes; if that path is
- * ever wrong for CN, the failure surfaces as a 401/403 on exchange, not as a
- * silently misrouted request.
- */
-const QODER_JOB_TOKEN_URL = "https://center.qoder.sh/algo/api/v3/user/jobToken?Encode=1";
-function qoderJobTokenUrl(realm: QoderRealm): string {
-  return realm === "cn"
-    ? `${QODER_REALMS.cn.openapi}/api/v1/jobToken/exchange`
-    : QODER_JOB_TOKEN_URL;
-}
-const QODER_STANDARD_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-const QODER_ALPHABET = "_doRTgHZBKcGVjlvpC,@aFSx#DPuNJme&i*MzLOEn)sUrthbf%Y^w.(kIQyXqWA!";
-const QODER_RSA_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
-MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA8iMH5c02LilrsERw9t6Pv5Nc
-4k6Pz1EaDicBMpdpxKduSZu5OANqUq8er4GM95omAGIOPOh+Nx0spthYA2BqGz+l
-6HRkPJ7S236FZz73In/KVuLnwI8JJ2CbuJap8kvheCCZpmAWpb/cPx/3Vr/J6I17
-XcW+ML9FoCI6AOvOzwIDAQAB
------END PUBLIC KEY-----`;
-
-export interface QoderAuth {
-  userId: string;
-  userName: string;
-  userType: string;
-  securityOauthToken: string;
-  refreshToken: string;
-  machineId: string;
-}
-interface QoderModelConfig {
-  id: string;
-  display_name: string;
-  max_input_tokens: number;
-  max_output_tokens?: number;
-  is_vl: boolean;
-  is_reasoning: boolean;
-  source?: string;
-}
-
-
-function qoderMd5(value: string | Uint8Array): string {
-  return createHash("md5").update(value).digest("hex");
-}
-function qoderPathSignature(url: string): string {
-  const path = new URL(url).pathname;
-  return path.startsWith("/algo") ? path.slice(5) : path;
-}
-
-const QODER_MACHINE_ID_TTL_MS = 60 * 60 * 1000;
-const QODER_MAX_MACHINE_IDS = 1_024;
-const qoderMachineIds = new Map<string, { id: string; expiresAt: number }>();
-/**
- * A PAT (`pt-...`) must be exchanged for a short-lived job token before it
- * can sign COSY requests. Device tokens (`dt-...`) from OAuth login and job
- * tokens (`jt-...`) are used directly.
- */
-export function isQoderPat(secret: string): boolean {
-  return secret.startsWith("pt-");
-}
-
-/**
- * Stable per-account machine id for OAuth dispatches. Derived from the
- * account id (not minted per request) so pooled accounts keep one device
- * fingerprint across restarts instead of looking like a new device every
- * time, while staying distinct per account.
- */
-export function qoderMachineIdForAccount(accountId: string): string {
-  const hex = createHash("sha256").update(`qoder-machine-v1:${accountId}`).digest("hex");
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
-}
-
-/**
- * Builds dispatch auth from an OAuth device token. The token is used
- * directly as the COSY identity's oauth token; the user id and machine id
- * come from the `auth_state` the login persisted. Fails closed with a
- * reconnect prompt when the identity is absent (e.g. an account created
- * before `auth_state` existed) instead of signing with a guessed id.
- */
-export function qoderOAuthAuth(
-  secret: string,
-  authState: unknown,
-  accountId: string | undefined,
-): QoderAuth {
-  const state = parseQoderOAuthState(authState);
-  if (state === undefined || !state.userId) {
-    throw new GatewayError(
-      "authentication_failed",
-      401,
-      "Qoder OAuth account is missing its user identity; sign in again",
-    );
-  }
-  return {
-    userId: state.userId,
-    userName: "",
-    userType: "personal_standard",
-    securityOauthToken: secret,
-    refreshToken: "",
-    machineId: state.machineId || (accountId ? qoderMachineIdForAccount(accountId) : randomUUID()),
-  };
-}
-
-function qoderMachineIdFromPat(pat: string): string {
-  const key = createHash("sha256").update(pat).digest("hex");
-  const now = Date.now();
-  const existing = qoderMachineIds.get(key);
-  if (existing && existing.expiresAt > now) return existing.id;
-  const id = randomUUID();
-  qoderMachineIds.delete(key);
-  qoderMachineIds.set(key, { id, expiresAt: now + QODER_MACHINE_ID_TTL_MS });
-  for (const [candidate, value] of qoderMachineIds) {
-    if (value.expiresAt <= now) qoderMachineIds.delete(candidate);
-  }
-  while (qoderMachineIds.size > QODER_MAX_MACHINE_IDS) {
-    const oldest = qoderMachineIds.keys().next();
-    if (oldest.done) break;
-    qoderMachineIds.delete(oldest.value);
-  }
-  return id;
-}
-
-function qoderStaticHeaders(machineId: string, version = getQoderVersion()): Record<string, string> {
-  const date = new Date().toUTCString();
-  return {
-    "cosy-machinetoken": machineId,
-    "cosy-machinetype": "5",
-    "cosy-machineid": machineId,
-    "cosy-clienttype": "5",
-    "cosy-version": version,
-    "login-version": "v2",
-    appcode: QODER_APPCODE,
-    accept: "application/json",
-    "accept-encoding": "identity",
-    date,
-    signature: qoderMd5(`${QODER_APPCODE}&${QODER_SIG_SECRET}&${date}`),
-    "content-type": "application/json",
-    "user-agent": "Go-http-client/2.0",
-  };
-}
-
-function transformQoderBody(plaintext: string): Uint8Array {
-  const base64 = Buffer.from(plaintext).toString("base64");
-  const third = Math.floor(base64.length / 3);
-  const reordered = base64.slice(base64.length - third) + base64.slice(third, base64.length - third) + base64.slice(0, third);
-  let encoded = "";
-  for (const char of reordered) {
-    if (char === "=") encoded += "$";
-    else encoded += QODER_ALPHABET[QODER_STANDARD_ALPHABET.indexOf(char)] ?? char;
-  }
-  return Buffer.from(encoded, "latin1");
-}
-
-function qoderBuildCosyHeaders(
-  body: Uint8Array,
-  url: string,
-  auth: QoderAuth,
-  version = getQoderVersion(),
-): Record<string, string> {
-  const key = randomUUID().replaceAll("-", "").slice(0, 16);
-  const identity = JSON.stringify({
-    name: auth.userName,
-    aid: auth.userId,
-    uid: auth.userId,
-    yx_uid: "",
-    organization_id: "",
-    organization_name: "",
-    user_type: auth.userType,
-    security_oauth_token: auth.securityOauthToken,
-    refresh_token: auth.refreshToken,
-  });
-  const cipher = createCipheriv("aes-128-cbc", Buffer.from(key), Buffer.from(key));
-  const info = Buffer.concat([cipher.update(identity), cipher.final()]).toString("base64");
-  const cosyKey = publicEncrypt({ key: QODER_RSA_PUBLIC_KEY, padding: constants.RSA_PKCS1_PADDING }, Buffer.from(key)).toString("base64");
-  const payload = Buffer.from(
-    JSON.stringify({ version: "v1", requestId: randomUUID(), info, cosyVersion: version, ideVersion: "" }),
-  ).toString("base64");
-  const date = String(Math.floor(Date.now() / 1000));
-  const signature = qoderMd5(`${payload}\n${cosyKey}\n${date}\n${Buffer.from(body).toString("latin1")}\n${qoderPathSignature(url)}`);
-  return {
-    authorization: `Bearer COSY.${payload}.${signature}`,
-    "cosy-data-policy": "agree",
-    "cosy-machinetype": "5",
-    "cosy-machineos": qoderMachineOs(),
-    "cosy-clienttype": "5",
-    "cosy-date": date,
-    "cosy-user": auth.userId,
-    "cosy-key": cosyKey,
-    "cosy-bodyhash": qoderMd5(body),
-    "cosy-bodylength": String(body.byteLength),
-    "cosy-sigpath": qoderPathSignature(url),
-    "cosy-organization-id": "",
-    "cosy-organization-tags": "",
-    "x-request-id": randomUUID(),
-    ...(MODERN_PROFILE.sendBusinessHeaders
-      ? {
-          "cosy-business-product": MODERN_PROFILE.businessProduct,
-          "cosy-business-type": MODERN_PROFILE.businessType,
-          "cosy-business-version": version,
-          "cosy-scene": MODERN_PROFILE.cosyScene,
-        }
-      : {}),
-    "cosy-version": version,
-    "login-version": "v2",
-    appcode: QODER_APPCODE,
-    accept: "application/json",
-    "accept-encoding": "identity",
-    date: new Date().toUTCString(),
-    signature: qoderMd5(`${QODER_APPCODE}&${QODER_SIG_SECRET}&${new Date().toUTCString()}`),
-    "content-type": "application/json",
-    "user-agent": "Go-http-client/2.0",
-  };
-}
-
-type QoderFetcher = (url: string, init: RequestInit) => Promise<Response>;
-
-async function exchangeQoderPat(
-  pat: string,
-  signal: AbortSignal,
-  fetcher: QoderFetcher,
-  version = getQoderVersion(),
-  realm: QoderRealm = "intl",
-): Promise<QoderAuth> {
-  const machineId = qoderMachineIdFromPat(pat);
-  const encodedBody = transformQoderBody(JSON.stringify({ payload: JSON.stringify({ personalToken: pat, securityOauthToken: "", refreshToken: "", needRefresh: false, authInfo: {} }), encodeVersion: "1" }));
-  const response = await fetcher(qoderJobTokenUrl(realm), { method: "POST", headers: qoderStaticHeaders(machineId, version), body: encodedBody as unknown as BodyInit, signal });
-  if (!response.ok) throw await mapUpstreamHttpError(response, "qoder");
-  let responseBody: unknown;
-  try {
-    responseBody = await response.json();
-  } catch {
-    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned invalid JSON", {}, "upstream");
-  }
-  if (typeof responseBody !== "object" || responseBody === null || Array.isArray(responseBody)) {
-    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned unexpected response", {}, "upstream");
-  }
-  const rec = responseBody as Record<string, unknown>;
-  if (typeof rec["id"] !== "string" || typeof rec["securityOauthToken"] !== "string") {
-    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned incomplete credentials", {}, "upstream");
-  }
-  return {
-    userId: rec["id"] as string,
-    userName: typeof rec["name"] === "string" ? (rec["name"] as string) : "",
-    userType: typeof rec["userType"] === "string" ? (rec["userType"] as string) : "personal_standard",
-    securityOauthToken: rec["securityOauthToken"] as string,
-    refreshToken: typeof rec["refreshToken"] === "string" ? (rec["refreshToken"] as string) : "",
-    machineId,
-  };
-}
-
-async function callQoder(
-  url: string,
-  body: Record<string, unknown>,
-  modelId: string,
-  auth: QoderAuth,
-  signal: AbortSignal,
-  fetcher: QoderFetcher,
-  version = getQoderVersion(),
-): Promise<Response> {
-  const encoded = transformQoderBody(JSON.stringify(body));
-  const modelConfig = (body["model_config"] as Record<string, unknown> | null) ?? null;
-  return fetcher(url, {
-    method: "POST",
-    headers: {
-      ...qoderBuildCosyHeaders(encoded, url, auth, version),
-      ...(MODERN_PROFILE.sendModelSourceHeaders
-        ? { "x-model-key": modelId, "x-model-source": typeof modelConfig?.["source"] === "string" ? (modelConfig["source"] as string) : "system" }
-        : {}),
-      Accept: "text/event-stream",
-      "Cache-Control": "no-cache",
-      "Accept-Encoding": "identity",
-    },
-    body: encoded as unknown as BodyInit,
-    signal,
-  });
-}
-
-/**
- * The human-readable text out of a Qoder error envelope.
- *
- * The envelope is Qoder's own wrapper around the stream, and it does not use
- * one field for the message: the text has been seen as a nested `error`
- * object, a bare string `body`, and a top-level `message`/`msg`. The canonical
- * extractor covers the structured shapes; a string body and the top-level
- * fields cover the rest. Whatever survives is bounded the same way an upstream
- * message is, so a verbose envelope cannot blow up the public error line.
- */
-function qoderEnvelopeMessage(rec: Record<string, unknown>): string {
-  const structured = extractUpstreamMessage(rec["body"]);
-  if (structured.length > 0) return structured;
-  if (typeof rec["body"] === "string" && rec["body"].trim().length > 0 && rec["body"] !== "[DONE]")
-    return rec["body"].replace(/[\r\n]+/g, " ").trim().slice(0, 500);
-  return extractUpstreamMessage(rec);
-}
-
-function qoderEnvelopeToFrames(data: string): Array<{ event: string | null; data: string }> {
-  if (data === "[DONE]") return [{ event: null, data: "[DONE]" }];
-  let envelope: unknown;
-  try {
-    envelope = JSON.parse(data);
-  } catch {
-  }
-  if (typeof envelope !== "object" || envelope === null || Array.isArray(envelope)) return [];
-  const rec = envelope as Record<string, unknown>;
-  if (rec["statusCodeValue"] !== undefined && rec["statusCodeValue"] !== 200) {
-    const status = typeof rec["statusCodeValue"] === "number" ? (rec["statusCodeValue"] as number) : 502;
-    // Qoder reports failures inside the stream envelope instead of as HTTP
-    // responses, so classify its structured provider code and status through
-    // the same gateway error policy as the other dispatch paths.
-    const detail = qoderEnvelopeMessage(rec);
-    const identifier = upstreamErrorIdentifier(rec["body"]) ?? upstreamErrorIdentifier(rec);
-    // Qoder signals a queued request the same way inside the stream as it does
-    // on HTTP: `{"code":"10605", "isQueued":true, "retryAfterSeconds":N}` on a
-    // non-200 envelope. The status table would read the 403 as a refusal, and
-    // the caller would end its turn on a request that was only waiting.
-    const queuedWaitMs = isUpstreamQueued(rec["body"]) ?? false;
-    const waitMs = queuedWaitMs
-      ? (queueRetryAfterMs(rec["body"]) ?? undefined)
-      : undefined;
-    const classification = queuedWaitMs
-      ? { code: "upstream_queued" as const, status: 503, origin: "upstream" as const }
-      : classifyUpstreamError(status, identifier);
-    throw new GatewayError(
-      classification.code,
-      classification.status,
-      detail.length > 0 ? detail : `Qoder stream envelope returned HTTP ${status}`,
-      {
-        providerId: QODER_PROVIDER_ID,
-        providerStatus: status,
-        ...(identifier ? { providerCode: identifier } : {}),
-        ...(classification.credentialEvidence ? { credentialEvidence: true } : {}),
-        ...(classification.rateLimitScope
-          ? { rateLimitScope: classification.rateLimitScope }
-          : {}),
-        ...(waitMs === undefined ? {} : { retryAfterMs: waitMs, cooldownMs: waitMs }),
-        ...(queuedWaitMs ? { reason: "upstream-queued" } : {}),
-      },
-      classification.origin,
-    );
-  }
-  const body = rec["body"];
-  if (body === "[DONE]") return [{ event: null, data: "[DONE]" }];
-  if (typeof body !== "string") return [];
-  return [{ event: null, data: body.replace(/\r?\n/g, "") }];
-}
-
-function qoderStableHash(prefix: string, ...parts: string[]): string {
-  const h = createHash("sha256");
-  h.update(prefix);
-  for (const p of parts) {
-    h.update("\0");
-    h.update(p);
-  }
-  return h.digest("hex").slice(0, 16);
-}
-
-function flattenCanonicalContent(content: readonly ContentPart[]): string {
-  return content
-    .filter((b) => b.kind === "text" || b.kind === "toolResult")
-    .map((b) => {
-      if (b.kind === "text") return b.text;
-      if (b.kind === "toolResult") return typeof b.content === "string" ? b.content : JSON.stringify(b.content);
-      return "";
-    })
-    .join("\n");
-}
-
-function qoderStableRecordId(modelId: string, messages: CanonicalRequest["messages"], maxTokens: number): string {
-  const h = createHash("sha256");
-  h.update("qoder-record\0");
-  h.update(modelId);
-  for (const m of messages) {
-    h.update("\0");
-    h.update(m.role);
-    const text = flattenCanonicalContent(m.content);
-    if (text) {
-      h.update("\0");
-      h.update(text);
-    }
-  }
-  h.update(`\0mt=${maxTokens}`);
-  return h.digest("hex").slice(0, 16);
-}
-
-function qoderRequestedMaxTokens(request: CanonicalRequest, modelConfig: QoderModelConfig): number {
-  /**
-   * The ceiling is the roster's stated one. A fixed 32k fallback would clamp
-   * every model alike, so a request asking for more would be silently lowered
-   * no matter which model it named.
-   */
-  const configured = typeof modelConfig.max_output_tokens === "number" ? modelConfig.max_output_tokens : 65_536;
-  const controls = request.generation_controls as Record<string, unknown>;
-  const requested =
-    typeof controls["max_tokens"] === "number"
-      ? (controls["max_tokens"] as number)
-      : typeof controls["max_output_tokens"] === "number"
-        ? (controls["max_output_tokens"] as number)
-        : null;
-  return typeof requested === "number" && requested > 0 ? Math.min(requested, configured) : configured;
-}
-
-/**
- * Whether this model needs the prior turn's reasoning echoed back.
- *
- * The DeepSeek family ties multi-turn consistency to `reasoning_content`: an
- * assistant turn that thought must be replayed with that field or the upstream
- * refuses the whole history. The upstream reference bridge keeps it for exactly
- * these models and drops it as noise for every other one
- * (`keep_reasoning=is_deepseek_model(...)`, and `reasoning_content` in
- * `NOISE_KEYS` otherwise), and notes the symptom when it is missed: occasional
- * failures that sometimes pass on retry.
- *
- * Matched by the upstream key and by the display name, because a caller may
- * name either — the reference warns that matching only the "deepseek" prefix
- * missed every request that used the key.
- */
-function qoderKeepsReasoning(modelId: string): boolean {
-  const key = modelId.trim().toLowerCase();
-  if (key === "dmodel" || key === "dfmodel") return true;
-  return key.startsWith("deepseek");
-}
-
-/**
- * The `reasoning_content` field for an assistant turn, when one is needed.
- *
- * Presence, not length, decides: a client that already knows the rule sends
- * `""` on a thinking turn whose text is not readable back, and dropping that
- * empty string re-triggers the complaint it was sent to avoid. An assistant
- * turn with no reasoning at all gains nothing, so nothing is fabricated.
- */
-function qoderReasoningEcho(
-  message: { content: readonly ContentPart[] },
-  modelId: string,
-): { reasoning_content: string } | Record<string, never> {
-  if (!qoderKeepsReasoning(modelId)) return {};
-  const reasoning = message.content.filter((part) => part.kind === "reasoning");
-  if (reasoning.length === 0) return {};
-  const text = reasoning
-    .map((part) => (part.kind === "reasoning" ? (part.summary ?? part.payload ?? "") : ""))
-    .join("");
-  return { reasoning_content: text };
-}
-
-/**
- * The tool arguments as the object the `tool_use` block expects.
- *
- * The canonical form keeps them as the raw JSON text the caller sent, which is
- * what a chat-completions `tool_calls` entry holds. A `tool_use` block wants
- * structured input, so the text is parsed back.
- *
- * The fallbacks mirror the upstream reference bridge rather than inventing
- * shapes: unparseable text becomes `{}` and a non-object becomes `{value}`.
- * Smuggling the raw text through instead would emit an argument shape the
- * upstream has never seen for this field.
- */
-/**
- * Projects the canonical tools onto Qoder's chat-completions `tools` array.
- *
- * Without this the upstream is never told a tool exists, so a model that wants
- * one improvises markup in its prose (`<Read file_path="..." />`) instead of
- * emitting a structured call — the call is then neither runnable nor
- * recoverable, because it never was a call on either side.
- *
- * Only `function` tools are representable upstream. Anything else is dropped
- * rather than forwarded: Qoder rejects an unknown variant during
- * deserialization and fails the whole turn, which is worse than omitting a
- * tool the model could not have used anyway.
- */
-function qoderTools(
-  tools: readonly ToolDefinition[] | undefined,
-): Array<Record<string, unknown>> {
-  const out: Array<Record<string, unknown>> = [];
-  for (const tool of tools ?? []) {
-    if (tool.tool_type !== undefined && tool.tool_type !== "function") continue;
-    // The upstream requires `tools[].function` to be an object. A flat
-    // declaration naming the tool at the top level is rejected outright with
-    // "'function' is a required property, expected an object", which fails the
-    // whole request rather than just this tool.
-    out.push({
-      type: "function",
-      function: {
-        name: tool.name,
-        ...(tool.description === undefined ? { description: "" } : { description: tool.description }),
-        parameters: tool.jsonSchema ?? { type: "object", properties: {} },
-        ...(tool.strict === undefined ? {} : { strict: tool.strict }),
-      },
-    });
-  }
-  return out;
-}
-
-
-/**
- * Projects the canonical tool choice onto the upstream's field.
- *
- * The upstream only accepts a string here. Given the object form
- * `{type:"function",function:{name}}` it ignores the field, and the model then
- * calls the tool with no arguments filled in.
- *
- * `allowed_tools` has no chat-completions equivalent, so it collapses to the
- * direction it already names rather than being dropped: a caller that asked for
- * `required` must not silently get `auto`.
- */
-function qoderToolChoice(choice: ToolChoice | undefined): unknown {
-  if (choice === undefined) return undefined;
-  if (typeof choice === "string") return choice;
-  if (choice.type === "tool" || choice.type === "custom") {
-    const name = choice.name.trim();
-    return name.length > 0 ? name : "auto";
-  }
-  return choice.mode;
-}
-
-/**
- * Marks a tool call recorded into the text of an assistant turn.
- *
- * The upstream only reads structured turns on its CN realm, so on INTL a past
- * call has to be described in prose or the model loses the record of what it
- * asked for. The wording matches the reference bridge, which is what the
- * upstream has been trained to read back.
- */
-const QODER_TOOL_MARKER = "[assistant 请求调用工具]";
-
-/**
- * Whether this request sends its tool history as structured turns.
- *
- * The upstream honours the structured form on its CN realm only. On INTL it is
- * not enabled, and sending it anyway yields tool calls that come back right in
- * name but with no arguments filled in — a call that cannot run. So the shape
- * follows the realm rather than being assumed everywhere.
- */
-function qoderStructuredTools(realm: QoderRealm): boolean {
-  return realm === "cn";
-}
-
-export function buildQoderRequest(
-  modelId: string,
-  request: CanonicalRequest,
-  modelConfig: QoderModelConfig,
-  auth: QoderAuth,
-  realm: QoderRealm = "intl",
-): Record<string, unknown> {
-  const allMessages = request.messages;
-  const systemParts: string[] = [];
-  if (request.system) {
-    for (const p of request.system) if (p.kind === "text") systemParts.push(p.text);
-  }
-  if (request.instructions) {
-    for (const p of request.instructions) if (p.kind === "text") systemParts.push(p.text);
-  }
-  for (const m of allMessages) {
-    if (m.role === "system" || m.role === "developer") {
-      const t = flattenCanonicalContent(m.content);
-      if (t) systemParts.push(t);
-    }
-  }
-  const systemPrompt = systemParts.join("\n\n").trim();
-  const qoderMessages: Array<Record<string, unknown>> = [];
-  const structuredTools = qoderStructuredTools(realm);
-  if (MODERN_PROFILE.mirrorTopLevelSystem && systemPrompt.length > 0) {
-    qoderMessages.push({
-      role: "system",
-      content: systemPrompt,
-    });
-  }
-  for (const m of allMessages) {
-    if (m.role === "system" || m.role === "developer") continue;
-    // Answers may live in a `user` turn (the Messages ledger re-homes them),
-    // so the result scan is role-agnostic. Each result becomes its own `tool`
-    // turn carrying its `tool_call_id`; any non-result content on the same turn
-    // is emitted after, so nothing is duplicated or lost.
-    const results = structuredTools ? toolResultParts(m) : [];
-    if (results.length > 0) {
-      for (const block of results) {
-        const text = flattenCanonicalContent(
-          typeof block.content === "string"
-            ? [{ kind: "text", text: block.content }]
-            : block.content,
-        );
-        qoderMessages.push({
-          role: "tool",
-          content: text,
-          tool_call_id: block.call_id,
-        });
-      }
-      // Text that shared the turn with a result is emitted after it, minus the
-      // result itself. Re-emitting the result's own text here was doubling
-      // every tool answer: the `tool` turn above and a `user` turn with the
-      // same content, which doubled the payload for no reason.
-      const remaining = m.content.filter((part) => part.kind !== "toolResult");
-      const flat = flattenCanonicalContent(remaining);
-      if (flat.length === 0) continue;
-      qoderMessages.push({
-        role: "user",
-        content: flat,
-      });
-      continue;
-    }
-    // An assistant turn that called tools must carry the calls, not just its
-    // text. Falling through to the text-only emit dropped them, so the payload
-    // arrived as a `tool` result with no preceding call and the upstream
-    // rejected the whole transcript: "Messages with role 'tool' must be a
-    // response to a preceding message with 'tool_calls'".
-    const allCalls = m.content.filter((part) => part.kind === "toolCall");
-    const reasoningEcho = qoderReasoningEcho(m, modelId);
-    if (!structuredTools && allCalls.length > 0) {
-      // INTL does not read structured turns, so the call is written into the
-      // text instead of being dropped. Dropping it left the next `tool` turn
-      // answering a call that was never made, and the model had no record of
-      // what it had asked for — so it re-emitted a call with no arguments.
-      //
-      // The marker and the JSON shape mirror the reference bridge, which is
-      // what the upstream has actually been trained to read back.
-      const textParts = m.content.filter((part) => part.kind !== "toolCall");
-      const prose = flattenCanonicalContent(textParts);
-      const recorded = allCalls.map((part) => ({
-        name: part.name,
-        arguments: typeof part.arguments === "string" ? part.arguments : "",
-      }));
-      qoderMessages.push({
-        role: "assistant",
-        content: (prose.length > 0 ? prose + "\n\n" : "") + QODER_TOOL_MARKER + "\n" + JSON.stringify(recorded),
-        ...reasoningEcho,
-      });
-      continue;
-    }
-    const calls = structuredTools ? allCalls : [];
-    if (calls.length > 0) {
-      const textParts = m.content.filter((part) => part.kind !== "toolCall");
-      const flat = flattenCanonicalContent(textParts);
-      qoderMessages.push({
-        role: "assistant",
-        content: flat,
-        ...reasoningEcho,
-        tool_calls: calls.map((part) => ({
-          id: part.call_id,
-          type: "function",
-          function: {
-            name: part.name,
-            arguments: typeof part.arguments === "string" ? part.arguments : "",
-          },
-        })),
-      });
-      continue;
-    }
-    const flat = flattenCanonicalContent(m.content);
-    const role = m.role === "assistant" ? "assistant" : "user";
-    qoderMessages.push({
-      role,
-      content: flat,
-      ...(role === "assistant" ? qoderReasoningEcho(m, modelId) : {}),
-    });
-  }
-  const latestUserMessage = [...qoderMessages].reverse().find((m) => m["role"] === "user");
-  const latestUserText = typeof latestUserMessage?.["content"] === "string" ? (latestUserMessage["content"] as string) : "";
-  const maxTokens = qoderRequestedMaxTokens(request, modelConfig);
-  const reasoning = modelConfig.is_reasoning === true;
-  const sessionId = qoderStableHash("qoder-session", auth.userId, modelId);
-  const recordId = qoderStableRecordId(modelId, allMessages, maxTokens);
-  return {
-    request_id: randomUUID(),
-    request_set_id: recordId,
-    chat_record_id: recordId,
-    session_id: sessionId,
-    stream: true,
-    ...(MODERN_PROFILE.emptyAliyunUserType ? { aliyun_user_type: "" } : {}),
-    chat_task: "FREE_INPUT",
-    is_reply: true,
-    is_retry: false,
-    source: 1,
-    version: "3",
-    session_type: "qodercli",
-    agent_id: "agent_common",
-    task_id: "common",
-    code_language: "",
-    chat_prompt: MODERN_PROFILE.mirrorTopLevelSystem ? systemPrompt : "",
-    image_urls: null,
-    chat_context: {
-      chatPrompt: MODERN_PROFILE.mirrorTopLevelSystem ? systemPrompt : "",
-      imageUrls: null,
-      extra: { context: [], modelConfig: { key: modelId, is_reasoning: reasoning }, originalContent: { text: latestUserText } },
-      features: [],
-      // An object, as the reference sends it: `cc["text"]["text"] = prompt`.
-      text: { text: latestUserText },
-    },
-    model_config: {
-      key: modelId,
-      display_name: modelConfig.display_name,
-      // Declares the wire dialect for the tool calls. Without it the upstream
-      // does not read the OpenAI-shaped `tools` array the same way, and the
-      // model then emits a call with no arguments filled in.
-      format: "openai",
-      model: "",
-      api_key: "",
-      url: "",
-      is_vl: modelConfig.is_vl,
-      is_reasoning: modelConfig.is_reasoning,
-      max_input_tokens: modelConfig.max_input_tokens,
-      // Mirrors the roster's stated ceiling. A fixed 32k fallback would be sent
-      // for every model alike, so the request would declare a cap the catalog
-      // does not publish.
-      max_output_tokens: modelConfig.max_output_tokens ?? 65_536,
-      source: modelConfig.source ?? "system",
-    },
-    messages: qoderMessages,
-    max_tokens: maxTokens,
-    // Always present, even when empty. Omitting the field makes Qoder fall back
-    // to the desktop agent's own toolset (Bash/Edit/...), which then leaks to a
-    // caller that declared none — the reference bridge sends `[]` for exactly
-    // that reason. Parallel calls are stated explicitly rather than left to the
-    // upstream default, so a caller expecting them is not served serial
-    // behaviour.
-    tools: qoderTools(request.tools),
-    parallel_tool_calls: true,
-    ...(() => {
-      const choice = qoderToolChoice(request.tool_choice);
-      return choice === undefined ? {} : { tool_choice: choice };
-    })(),
-  };
-}
-
-// ---------------------------------------------------------------------------
-// DSML tool-call recovery — DeepSeek's native markup in the text stream
-// ---------------------------------------------------------------------------
-// Some DeepSeek-family models write their tool calls as XML-like DSML markup
-// inside the plain-text `content` stream instead of the structured
-// `tool_calls` field. Left alone, the markup reaches the caller as visible
-// prose and the tool never runs — which is exactly the symptom reported.
-//
-// The reference bridge (`qoder_proxy.py`, `parse_dsml_tool_calls`) recovers
-// these at end of stream. This is the same rule: buffer once DSML appears,
-// parse at the end, emit the clean prose then the real tool calls.
-//
-// Patterns mirror the Python originals (`re.DOTALL` becomes the `s` flag):
-//   TAG_START      = r"<[^>]*DSML[^>]*"
-//   DSML_CALLS_RE  = TAG_START + r"calls>(.*?)</[^>]*DSML[^>]*calls>"
-//   DSML_INVOKE_RE = TAG_START + r"invoke\s+name=["']([^"']+)["']>(.*?)</[^>]*invoke>"
-//   DSML_PARAM_RE  = TAG_START + r"parameter\s+name=["']([^"']+)["'][^>]*>(.*?)</[^>]*parameter>"
-
-const DSML_CALLS_RE = /<[^>]*DSML[^>]*calls>([\s\S]*?)<\/[^>]*DSML[^>]*calls>/;
-const DSML_INVOKE_RE = /<[^>]*DSML[^>]*invoke\s+name=["']([^"']+)["']>([\s\S]*?)<\/[^>]*invoke>/g;
-const DSML_PARAM_RE = /<[^>]*DSML[^>]*parameter\s+name=["']([^"']+)["'][^>]*>([\s\S]*?)<\/[^>]*parameter>/g;
-
-/** One recovered call, in the shape the canonical events want. */
-export interface DsmlCall {
-  readonly id: string;
-  readonly name: string;
-  readonly arguments: string;
-}
-
-/**
- * Recovers DSML tool calls out of a plain-text string.
- *
- * `clean` is the text with the markup removed. With no DSML present, `calls`
- * is empty and `clean` is the original text unchanged — so this is safe to run
- * over every stream, not just suspected ones.
- */
-export function parseDsmlToolCalls(text: string): { calls: DsmlCall[]; clean: string } {
-  if (text.length === 0 || !text.includes("DSML")) return { calls: [], clean: text };
-
-  const callsMatch = DSML_CALLS_RE.exec(text);
-  let block: string;
-  let clean: string;
-
-  if (callsMatch) {
-    block = callsMatch[1] ?? "";
-    const before = text.slice(0, callsMatch.index).trimEnd();
-    const after = text.slice(callsMatch.index + callsMatch[0].length).trimStart();
-    clean = (before + " " + after).trim();
-  } else {
-    // No <calls> wrapper (issue #51): find bare <invoke> blocks in the whole
-    // text, then cut the prose off at the last `<` before the first invoke.
-    DSML_INVOKE_RE.lastIndex = 0;
-    const first = DSML_INVOKE_RE.exec(text);
-    if (!first) return { calls: [], clean: text };
-    block = text;
-    const cut = text.lastIndexOf("<", first.index);
-    clean = text.slice(0, cut >= 0 ? cut : first.index).trim();
-  }
-
-  const calls: DsmlCall[] = [];
-  DSML_INVOKE_RE.lastIndex = 0;
-  let inv: RegExpExecArray | null;
-  while ((inv = DSML_INVOKE_RE.exec(block)) !== null) {
-    const params: Record<string, string> = {};
-    DSML_PARAM_RE.lastIndex = 0;
-    let par: RegExpExecArray | null;
-    while ((par = DSML_PARAM_RE.exec(inv[2] ?? "")) !== null) {
-      params[par[1] ?? ""] = (par[2] ?? "").trim();
-    }
-    calls.push({
-      id: `call_${randomUUID().replace(/-/g, "").slice(0, 16)}`,
-      name: inv[1] ?? "",
-      arguments: JSON.stringify(params),
-    });
-  }
-
-  return { calls, clean };
-}
-
-/**
- * Escapes the bare quotes that belong inside a JSON string value.
- *
- * Escaped quotes are parked first so they are not escaped twice, then every
- * remaining quote is escaped, then the parked ones are restored.
- */
-function repairJsonQuotes(text: string): string {
-  const ph = "\u0000";
-  return text.replace(/\\"/g, ph).replace(/"/g, '\\"').replaceAll(ph, '\\"');
-}
-
-/** `[{"name":"…","arguments":"<unescaped JSON>"}]`, one call only. */
-const ECHO_LOOSE_RE = /^\[\s*\{\s*"name"\s*:\s*"([^"]{1,200})"\s*,\s*"arguments"\s*:\s*"(.*)"\s*\}\s*\]$/s;
-
-/**
- * Rebuilds the single-call echo shape when strict parsing fails.
- *
- * Returns `null` when the text is not that shape at all, so a caller can fall
- * back rather than accepting a guess. The result still goes through the same
- * strict checks as a normally-parsed array.
- */
-function salvageEchoArray(rest: string): unknown {
-  const m = ECHO_LOOSE_RE.exec(rest.trim());
-  if (!m) return null;
-  const name = m[1] ?? "";
-  const raw = m[2] ?? "";
-  for (const candidate of [raw, repairJsonQuotes(raw)]) {
-    try {
-      JSON.parse(candidate);
-      return [{ name, arguments: candidate }];
-    } catch {
-      continue;
-    }
-  }
-  return null;
-}
-
-/**
- * Recovers a tool call the model echoed back as text.
- *
- * On INTL the upstream reads tool calls as prose, so a turn that called a tool
- * is described with `QODER_TOOL_MARKER` followed by a JSON array of
- * `{name, arguments}`. The model occasionally reproduces that shape verbatim as
- * its answer instead of calling again, and left alone the client shows the JSON
- * as content while the tool never runs.
- *
- * Only a well-formed array whose every entry names a tool and carries parseable
- * arguments is accepted. Anything else returns no calls and the original text,
- * so a model merely talking about the format is never mistaken for a call.
- */
-export function parseLeakedToolCalls(
-  text: string,
-  allowedNames?: ReadonlySet<string>,
-): { calls: DsmlCall[]; clean: string } {
-  if (text.length === 0 || !text.includes(QODER_TOOL_MARKER)) {
-    return { calls: [], clean: text };
-  }
-  const at = text.indexOf(QODER_TOOL_MARKER);
-  const head = text.slice(0, at).trim();
-  const rest = text.slice(at + QODER_TOOL_MARKER.length).trim();
-
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(rest);
-  } catch {
-    // A model echoing the call writes the inner quotes unescaped:
-    // `[{"name":"Read","arguments":"{"file_path":"a.ts"}"}]`. That is not
-    // valid JSON at either level, so the array has to be rebuilt before it can
-    // be trusted. Only the single-call shape is salvaged, which is what an echo
-    // almost always is.
-    const salvaged = salvageEchoArray(rest);
-    if (salvaged === null) return { calls: [], clean: text };
-    parsed = salvaged;
-  }
-  if (!Array.isArray(parsed) || parsed.length === 0) return { calls: [], clean: text };
-
-  const calls: DsmlCall[] = [];
-  for (const item of parsed) {
-    if (typeof item !== "object" || item === null) return { calls: [], clean: text };
-    const rec = item as Record<string, unknown>;
-    const name = typeof rec["name"] === "string" ? rec["name"].trim() : "";
-    if (name.length === 0) return { calls: [], clean: text };
-    if (allowedNames && !allowedNames.has(name)) return { calls: [], clean: text };
-    let args = rec["arguments"];
-    if (typeof args === "object" && args !== null) args = JSON.stringify(args);
-    if (typeof args !== "string") return { calls: [], clean: text };
-    // Arguments that do not parse are not a call this can trust.
-    if (args.trim().length > 0) {
-      try {
-        JSON.parse(args);
-      } catch {
-        return { calls: [], clean: text };
-      }
-    }
-    calls.push({ id: `call_${randomUUID().replace(/-/g, "").slice(0, 16)}`, name, arguments: args });
-  }
-  return { calls, clean: head };
-}
-
-/**
- * The holdable tail of a content chunk: a short suffix that looks like the
- * start of a DSML tag and may finish in the next frame. Empty when there is
- * nothing worth holding.
- *
- * Mirrors `_dsml_tail_hold` in the reference bridge.
- */
-export function dsmlTailHold(text: string): string {
-  const at = text.lastIndexOf("<");
-  if (at < 0 || text.length - at > 24) return "";
-  const tail = text.slice(at);
-  // A complete tag already — nothing to wait for.
-  if (tail.includes(">")) return "";
-  const body = tail.replace(/\uFF5C/g, "|").toUpperCase().slice(1).replace(/^\//, "");
-  if (body.length === 0) return tail; // bare "<" or "</"
-  if (!body.startsWith("|")) return "";
-  const rest = body.slice(1);
-  if (rest.length === 0) return tail;
-  if ("DSML".startsWith(rest) || rest.startsWith("DSML")) return tail;
-  return "";
-}
-
-/**
- * Removes leftover DSML closing tags from the tail of a text.
- *
- * The upstream sometimes leaks only the tail of a tool-call block — bare
- * `</parameter>` / `</invoke>` / `</calls>` with no opening and, in the
- * thinking channel, occasionally without the `DSML` marker at all. Those
- * fragments are pure protocol residue: they are never natural prose, so
- * dropping them is safe and keeps internal markup out of what the user sees.
- *
- * Anchored to the end, as in the reference bridge: a closing tag in the middle
- * of a text is not this residue and stripping it would eat real prose. The
- * caller loops, so several trailing tags come off one per pass.
- *
- * Mirrors `_strip_dsml_close_tail`, widened to the bare form because the
- * thinking channel does not always carry the marker.
- */
-const DSML_CLOSE_TAG_RE = /<\/(?:[^>]*DSML[^>]*|parameter|invoke|calls|tool_calls|function_calls)\s*>\s*$/i;
-
-export function stripDsmlCloseTags(text: string): string {
-  let previous: string | null = null;
-  let out = text.trimEnd();
-  while (previous !== out) {
-    previous = out;
-    out = out.replace(DSML_CLOSE_TAG_RE, "").trimEnd();
-  }
-  return out;
-}
-
-// Stream transformation — decode SSE, unwrap COSY envelope, map OpenAI chat chunks to CanonicalEvent
-
-function mapQoderFinishReason(raw: unknown): CanonicalStopReason | undefined {
-  if (raw === "length") return "length";
-  if (raw === "tool_calls") return "tool_use";
-  if (raw === "content_filter") return "content_filter";
-  return undefined;
-}
-
-export async function* qoderBodyToCanonicalEvents(
-  body: ReadableStream<Uint8Array>,
-  signal: AbortSignal,
-  model: string,
-): AsyncIterable<CanonicalEvent> {
-  let seq = 1;
-  yield { type: "response_start", sequence_number: seq++, model } as CanonicalEvent;
-  let finishReason: unknown = undefined;
-  let rawUsage: Record<string, unknown> | undefined = undefined;
-  let hasTerminal = false;
-  // DSML recovery state. While `buf` is empty the text passes through
-  // untouched; once a chunk carries DSML the rest is buffered so the markup can
-  // be parsed whole at end of stream. `tail` holds a possible half-tag that
-  // straddles a frame boundary.
-  let buf = "";
-  let tail = "";
-  /** Calls recovered from the thinking channel, emitted if content had none. */
-  let reasonCalls: DsmlCall[] = [];
-  // The same recovery for the thinking channel. A model that plans its call
-  // inside `reasoning_content` writes the markup there instead of in `content`,
-  // so recovering only the content channel loses the call *and* leaves the
-  // tags visible in the user's thinking.
-  let reasonBuf = "";
-  let reasonTail = "";
-
-  for await (const sse of decodeSseEvents(body, { signal })) {
-    const sseData = sse.data;
-    let frames: Array<{ event: string | null; data: string }>;
-    try {
-      frames = qoderEnvelopeToFrames(sseData);
-    } catch (e) {
-      throw e;
-    }
-    for (const frame of frames) {
-      const data = frame.data.trim();
-      if (!data) continue;
-      if (data === "[DONE]") {
-        hasTerminal = true;
-        continue;
-      }
-      let json: Record<string, unknown>;
-      try {
-        json = JSON.parse(data) as Record<string, unknown>;
-      } catch {
-        continue;
-      }
-      if (json["usage"] && typeof json["usage"] === "object") rawUsage = json["usage"] as Record<string, unknown>;
-      const choices = (json["choices"] as Array<Record<string, unknown>>) ?? [];
-      for (const choice of choices) {
-        const delta = choice["delta"] as Record<string, unknown> | undefined;
-        if (delta) {
-          if (typeof delta["content"] === "string" && (delta["content"] as string).length > 0) {
-            const piece = tail + (delta["content"] as string);
-            tail = "";
-            if (buf.length === 0) {
-              // Not yet in a DSML stream: hold back only a possible tag start,
-              // and pass everything before it through unchanged.
-              const hold = dsmlTailHold(piece);
-              const body = hold.length > 0 ? piece.slice(0, piece.length - hold.length) : piece;
-              if (body.includes("DSML")) {
-                buf = body;
-                tail = hold;
-                continue;
-              }
-              if (body.length > 0) {
-                yield {
-                  type: "content_delta",
-                  sequence_number: seq++,
-                  content: { kind: "text", text: body },
-                } as CanonicalEvent;
-              }
-              tail = hold;
-              continue;
-            }
-            buf += piece;
-            continue;
-          }
-          const reasoningText = readReasoningText(delta);
-          if (typeof reasoningText === "string" && reasoningText.length > 0) {
-            const piece = reasonTail + reasoningText;
-            reasonTail = "";
-            if (reasonBuf.length === 0) {
-              const hold = dsmlTailHold(piece);
-              const body = hold.length > 0 ? piece.slice(0, piece.length - hold.length) : piece;
-              if (body.includes("DSML")) {
-                reasonBuf = body;
-                reasonTail = hold;
-                continue;
-              }
-              const visible = stripDsmlCloseTags(body);
-              if (visible.length > 0) {
-                yield {
-                  type: "content_delta",
-                  sequence_number: seq++,
-                  content: { kind: "reasoning", payload: null, summary: visible },
-                } as CanonicalEvent;
-              }
-              reasonTail = hold;
-              continue;
-            }
-            reasonBuf += piece;
-            continue;
-          }
-          const toolCalls = delta["tool_calls"] as Array<Record<string, unknown>> | undefined;
-          if (toolCalls) {
-            for (const tc of toolCalls) {
-              const fn = tc["function"] as Record<string, unknown> | undefined;
-              yield {
-                type: "tool_call_delta",
-                sequence_number: seq++,
-                call_id: (tc["id"] as string) ?? `call_${String(tc["index"] ?? 0)}`,
-                name: fn?.["name"] as string | undefined,
-                arguments_delta: (fn?.["arguments"] as string) ?? "",
-              } as CanonicalEvent;
-            }
-          }
-        }
-        const fr = choice["finish_reason"];
-        if (fr !== null && fr !== undefined) finishReason = fr;
-        // Some providers send usage in choices[0].usage or top-level
-        if (choice["usage"] && typeof choice["usage"] === "object") rawUsage = choice["usage"] as Record<string, unknown>;
-      }
-      // Some Qoder chunks carry finish_reason at top level
-      if (json["finish_reason"] !== undefined) finishReason = json["finish_reason"];
-    }
-  }
-  // End of stream: resolve whatever the DSML buffer collected.
-  if (reasonBuf.length > 0) {
-    const { calls, clean } = parseDsmlToolCalls(reasonBuf);
-    const visible = stripDsmlCloseTags(clean).trim();
-    if (visible.length > 0) {
-      yield {
-        type: "content_delta",
-        sequence_number: seq++,
-        content: { kind: "reasoning", payload: null, summary: visible },
-      } as CanonicalEvent;
-    }
-    // A call recovered here counts exactly like one recovered from the content
-    // channel — the two are deduplicated below, so a model that writes the
-    // block in one channel and its tail in the other still yields one call.
-    if (calls.length > 0) reasonCalls = calls;
-  }
-  if (buf.length > 0) {
-    // Two ways a call can arrive as text: DSML markup, and the marker + JSON
-    // array the upstream itself uses on INTL. The second is tried only when the
-    // first finds nothing, so a DSML stream is never re-read as an echo.
-    let { calls, clean } = parseDsmlToolCalls(buf);
-    if (calls.length === 0) {
-      const leaked = parseLeakedToolCalls(buf);
-      if (leaked.calls.length > 0) {
-        calls = leaked.calls;
-        clean = leaked.clean;
-      }
-    }
-    if (calls.length > 0) {
-      const visible = stripDsmlCloseTags(clean).trim();
-      if (visible.length > 0) {
-        yield {
-          type: "content_delta",
-          sequence_number: seq++,
-          content: { kind: "text", text: visible },
-        } as CanonicalEvent;
-      }
-      for (const call of calls) {
-        yield {
-          type: "tool_call_delta",
-          sequence_number: seq++,
-          call_id: call.id,
-          name: call.name,
-          arguments_delta: call.arguments,
-        } as CanonicalEvent;
-      }
-      reasonCalls = [];
-      // The turn ended by calling a tool, whatever the upstream reported.
-      finishReason = "tool_calls";
-    } else {
-      // Unparseable markup: emit as prose rather than dropping it, so nothing
-      // the model said is lost.
-      const visible = stripDsmlCloseTags(buf).trim();
-      if (visible.length > 0) {
-        yield {
-          type: "content_delta",
-          sequence_number: seq++,
-          content: { kind: "text", text: visible },
-        } as CanonicalEvent;
-      }
-    }
-  }
-  // Content carried no call of its own: whatever the thinking channel
-  // recovered is the turn's call.
-  for (const call of reasonCalls) {
-    yield {
-      type: "tool_call_delta",
-      sequence_number: seq++,
-      call_id: call.id,
-      name: call.name,
-      arguments_delta: call.arguments,
-    } as CanonicalEvent;
-  }
-  // A recovered call outranks what the upstream reported. It says `stop`
-  // because the markup never became a real tool call on its side, so leaving it
-  // alone ends the turn "finished" with a call the caller never sees run.
-  if (reasonCalls.length > 0) finishReason = "tool_calls";
-  if (tail.length > 0) {
-    yield {
-      type: "content_delta",
-      sequence_number: seq++,
-      content: { kind: "text", text: tail },
-    } as CanonicalEvent;
-  }
-  // If no terminal arrived, synthesize one (prevents truncation error)
-  const stopReason = mapQoderFinishReason(finishReason);
-  const _providerStop = typeof finishReason === "string" ? finishReason : undefined;
-  void hasTerminal;
-  yield {
-    type: "terminal",
-    sequence_number: seq++,
-    state: "complete",
-    ...(stopReason === undefined ? {} : { stop_reason: stopReason }),
-    ...(_providerStop === undefined ? {} : { provider_stop_reason: _providerStop }),
-    usage: usageFromProvider(rawUsage),
-  } as CanonicalEvent;
-}
-
-// Model catalog — maps QODER_MODEL_CONFIGS (provider) to Cartethyia ModelDefinition
-
-/**
- * The intl catalog this provider publishes.
- *
- * `QODER_MODEL_CONFIGS` is not the source here: it freezes most rows at 180k
- * while the upstream reports 1M for the same keys. That number is not
- * cosmetic: it is sent upstream as `model_config.max_input_tokens`, so a stale
- * low value tells Qoder the conversation window is small and makes it behave
- * that way. Both the published catalog and the dispatched request come from the
- * realm's roster, which carries the upstream's own numbers.
- */
-export const QODER_MODELS: readonly ModelDefinition[] = QODER_INTL_MODELS;
-
-// ProviderAdapter — manual dispatch preserving COSY encryption + envelope logic
-
-interface QoderAdapterOptions {
-  readonly fetch?: typeof fetch;
-  /** Which deployment this adapter dispatches to. Defaults to intl. */
-  readonly realm?: QoderRealm;
-  /** Bundled provider id, so the adapter's own id matches the route's. */
-  readonly providerId?: string;
-}
-
-class QoderAdapter implements ProviderAdapter {
-  readonly provider_id: ProviderId;
-  private readonly realm: QoderRealm;
-  private readonly fetchFn: typeof fetch;
-
-  constructor(options: QoderAdapterOptions = {}) {
-    this.provider_id = (options.providerId ?? QODER_PROVIDER_ID) as ProviderId;
-    this.realm = options.realm ?? "intl";
-    this.fetchFn = options.fetch ?? globalThis.fetch;
-  }
-
-  /**
-   * The static roster for this adapter's realm.
-   *
-   * A single merged table advertised CN-only keys to global accounts and vice
-   * versa, so a request was routed to a deployment that refuses it.
-   */
-  #modelConfigs(): Record<string, QoderModelConfig> {
-    return (this.realm === "cn" ? QODER_CN_MODEL_CONFIGS : QODER_INTL_MODEL_CONFIGS) as Record<
-      string,
-      QoderModelConfig
-    >;
-  }
-
-  async *dispatch(
-    request: CanonicalRequest,
-    candidate: ProviderDispatchTarget,
-    context: ProviderDispatchContext,
-  ): AsyncIterable<CanonicalEvent> {
-    if (candidate.wire_family !== "chat") {
-      throw new GatewayError("capability_unsupported", 400, `qoder supports chat only, got ${candidate.wire_family}`);
-    }
-    const secret = readCredentialSecret(context.credential, "Qoder credential is required");
-
-    /**
-     * A caller-facing virtual name is translated to its roster key here.
-     *
-     * The translation has to happen before the config lookup and before the
-     * request body: the body carries the roster key, and looking up the
-     * virtual id in the config table would fall through to the synthetic
-     * default and silently dispatch under-declared capabilities.
-     */
-    const requestedModelId = candidate.model_id || request.model;
-    if (isQoderVirtualModel(requestedModelId) && !this.#modelConfigs()[qoderDispatchModelId(requestedModelId)]) {
-      throw new GatewayError(
-        "model_not_found",
-        404,
-        `Qoder virtual model ${requestedModelId} resolves to a roster key this realm does not serve`,
-        { virtual_model: requestedModelId, target: qoderDispatchModelId(requestedModelId) },
-        "upstream",
-      );
-    }
-    const modelId = qoderDispatchModelId(requestedModelId);
-    const modelConfig = this.#modelConfigs()[modelId] ?? {
-      id: modelId,
-      display_name: modelId,
-      max_input_tokens: 180_000,
-      is_vl: true,
-      is_reasoning: false,
-    };
-
-    const lifecycle = createUpstreamDeadlineLifecycle(context);
-
-    // Outbound fetch respects SSRF binding when provided
-    const outboundFetch: typeof fetch = (context.outbound_fetch as unknown as typeof fetch) ?? this.fetchFn;
-
-    const fetcher: QoderFetcher = (url, init) =>
-      outboundFetch(url, { ...init, signal: lifecycle.signal } as RequestInit) as Promise<Response>;
-
-    try {
-      const version = getQoderVersion();
-      // Dual mode like Cline: a pasted PAT is exchanged for a job token per
-      // request, while an OAuth device token is used directly with the
-      // identity the login persisted.
-      const auth = isQoderPat(secret)
-        ? await exchangeQoderPat(secret, lifecycle.signal, fetcher, version, this.realm)
-        : qoderOAuthAuth(secret, context.credential.auth_state, context.credential.account_id);
-      const qoderBody = buildQoderRequest(modelId, request, modelConfig, auth, this.realm);
-      // A full URL from the route wins, but the fallback is this realm's
-      // gateway — not the intl host hardcoded into `MODERN_PROFILE`. Dispatching
-      // a CN credential to `*.qoder.sh` is refused outright.
-      const url =
-        candidate.endpoint_path && candidate.endpoint_path.startsWith("http")
-          ? candidate.endpoint_path
-          : `${qoderGatewayCandidates(this.realm)[0] ?? ""}${QODER_CHAT_PATH}`;
-
-      const response = await callQoder(url, qoderBody, modelId, auth, lifecycle.signal, fetcher, version);
-      if (!response.ok) throw await mapUpstreamHttpError(response, "qoder");
-      if (!response.body) throw new GatewayError("platform_unavailable", 502, "Qoder returned empty body", {}, "upstream");
-      // Headers arrived: the pre-stream deadline has served its purpose.
-      // From here the gateway stall/first-chunk watchdog (propagated via
-      // context.abort_signal) governs the body. Keeping this timer armed
-      // would kill healthy long streams at the stale pre-stream deadline.
-      lifecycle.release();
-      yield* qoderBodyToCanonicalEvents(response.body as ReadableStream<Uint8Array>, lifecycle.signal, request.model);
-    } catch (err: unknown) {
-      const abortError = abortGatewayError(lifecycle, err, context.abort_signal);
-      if (abortError) throw abortError;
-      throw err;
-    } finally {
-      lifecycle.release();
-    }
-  }
-}
-
-export function createQoderAdapter(options: QoderAdapterOptions = {}): ProviderAdapter {
-  return new QoderAdapter(options);
-}
-
-/**
- * Adapter for the China deployment.
- *
- * Same wire, different gateway host and roster — see `qoder-realm.ts`.
- */
-export function createQoderCnAdapter(options: QoderAdapterOptions = {}): ProviderAdapter {
-  return new QoderAdapter({ ...options, realm: "cn", providerId: "qodercn" });
-}
-
-/**
- * A COSY signer for one already-resolved account identity.
- *
- * Discovery needs signed headers but lives in `qoder-catalog.ts`, which cannot
- * import this module (the adapter imports its rosters — that would be a cycle).
- * Exporting the signer keeps one signing implementation and lets discovery
- * stay pure and injectable.
- */
-export function qoderSignerFor(
-  auth: QoderAuth,
-  version = getQoderVersion(),
-): (url: string, body: string) => Record<string, string> {
-  return (url: string, body: string): Record<string, string> =>
-    qoderBuildCosyHeaders(Buffer.from(body, "latin1"), url, auth, version);
-}
-
-/** Qoder's own base64 alphabet transform, for a request body. */
-export function qoderEncodeBody(plaintext: Uint8Array | string): string {
-  const text = typeof plaintext === "string" ? plaintext : new TextDecoder().decode(plaintext);
-  return Buffer.from(transformQoderBody(text)).toString("latin1");
-}
-
-/**
- * Resolves the dispatch identity for one Qoder credential.
- *
- * Shared by the adapter and by discovery: both need the same `QoderAuth` the
- * COSY signature is built from, and duplicating the PAT-vs-OAuth branch would
- * let the two drift.
- */
-export async function resolveQoderAuth(input: {
-  readonly secret: string;
-  readonly authState: unknown;
-  readonly signal: AbortSignal;
-  readonly fetcher: (url: string, init: RequestInit) => Promise<Response>;
-  /** Which deployment mints the job token; a PAT is realm-bound. */
-  readonly realm?: QoderRealm;
-}): Promise<QoderAuth> {
-  const realm = input.realm ?? "intl";
-  if (isQoderPat(input.secret)) {
-    return await exchangeQoderPat(input.secret, input.signal, input.fetcher, getQoderVersion(), realm);
-  }
-  // Discovery is handed only the secret and the persisted state, so the
-  // account id is read from that state — the same place `qoderOAuthAuth` reads
-  // it — rather than being a separate field callers can pass wrongly.
-  const state = parseQoderOAuthState(input.authState);
-  return qoderOAuthAuth(input.secret, input.authState, state?.userId);
-}
+// Factory-blocked (Phase C4): PAT-to-jobToken session handshake, COSY
+// AES/RSA request signing, alphabet-scrambled binary body, enveloped SSE
+// frames — session/crypto protocol outside factory reach; stays bespoke.
+import { constants, createCipheriv, createHash, publicEncrypt, randomUUID } from "node:crypto";
+import {
+  classifyUpstreamError,
+  extractUpstreamMessage,
+  isUpstreamQueued,
+  mapUpstreamHttpError,
+  queueRetryAfterMs,
+  upstreamErrorIdentifier,
+} from "../../../transport/failure-policy";
+import { GatewayError } from "../../../protocol/gateway-error";
+import { resolveImageSource } from "../../../protocol/codecs";
+import type {
+  CanonicalEvent,
+  CanonicalRequest,
+  CanonicalStopReason,
+  ContentPart,
+  ToolChoice,
+  ToolDefinition,
+} from "../../../protocol/canonical-model";
+import { toolResultParts } from "../../../protocol/canonical-model";
+import { decodeSseEvents } from "../../../protocol/sse-decoder";
+import { usageFromProvider, readReasoningText } from "../../provider-usage";
+import { readCredentialSecret, type ProviderDispatchTarget, type ProviderAdapter, type ProviderDispatchContext, type ProviderId } from "../../provider-contracts";
+import type { ModelDefinition } from "../../provider-model-definition";
+import { parseQoderOAuthState } from "./qoder-oauth";
+import { getQoderVersion } from "../../operations/client-versions";
+import { abortGatewayError, createUpstreamDeadlineLifecycle } from "../../operations/upstream-deadline";
+import { qoderMachineOs } from "../../operations/cli-platform";
+import { qoderGatewayCandidates, QODER_CHAT_PATH, QODER_REALMS, type QoderRealm } from "./qoder-realm";
+import { QODER_CN_MODEL_CONFIGS, QODER_INTL_MODEL_CONFIGS, QODER_INTL_MODELS } from "./qoder-catalog";
+import { isQoderVirtualModel, qoderDispatchModelId } from "./qoder-virtual";
+
+interface QoderModeProfile {
+  readonly chatUrl: string;
+  readonly businessProduct: string;
+  readonly businessType: string;
+  readonly businessVersion: string;
+  readonly cosyScene: string;
+  readonly mirrorTopLevelSystem: boolean;
+  readonly sendBusinessHeaders: boolean;
+  readonly sendModelSourceHeaders: boolean;
+  readonly emptyAliyunUserType: boolean;
+}
+
+export const MODERN_PROFILE: QoderModeProfile = {
+  chatUrl: "https://api2.qoder.sh/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common&Encode=1",
+  businessProduct: "cli",
+  businessType: "agent",
+  businessVersion: "1.0.22",
+  cosyScene: "assistant",
+  mirrorTopLevelSystem: true,
+  sendBusinessHeaders: true,
+  sendModelSourceHeaders: true,
+  emptyAliyunUserType: true,
+};
+
+const QODER_PROVIDER_ID = "qoder" as const;
+
+export const QODER_MODEL_CONFIGS: Record<
+  string,
+  { id: string; display_name: string; max_input_tokens: number; max_output_tokens?: number; is_vl: boolean; is_reasoning: boolean; source?: string }
+> = {
+  auto: { id: "auto", display_name: "Auto", max_input_tokens: 180000, is_vl: true, is_reasoning: false },
+  ultimate: { id: "ultimate", display_name: "Ultimate", max_input_tokens: 180000, is_vl: true, is_reasoning: true },
+  performance: { id: "performance", display_name: "Performance", max_input_tokens: 272000, is_vl: true, is_reasoning: false },
+  efficient: { id: "efficient", display_name: "Efficient", max_input_tokens: 180000, is_vl: true, is_reasoning: false },
+  lite: { id: "lite", display_name: "Lite", max_input_tokens: 180000, is_vl: false, is_reasoning: true },
+  qmodel: { id: "qmodel", display_name: "Qwen 3.6 Plus", max_input_tokens: 180000, is_vl: true, is_reasoning: false },
+  qmodel_latest: { id: "qmodel_latest", display_name: "Qwen 3.7 Max", max_input_tokens: 1000000, is_vl: true, is_reasoning: false },
+  qmodel_preview: { id: "qmodel_preview", display_name: "Qwen 3.8 Max", max_input_tokens: 1000000, is_vl: true, is_reasoning: false },
+  dmodel: { id: "dmodel", display_name: "DeepSeek V4 Pro", max_input_tokens: 180000, is_vl: true, is_reasoning: true },
+  dfmodel: { id: "dfmodel", display_name: "DeepSeek V4 Flash", max_input_tokens: 180000, is_vl: true, is_reasoning: true },
+  gm51model: { id: "gm51model", display_name: "GLM 5.1", max_input_tokens: 180000, is_vl: true, is_reasoning: true },
+  kmodel: { id: "kmodel", display_name: "Kimi K2.6", max_input_tokens: 256000, is_vl: true, is_reasoning: false },
+  mmodel: { id: "mmodel", display_name: "MiniMax M2.7", max_input_tokens: 180000, is_vl: true, is_reasoning: false },
+  kmodel_latest: { id: "kmodel_latest", display_name: "Kimi K2.7 Latest", max_input_tokens: 256000, is_vl: true, is_reasoning: false },
+};
+
+const QODER_APPCODE = "cosy";
+const QODER_SIG_SECRET = "d2FyLCB3YXIgbmV2ZXIgY2hhbmdlcw==";
+/**
+ * Where a PAT is exchanged for a short-lived job token, per realm.
+ *
+ * The job token is realm-bound: one minted on the global host answers "Login
+ * expired" on the China gateway. Exchanging against the wrong host therefore
+ * looks like a dead credential rather than a routing bug, which is why the
+ * URL is derived from the realm table instead of being one constant.
+ *
+ * `intl` keeps its historical `center.qoder.sh` v3 endpoint. `cn` uses the
+ * openapi host the donor's `PATH_JOB_EXCHANGE` describes; if that path is
+ * ever wrong for CN, the failure surfaces as a 401/403 on exchange, not as a
+ * silently misrouted request.
+ */
+const QODER_JOB_TOKEN_URL = "https://center.qoder.sh/algo/api/v3/user/jobToken?Encode=1";
+function qoderJobTokenUrl(realm: QoderRealm): string {
+  return realm === "cn"
+    ? `${QODER_REALMS.cn.openapi}/api/v1/jobToken/exchange`
+    : QODER_JOB_TOKEN_URL;
+}
+const QODER_STANDARD_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+const QODER_ALPHABET = "_doRTgHZBKcGVjlvpC,@aFSx#DPuNJme&i*MzLOEn)sUrthbf%Y^w.(kIQyXqWA!";
+const QODER_RSA_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA8iMH5c02LilrsERw9t6Pv5Nc
+4k6Pz1EaDicBMpdpxKduSZu5OANqUq8er4GM95omAGIOPOh+Nx0spthYA2BqGz+l
+6HRkPJ7S236FZz73In/KVuLnwI8JJ2CbuJap8kvheCCZpmAWpb/cPx/3Vr/J6I17
+XcW+ML9FoCI6AOvOzwIDAQAB
+-----END PUBLIC KEY-----`;
+
+export interface QoderAuth {
+  userId: string;
+  userName: string;
+  userType: string;
+  securityOauthToken: string;
+  refreshToken: string;
+  machineId: string;
+}
+interface QoderModelConfig {
+  id: string;
+  display_name: string;
+  max_input_tokens: number;
+  max_output_tokens?: number;
+  is_vl: boolean;
+  is_reasoning: boolean;
+  source?: string;
+}
+
+
+function qoderMd5(value: string | Uint8Array): string {
+  return createHash("md5").update(value).digest("hex");
+}
+function qoderPathSignature(url: string): string {
+  const path = new URL(url).pathname;
+  return path.startsWith("/algo") ? path.slice(5) : path;
+}
+
+const QODER_MACHINE_ID_TTL_MS = 60 * 60 * 1000;
+const QODER_MAX_MACHINE_IDS = 1_024;
+const qoderMachineIds = new Map<string, { id: string; expiresAt: number }>();
+/**
+ * A PAT (`pt-...`) must be exchanged for a short-lived job token before it
+ * can sign COSY requests. Device tokens (`dt-...`) from OAuth login and job
+ * tokens (`jt-...`) are used directly.
+ */
+export function isQoderPat(secret: string): boolean {
+  return secret.startsWith("pt-");
+}
+
+/**
+ * Stable per-account machine id for OAuth dispatches. Derived from the
+ * account id (not minted per request) so pooled accounts keep one device
+ * fingerprint across restarts instead of looking like a new device every
+ * time, while staying distinct per account.
+ */
+export function qoderMachineIdForAccount(accountId: string): string {
+  const hex = createHash("sha256").update(`qoder-machine-v1:${accountId}`).digest("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+
+/**
+ * Builds dispatch auth from an OAuth device token. The token is used
+ * directly as the COSY identity's oauth token; the user id and machine id
+ * come from the `auth_state` the login persisted. Fails closed with a
+ * reconnect prompt when the identity is absent (e.g. an account created
+ * before `auth_state` existed) instead of signing with a guessed id.
+ */
+export function qoderOAuthAuth(
+  secret: string,
+  authState: unknown,
+  accountId: string | undefined,
+): QoderAuth {
+  const state = parseQoderOAuthState(authState);
+  if (state === undefined || !state.userId) {
+    throw new GatewayError(
+      "authentication_failed",
+      401,
+      "Qoder OAuth account is missing its user identity; sign in again",
+    );
+  }
+  return {
+    userId: state.userId,
+    userName: "",
+    userType: "personal_standard",
+    securityOauthToken: secret,
+    refreshToken: "",
+    machineId: state.machineId || (accountId ? qoderMachineIdForAccount(accountId) : randomUUID()),
+  };
+}
+
+function qoderMachineIdFromPat(pat: string): string {
+  const key = createHash("sha256").update(pat).digest("hex");
+  const now = Date.now();
+  const existing = qoderMachineIds.get(key);
+  if (existing && existing.expiresAt > now) return existing.id;
+  const id = randomUUID();
+  qoderMachineIds.delete(key);
+  qoderMachineIds.set(key, { id, expiresAt: now + QODER_MACHINE_ID_TTL_MS });
+  for (const [candidate, value] of qoderMachineIds) {
+    if (value.expiresAt <= now) qoderMachineIds.delete(candidate);
+  }
+  while (qoderMachineIds.size > QODER_MAX_MACHINE_IDS) {
+    const oldest = qoderMachineIds.keys().next();
+    if (oldest.done) break;
+    qoderMachineIds.delete(oldest.value);
+  }
+  return id;
+}
+
+function qoderStaticHeaders(machineId: string, version = getQoderVersion()): Record<string, string> {
+  const date = new Date().toUTCString();
+  return {
+    "cosy-machinetoken": machineId,
+    "cosy-machinetype": "5",
+    "cosy-machineid": machineId,
+    "cosy-clienttype": "5",
+    "cosy-version": version,
+    "login-version": "v2",
+    appcode: QODER_APPCODE,
+    accept: "application/json",
+    "accept-encoding": "identity",
+    date,
+    signature: qoderMd5(`${QODER_APPCODE}&${QODER_SIG_SECRET}&${date}`),
+    "content-type": "application/json",
+    "user-agent": "Go-http-client/2.0",
+  };
+}
+
+function transformQoderBody(plaintext: string): Uint8Array {
+  const base64 = Buffer.from(plaintext).toString("base64");
+  const third = Math.floor(base64.length / 3);
+  const reordered = base64.slice(base64.length - third) + base64.slice(third, base64.length - third) + base64.slice(0, third);
+  let encoded = "";
+  for (const char of reordered) {
+    if (char === "=") encoded += "$";
+    else encoded += QODER_ALPHABET[QODER_STANDARD_ALPHABET.indexOf(char)] ?? char;
+  }
+  return Buffer.from(encoded, "latin1");
+}
+
+function qoderBuildCosyHeaders(
+  body: Uint8Array,
+  url: string,
+  auth: QoderAuth,
+  version = getQoderVersion(),
+): Record<string, string> {
+  const key = randomUUID().replaceAll("-", "").slice(0, 16);
+  const identity = JSON.stringify({
+    name: auth.userName,
+    aid: auth.userId,
+    uid: auth.userId,
+    yx_uid: "",
+    organization_id: "",
+    organization_name: "",
+    user_type: auth.userType,
+    security_oauth_token: auth.securityOauthToken,
+    refresh_token: auth.refreshToken,
+  });
+  const cipher = createCipheriv("aes-128-cbc", Buffer.from(key), Buffer.from(key));
+  const info = Buffer.concat([cipher.update(identity), cipher.final()]).toString("base64");
+  const cosyKey = publicEncrypt({ key: QODER_RSA_PUBLIC_KEY, padding: constants.RSA_PKCS1_PADDING }, Buffer.from(key)).toString("base64");
+  const payload = Buffer.from(
+    JSON.stringify({ version: "v1", requestId: randomUUID(), info, cosyVersion: version, ideVersion: "" }),
+  ).toString("base64");
+  const date = String(Math.floor(Date.now() / 1000));
+  const signature = qoderMd5(`${payload}\n${cosyKey}\n${date}\n${Buffer.from(body).toString("latin1")}\n${qoderPathSignature(url)}`);
+  return {
+    authorization: `Bearer COSY.${payload}.${signature}`,
+    "cosy-data-policy": "agree",
+    "cosy-machinetype": "5",
+    "cosy-machineos": qoderMachineOs(),
+    "cosy-clienttype": "5",
+    "cosy-date": date,
+    "cosy-user": auth.userId,
+    "cosy-key": cosyKey,
+    "cosy-bodyhash": qoderMd5(body),
+    "cosy-bodylength": String(body.byteLength),
+    "cosy-sigpath": qoderPathSignature(url),
+    "cosy-organization-id": "",
+    "cosy-organization-tags": "",
+    "x-request-id": randomUUID(),
+    ...(MODERN_PROFILE.sendBusinessHeaders
+      ? {
+          "cosy-business-product": MODERN_PROFILE.businessProduct,
+          "cosy-business-type": MODERN_PROFILE.businessType,
+          "cosy-business-version": version,
+          "cosy-scene": MODERN_PROFILE.cosyScene,
+        }
+      : {}),
+    "cosy-version": version,
+    "login-version": "v2",
+    appcode: QODER_APPCODE,
+    accept: "application/json",
+    "accept-encoding": "identity",
+    date: new Date().toUTCString(),
+    signature: qoderMd5(`${QODER_APPCODE}&${QODER_SIG_SECRET}&${new Date().toUTCString()}`),
+    "content-type": "application/json",
+    "user-agent": "Go-http-client/2.0",
+  };
+}
+
+type QoderFetcher = (url: string, init: RequestInit) => Promise<Response>;
+
+async function exchangeQoderPat(
+  pat: string,
+  signal: AbortSignal,
+  fetcher: QoderFetcher,
+  version = getQoderVersion(),
+  realm: QoderRealm = "intl",
+): Promise<QoderAuth> {
+  const machineId = qoderMachineIdFromPat(pat);
+  const encodedBody = transformQoderBody(JSON.stringify({ payload: JSON.stringify({ personalToken: pat, securityOauthToken: "", refreshToken: "", needRefresh: false, authInfo: {} }), encodeVersion: "1" }));
+  const response = await fetcher(qoderJobTokenUrl(realm), { method: "POST", headers: qoderStaticHeaders(machineId, version), body: encodedBody as unknown as BodyInit, signal });
+  if (!response.ok) throw await mapUpstreamHttpError(response, "qoder");
+  let responseBody: unknown;
+  try {
+    responseBody = await response.json();
+  } catch {
+    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned invalid JSON", {}, "upstream");
+  }
+  if (typeof responseBody !== "object" || responseBody === null || Array.isArray(responseBody)) {
+    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned unexpected response", {}, "upstream");
+  }
+  const rec = responseBody as Record<string, unknown>;
+  if (typeof rec["id"] !== "string" || typeof rec["securityOauthToken"] !== "string") {
+    throw new GatewayError("platform_unavailable", 502, "Qoder PAT exchange returned incomplete credentials", {}, "upstream");
+  }
+  return {
+    userId: rec["id"] as string,
+    userName: typeof rec["name"] === "string" ? (rec["name"] as string) : "",
+    userType: typeof rec["userType"] === "string" ? (rec["userType"] as string) : "personal_standard",
+    securityOauthToken: rec["securityOauthToken"] as string,
+    refreshToken: typeof rec["refreshToken"] === "string" ? (rec["refreshToken"] as string) : "",
+    machineId,
+  };
+}
+
+async function callQoder(
+  url: string,
+  body: Record<string, unknown>,
+  modelId: string,
+  auth: QoderAuth,
+  signal: AbortSignal,
+  fetcher: QoderFetcher,
+  version = getQoderVersion(),
+): Promise<Response> {
+  const encoded = transformQoderBody(JSON.stringify(body));
+  const modelConfig = (body["model_config"] as Record<string, unknown> | null) ?? null;
+  return fetcher(url, {
+    method: "POST",
+    headers: {
+      ...qoderBuildCosyHeaders(encoded, url, auth, version),
+      ...(MODERN_PROFILE.sendModelSourceHeaders
+        ? { "x-model-key": modelId, "x-model-source": typeof modelConfig?.["source"] === "string" ? (modelConfig["source"] as string) : "system" }
+        : {}),
+      Accept: "text/event-stream",
+      "Cache-Control": "no-cache",
+      "Accept-Encoding": "identity",
+    },
+    body: encoded as unknown as BodyInit,
+    signal,
+  });
+}
+
+/**
+ * The human-readable text out of a Qoder error envelope.
+ *
+ * The envelope is Qoder's own wrapper around the stream, and it does not use
+ * one field for the message: the text has been seen as a nested `error`
+ * object, a bare string `body`, and a top-level `message`/`msg`. The canonical
+ * extractor covers the structured shapes; a string body and the top-level
+ * fields cover the rest. Whatever survives is bounded the same way an upstream
+ * message is, so a verbose envelope cannot blow up the public error line.
+ */
+function qoderEnvelopeMessage(rec: Record<string, unknown>): string {
+  const structured = extractUpstreamMessage(rec["body"]);
+  if (structured.length > 0) return structured;
+  if (typeof rec["body"] === "string" && rec["body"].trim().length > 0 && rec["body"] !== "[DONE]")
+    return rec["body"].replace(/[\r\n]+/g, " ").trim().slice(0, 500);
+  return extractUpstreamMessage(rec);
+}
+
+function qoderEnvelopeToFrames(data: string): Array<{ event: string | null; data: string }> {
+  if (data === "[DONE]") return [{ event: null, data: "[DONE]" }];
+  let envelope: unknown;
+  try {
+    envelope = JSON.parse(data);
+  } catch {
+  }
+  if (typeof envelope !== "object" || envelope === null || Array.isArray(envelope)) return [];
+  const rec = envelope as Record<string, unknown>;
+  if (rec["statusCodeValue"] !== undefined && rec["statusCodeValue"] !== 200) {
+    const status = typeof rec["statusCodeValue"] === "number" ? (rec["statusCodeValue"] as number) : 502;
+    // Qoder reports failures inside the stream envelope instead of as HTTP
+    // responses, so classify its structured provider code and status through
+    // the same gateway error policy as the other dispatch paths.
+    const detail = qoderEnvelopeMessage(rec);
+    const identifier = upstreamErrorIdentifier(rec["body"]) ?? upstreamErrorIdentifier(rec);
+    // Qoder signals a queued request the same way inside the stream as it does
+    // on HTTP: `{"code":"10605", "isQueued":true, "retryAfterSeconds":N}` on a
+    // non-200 envelope. The status table would read the 403 as a refusal, and
+    // the caller would end its turn on a request that was only waiting.
+    const queuedWaitMs = isUpstreamQueued(rec["body"]) ?? false;
+    const waitMs = queuedWaitMs
+      ? (queueRetryAfterMs(rec["body"]) ?? undefined)
+      : undefined;
+    const classification = queuedWaitMs
+      ? { code: "upstream_queued" as const, status: 503, origin: "upstream" as const }
+      : classifyUpstreamError(status, identifier);
+    throw new GatewayError(
+      classification.code,
+      classification.status,
+      detail.length > 0 ? detail : `Qoder stream envelope returned HTTP ${status}`,
+      {
+        providerId: QODER_PROVIDER_ID,
+        providerStatus: status,
+        ...(identifier ? { providerCode: identifier } : {}),
+        ...(classification.credentialEvidence ? { credentialEvidence: true } : {}),
+        ...(classification.rateLimitScope
+          ? { rateLimitScope: classification.rateLimitScope }
+          : {}),
+        ...(waitMs === undefined ? {} : { retryAfterMs: waitMs, cooldownMs: waitMs }),
+        ...(queuedWaitMs ? { reason: "upstream-queued" } : {}),
+      },
+      classification.origin,
+    );
+  }
+  const body = rec["body"];
+  if (body === "[DONE]") return [{ event: null, data: "[DONE]" }];
+  if (typeof body !== "string") return [];
+  return [{ event: null, data: body.replace(/\r?\n/g, "") }];
+}
+
+function qoderStableHash(prefix: string, ...parts: string[]): string {
+  const h = createHash("sha256");
+  h.update(prefix);
+  for (const p of parts) {
+    h.update("\0");
+    h.update(p);
+  }
+  return h.digest("hex").slice(0, 16);
+}
+
+function flattenCanonicalContent(content: readonly ContentPart[]): string {
+  return content
+    .filter((b) => b.kind === "text" || b.kind === "toolResult")
+    .map((b) => {
+      if (b.kind === "text") return b.text;
+      if (b.kind === "toolResult") return typeof b.content === "string" ? b.content : JSON.stringify(b.content);
+      return "";
+    })
+    .join("\n");
+}
+
+function qoderStableRecordId(modelId: string, messages: CanonicalRequest["messages"], maxTokens: number): string {
+  const h = createHash("sha256");
+  h.update("qoder-record\0");
+  h.update(modelId);
+  for (const m of messages) {
+    h.update("\0");
+    h.update(m.role);
+    const text = flattenCanonicalContent(m.content);
+    if (text) {
+      h.update("\0");
+      h.update(text);
+    }
+  }
+  h.update(`\0mt=${maxTokens}`);
+  return h.digest("hex").slice(0, 16);
+}
+
+function qoderRequestedMaxTokens(request: CanonicalRequest, modelConfig: QoderModelConfig): number {
+  /**
+   * The ceiling is the roster's stated one. A fixed 32k fallback would clamp
+   * every model alike, so a request asking for more would be silently lowered
+   * no matter which model it named.
+   */
+  const configured = typeof modelConfig.max_output_tokens === "number" ? modelConfig.max_output_tokens : 65_536;
+  const controls = request.generation_controls as Record<string, unknown>;
+  const requested =
+    typeof controls["max_tokens"] === "number"
+      ? (controls["max_tokens"] as number)
+      : typeof controls["max_output_tokens"] === "number"
+        ? (controls["max_output_tokens"] as number)
+        : null;
+  return typeof requested === "number" && requested > 0 ? Math.min(requested, configured) : configured;
+}
+
+/**
+ * Whether this model needs the prior turn's reasoning echoed back.
+ *
+ * The DeepSeek family ties multi-turn consistency to `reasoning_content`: an
+ * assistant turn that thought must be replayed with that field or the upstream
+ * refuses the whole history. The upstream reference bridge keeps it for exactly
+ * these models and drops it as noise for every other one
+ * (`keep_reasoning=is_deepseek_model(...)`, and `reasoning_content` in
+ * `NOISE_KEYS` otherwise), and notes the symptom when it is missed: occasional
+ * failures that sometimes pass on retry.
+ *
+ * Matched by the upstream key and by the display name, because a caller may
+ * name either — the reference warns that matching only the "deepseek" prefix
+ * missed every request that used the key.
+ */
+function qoderKeepsReasoning(modelId: string): boolean {
+  const key = modelId.trim().toLowerCase();
+  if (key === "dmodel" || key === "dfmodel") return true;
+  return key.startsWith("deepseek");
+}
+
+/**
+ * The `reasoning_content` field for an assistant turn, when one is needed.
+ *
+ * Presence, not length, decides: a client that already knows the rule sends
+ * `""` on a thinking turn whose text is not readable back, and dropping that
+ * empty string re-triggers the complaint it was sent to avoid.
+ *
+ * DeepSeek multi-turn consistency also backfills the field on every assistant
+ * turn once the conversation carries a reasoning trace at all — the reference
+ * bridge does the same (`backfill_reasoning_content`), and notes the symptom
+ * when it is missed: occasional failures that sometimes pass on retry. An
+ * assistant turn with no reasoning and no trace gains nothing, so nothing is
+ * fabricated.
+ */
+function qoderReasoningEcho(
+  message: { content: readonly ContentPart[] },
+  modelId: string,
+  hasReasoningTrace = false,
+): { reasoning_content: string } | Record<string, never> {
+  if (!qoderKeepsReasoning(modelId)) return {};
+  const reasoning = message.content.filter((part) => part.kind === "reasoning");
+  if (reasoning.length === 0) {
+    return hasReasoningTrace ? { reasoning_content: "" } : {};
+  }
+  const text = reasoning
+    .map((part) => (part.kind === "reasoning" ? (part.summary ?? part.payload ?? "") : ""))
+    .join("");
+  return { reasoning_content: text };
+}
+
+/**
+ * The tool arguments as the object the `tool_use` block expects.
+ *
+ * The canonical form keeps them as the raw JSON text the caller sent, which is
+ * what a chat-completions `tool_calls` entry holds. A `tool_use` block wants
+ * structured input, so the text is parsed back.
+ *
+ * The fallbacks mirror the upstream reference bridge rather than inventing
+ * shapes: unparseable text becomes `{}` and a non-object becomes `{value}`.
+ * Smuggling the raw text through instead would emit an argument shape the
+ * upstream has never seen for this field.
+ */
+/**
+ * Projects the canonical tools onto Qoder's chat-completions `tools` array.
+ *
+ * Without this the upstream is never told a tool exists, so a model that wants
+ * one improvises markup in its prose (`<Read file_path="..." />`) instead of
+ * emitting a structured call — the call is then neither runnable nor
+ * recoverable, because it never was a call on either side.
+ *
+ * Only `function` tools are representable upstream. Anything else is dropped
+ * rather than forwarded: Qoder rejects an unknown variant during
+ * deserialization and fails the whole turn, which is worse than omitting a
+ * tool the model could not have used anyway.
+ */
+function qoderTools(
+  tools: readonly ToolDefinition[] | undefined,
+): Array<Record<string, unknown>> {
+  const out: Array<Record<string, unknown>> = [];
+  for (const tool of tools ?? []) {
+    if (tool.tool_type !== undefined && tool.tool_type !== "function") continue;
+    // The upstream requires `tools[].function` to be an object. A flat
+    // declaration naming the tool at the top level is rejected outright with
+    // "'function' is a required property, expected an object", which fails the
+    // whole request rather than just this tool.
+    out.push({
+      type: "function",
+      function: {
+        name: tool.name,
+        ...(tool.description === undefined ? { description: "" } : { description: tool.description }),
+        parameters: tool.jsonSchema ?? { type: "object", properties: {} },
+        ...(tool.strict === undefined ? {} : { strict: tool.strict }),
+      },
+    });
+  }
+  return out;
+}
+
+
+/**
+ * Projects the canonical tool choice onto the upstream's field.
+ *
+ * The upstream only accepts a string here. Given the object form
+ * `{type:"function",function:{name}}` it ignores the field, and the model then
+ * calls the tool with no arguments filled in.
+ *
+ * `allowed_tools` has no chat-completions equivalent, so it collapses to the
+ * direction it already names rather than being dropped: a caller that asked for
+ * `required` must not silently get `auto`.
+ */
+function qoderToolChoice(choice: ToolChoice | undefined): unknown {
+  if (choice === undefined) return undefined;
+  if (typeof choice === "string") return choice;
+  if (choice.type === "tool" || choice.type === "custom") {
+    const name = choice.name.trim();
+    return name.length > 0 ? name : "auto";
+  }
+  return choice.mode;
+}
+
+/**
+ * Marks a tool call recorded into the text of an assistant turn.
+ *
+ * The upstream only reads structured turns on its CN realm, so on INTL a past
+ * call has to be described in prose or the model loses the record of what it
+ * asked for. The wording matches the reference bridge, which is what the
+ * upstream has been trained to read back.
+ */
+const QODER_TOOL_MARKER = "[assistant 请求调用工具]";
+
+/**
+ * Whether this request sends its tool history as structured turns.
+ *
+ * The upstream honours the structured form on its CN realm only. On INTL it is
+ * not enabled, and sending it anyway yields tool calls that come back right in
+ * name but with no arguments filled in — a call that cannot run. So the shape
+ * follows the realm rather than being assumed everywhere.
+ */
+function qoderStructuredTools(realm: QoderRealm): boolean {
+  return realm === "cn";
+}
+
+export function buildQoderRequest(
+  modelId: string,
+  request: CanonicalRequest,
+  modelConfig: QoderModelConfig,
+  auth: QoderAuth,
+  realm: QoderRealm = "intl",
+): Record<string, unknown> {
+  const allMessages = request.messages;
+  const systemParts: string[] = [];
+  if (request.system) {
+    for (const p of request.system) if (p.kind === "text") systemParts.push(p.text);
+  }
+  if (request.instructions) {
+    for (const p of request.instructions) if (p.kind === "text") systemParts.push(p.text);
+  }
+  for (const m of allMessages) {
+    if (m.role === "system" || m.role === "developer") {
+      const t = flattenCanonicalContent(m.content);
+      if (t) systemParts.push(t);
+    }
+  }
+  const systemPrompt = systemParts.join("\n\n").trim();
+  const qoderMessages: Array<Record<string, unknown>> = [];
+  const structuredTools = qoderStructuredTools(realm);
+  // DeepSeek multi-turn: once any turn in the conversation carries a reasoning
+  // trace, every assistant message must replay `reasoning_content` (see
+  // `qoderReasoningEcho`).
+  const hasReasoningTrace = allMessages.some((message) =>
+    message.content.some((part) => part.kind === "reasoning"),
+  );
+  if (MODERN_PROFILE.mirrorTopLevelSystem && systemPrompt.length > 0) {
+    qoderMessages.push({
+      role: "system",
+      content: systemPrompt,
+    });
+  }
+  for (const m of allMessages) {
+    if (m.role === "system" || m.role === "developer") continue;
+    // Answers may live in a `user` turn (the Messages ledger re-homes them),
+    // so the result scan is role-agnostic. Each result becomes its own `tool`
+    // turn carrying its `tool_call_id`; any non-result content on the same turn
+    // is emitted after, so nothing is duplicated or lost.
+    const results = structuredTools ? toolResultParts(m) : [];
+    if (results.length > 0) {
+      for (const block of results) {
+        const text = flattenCanonicalContent(
+          typeof block.content === "string"
+            ? [{ kind: "text", text: block.content }]
+            : block.content,
+        );
+        qoderMessages.push({
+          role: "tool",
+          content: text,
+          tool_call_id: block.call_id,
+        });
+      }
+      // Text that shared the turn with a result is emitted after it, minus the
+      // result itself. Re-emitting the result's own text here was doubling
+      // every tool answer: the `tool` turn above and a `user` turn with the
+      // same content, which doubled the payload for no reason.
+      const remaining = m.content.filter((part) => part.kind !== "toolResult");
+      const flat = flattenCanonicalContent(remaining);
+      if (flat.length === 0) continue;
+      qoderMessages.push({
+        role: "user",
+        content: flat,
+      });
+      continue;
+    }
+    // An assistant turn that called tools must carry the calls, not just its
+    // text. Falling through to the text-only emit dropped them, so the payload
+    // arrived as a `tool` result with no preceding call and the upstream
+    // rejected the whole transcript: "Messages with role 'tool' must be a
+    // response to a preceding message with 'tool_calls'".
+    const allCalls = m.content.filter((part) => part.kind === "toolCall");
+    const reasoningEcho = qoderReasoningEcho(m, modelId, hasReasoningTrace);
+    // Structured tool turns are only safe when every call carries an id — the
+    // upstream drops or rejects a transcript whose `tool` result answers a call
+    // without one. Fall back to prose history exactly like INTL in that case.
+    const structuredIdsOk = allCalls.every(
+      (part) => typeof part.call_id === "string" && part.call_id.length > 0,
+    );
+    if ((!structuredTools || !structuredIdsOk) && allCalls.length > 0) {
+      // INTL does not read structured turns, so the call is written into the
+      // text instead of being dropped. Dropping it left the next `tool` turn
+      // answering a call that was never made, and the model had no record of
+      // what it had asked for — so it re-emitted a call with no arguments.
+      //
+      // The marker and the JSON shape mirror the reference bridge, which is
+      // what the upstream has actually been trained to read back.
+      const textParts = m.content.filter((part) => part.kind !== "toolCall");
+      const prose = flattenCanonicalContent(textParts);
+      const recorded = allCalls.map((part) => ({
+        name: part.name,
+        arguments: typeof part.arguments === "string" ? part.arguments : "",
+      }));
+      qoderMessages.push({
+        role: "assistant",
+        content: (prose.length > 0 ? prose + "\n\n" : "") + QODER_TOOL_MARKER + "\n" + JSON.stringify(recorded),
+        ...reasoningEcho,
+      });
+      continue;
+    }
+    const calls = structuredTools && structuredIdsOk ? allCalls : [];
+    if (calls.length > 0) {
+      const textParts = m.content.filter((part) => part.kind !== "toolCall");
+      const flat = flattenCanonicalContent(textParts);
+      qoderMessages.push({
+        role: "assistant",
+        content: flat,
+        ...reasoningEcho,
+        tool_calls: calls.map((part) => ({
+          id: part.call_id,
+          type: "function",
+          function: {
+            name: part.name,
+            arguments: typeof part.arguments === "string" ? part.arguments : "",
+          },
+        })),
+      });
+      continue;
+    }
+    const role = m.role === "assistant" ? "assistant" : "user";
+    // Images must travel as structured OpenAI parts inside the message content —
+    // the upstream reads `image_url` parts there and not the top-level
+    // `image_urls` (mirroring `flatten_messages` in the reference bridge). A
+    // bare file_id reference degrades to a text note instead of being dropped.
+    const hasImages = m.content.some((part) => part.kind === "image");
+    if (hasImages) {
+      const parts: Array<Record<string, unknown>> = [];
+      for (const part of m.content) {
+        if (part.kind === "text") {
+          parts.push({ type: "text", text: part.text });
+        } else if (part.kind === "image") {
+          const source = resolveImageSource(part.payload);
+          if (source?.url !== undefined) {
+            parts.push({ type: "image_url", image_url: { url: source.url } });
+          } else {
+            parts.push({
+              type: "text",
+              text: source?.fileId !== undefined ? `[image: ${source.fileId}]` : "[image: unsupported source]",
+            });
+          }
+        }
+      }
+      qoderMessages.push({
+        role,
+        content: parts,
+        ...(role === "assistant" ? qoderReasoningEcho(m, modelId, hasReasoningTrace) : {}),
+      });
+      continue;
+    }
+    const flat = flattenCanonicalContent(m.content);
+    qoderMessages.push({
+      role,
+      content: flat,
+      ...(role === "assistant" ? qoderReasoningEcho(m, modelId, hasReasoningTrace) : {}),
+    });
+  }
+  const latestUserMessage = [...qoderMessages].reverse().find((m) => m["role"] === "user");
+  const latestUserText = typeof latestUserMessage?.["content"] === "string" ? (latestUserMessage["content"] as string) : "";
+  const maxTokens = qoderRequestedMaxTokens(request, modelConfig);
+  const reasoning = modelConfig.is_reasoning === true;
+  const sessionId = qoderStableHash("qoder-session", auth.userId, modelId);
+  const recordId = qoderStableRecordId(modelId, allMessages, maxTokens);
+  return {
+    request_id: randomUUID(),
+    request_set_id: recordId,
+    chat_record_id: recordId,
+    session_id: sessionId,
+    stream: true,
+    ...(MODERN_PROFILE.emptyAliyunUserType ? { aliyun_user_type: "" } : {}),
+    chat_task: "FREE_INPUT",
+    is_reply: true,
+    is_retry: false,
+    source: 1,
+    version: "3",
+    session_type: "qodercli",
+    agent_id: "agent_common",
+    task_id: "common",
+    code_language: "",
+    chat_prompt: MODERN_PROFILE.mirrorTopLevelSystem ? systemPrompt : "",
+    image_urls: null,
+    chat_context: {
+      chatPrompt: MODERN_PROFILE.mirrorTopLevelSystem ? systemPrompt : "",
+      imageUrls: null,
+      extra: { context: [], modelConfig: { key: modelId, is_reasoning: reasoning }, originalContent: { text: latestUserText } },
+      features: [],
+      // An object, as the reference sends it: `cc["text"]["text"] = prompt`.
+      text: { text: latestUserText },
+    },
+    model_config: {
+      key: modelId,
+      display_name: modelConfig.display_name,
+      // Declares the wire dialect for the tool calls. Without it the upstream
+      // does not read the OpenAI-shaped `tools` array the same way, and the
+      // model then emits a call with no arguments filled in.
+      format: "openai",
+      model: "",
+      api_key: "",
+      url: "",
+      is_vl: modelConfig.is_vl,
+      is_reasoning: modelConfig.is_reasoning,
+      max_input_tokens: modelConfig.max_input_tokens,
+      // Mirrors the roster's stated ceiling. A fixed 32k fallback would be sent
+      // for every model alike, so the request would declare a cap the catalog
+      // does not publish.
+      max_output_tokens: modelConfig.max_output_tokens ?? 65_536,
+      source: modelConfig.source ?? "system",
+    },
+    messages: qoderMessages,
+    max_tokens: maxTokens,
+    // Always present, even when empty. Omitting the field makes Qoder fall back
+    // to the desktop agent's own toolset (Bash/Edit/...), which then leaks to a
+    // caller that declared none — the reference bridge sends `[]` for exactly
+    // that reason. Parallel calls are stated explicitly rather than left to the
+    // upstream default, so a caller expecting them is not served serial
+    // behaviour.
+    tools: qoderTools(request.tools),
+    parallel_tool_calls: true,
+    ...(() => {
+      const choice = qoderToolChoice(request.tool_choice);
+      return choice === undefined ? {} : { tool_choice: choice };
+    })(),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// DSML tool-call recovery — DeepSeek's native markup in the text stream
+// ---------------------------------------------------------------------------
+// Some DeepSeek-family models write their tool calls as XML-like DSML markup
+// inside the plain-text `content` stream instead of the structured
+// `tool_calls` field. Left alone, the markup reaches the caller as visible
+// prose and the tool never runs — which is exactly the symptom reported.
+//
+// The parser lives in `src/protocol/dsml.ts`, shared with the CodeBuddy
+// family; Qoder selects the fuzzy dialect, which mirrors the reference bridge's
+// Python regexes (`qoder_proxy.py`, `parse_dsml_tool_calls`).
+import {
+  parseFuzzyDsmlToolCalls,
+  dsmlTailHold,
+  stripDsmlCloseTags,
+  type DsmlToolCall,
+} from "../../../protocol/dsml";
+
+/** Qoder's dialect bounds the shared parser to the fuzzy (non-strict) form. */
+export const parseDsmlToolCalls = (text: string) => parseFuzzyDsmlToolCalls(text);
+export { dsmlTailHold, stripDsmlCloseTags } from "../../../protocol/dsml";
+
+/** One recovered call, in the shape the canonical events want. */
+export type DsmlCall = DsmlToolCall;
+
+/**
+ * Escapes the bare quotes that belong inside a JSON string value.
+ *
+ * Escaped quotes are parked first so they are not escaped twice, then every
+ * remaining quote is escaped, then the parked ones are restored.
+ */
+function repairJsonQuotes(text: string): string {
+  const ph = "\u0000";
+  return text.replace(/\\"/g, ph).replace(/"/g, '\\"').replaceAll(ph, '\\"');
+}
+
+/** `[{"name":"…","arguments":"<unescaped JSON>"}]`, one call only. */
+const ECHO_LOOSE_RE = /^\[\s*\{\s*"name"\s*:\s*"([^"]{1,200})"\s*,\s*"arguments"\s*:\s*"(.*)"\s*\}\s*\]$/s;
+
+/**
+ * Any spelling of the INTL tool-call leak marker — the square-bracket
+ * canonical form, the angle-bracket variant the upstream also emits
+ * (`<assistant 请求调用工具>`), and partial variants missing the closing
+ * bracket. Mirrors `_LEAK_MARKER_RE` in the reference bridge.
+ */
+const LEAK_MARKER_ANY_RE = /[\[<(]*\s*assistant\s*请求调用工具\s*[\]>)]?/;
+
+/** Canonical marker literal used to seed prefix matching. */
+const LEAK_MARKER_LITERALS: readonly string[] = [
+  "[assistant 请求调用工具]",
+  "<assistant 请求调用工具>",
+  "assistant 请求调用工具",
+];
+
+/** Longest partial marker we hold across frames (mirrors `_MARKER_HOLD_WINDOW`). */
+const LEAK_HOLD_WINDOW = 24;
+/** Fail-open caps so an endless lookalike cannot hold text forever. */
+const LEAK_HOLD_MAX_CHARS = 32_768;
+const LEAK_HOLD_MAX_FRAMES = 200;
+
+/**
+ * True when `suffix` is a strict prefix of some marker literal — the stream
+ * may be mid-marker and the rest arrives in the next frame.
+ */
+function isLeakMarkerPrefix(suffix: string): boolean {
+  if (suffix.length === 0 || suffix.length >= LEAK_HOLD_WINDOW) return false;
+  return LEAK_MARKER_LITERALS.some((literal) => literal.startsWith(suffix));
+}
+
+/**
+ * Splits one content chunk into `{ emit, hold }`, mirroring the reference
+ * bridge's `_find_marker_split`: prose before a complete marker is emitted
+ * immediately, the marker and everything after it is held, and a partial
+ * marker at the very end is held for the next frame.
+ */
+function qoderLeakSplit(text: string): { emit: string; hold: string } {
+  if (text.length === 0) return { emit: "", hold: "" };
+  const marker = LEAK_MARKER_ANY_RE.exec(text);
+  if (marker) {
+    return { emit: text.slice(0, marker.index), hold: text.slice(marker.index) };
+  }
+  // No complete marker: hold a trailing partial-marker suffix only.
+  const tail = text.slice(-LEAK_HOLD_WINDOW);
+  for (let n = tail.length; n >= 1; n -= 1) {
+    const seg = tail.slice(-n);
+    if (isLeakMarkerPrefix(seg)) {
+      return { emit: text.slice(0, text.length - n), hold: text.slice(text.length - n) };
+    }
+  }
+  return { emit: text, hold: "" };
+}
+
+/**
+ * True when `text` is still plausibly the INTL leak block (marker + JSON
+ * array). Used to keep holding across frames; false means it is ordinary
+ * prose and can be released. Mirrors `_still_leak_candidate`.
+ */
+function qoderStillLeakCandidate(text: string): boolean {
+  if (text.length === 0) return true;
+  const marker = LEAK_MARKER_ANY_RE.exec(text);
+  if (!marker) {
+    // No complete marker yet: still a candidate only while it could grow into
+    // one (full prefix or pending marker remainder).
+    return isLeakMarkerPrefix(text) || LEAK_MARKER_ANY_RE.test(text);
+  }
+  const rest = text.slice(marker.index + marker[0].length).trim();
+  if (rest.length === 0) return true;
+  if (rest.startsWith("[")) return true;
+  if (rest.startsWith("{")) return true;
+  return false;
+}
+
+/**
+ * Rebuilds the single-call echo shape when strict parsing fails.
+ *
+ * Returns `null` when the text is not that shape at all, so a caller can fall
+ * back rather than accepting a guess. The result still goes through the same
+ * strict checks as a normally-parsed array.
+ */
+function salvageEchoArray(rest: string): unknown {
+  const m = ECHO_LOOSE_RE.exec(rest.trim());
+  if (!m) return null;
+  const name = m[1] ?? "";
+  const raw = m[2] ?? "";
+  for (const candidate of [raw, repairJsonQuotes(raw)]) {
+    try {
+      JSON.parse(candidate);
+      return [{ name, arguments: candidate }];
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+
+/**
+ * Recovers a tool call the model echoed back as text.
+ *
+ * On INTL the upstream reads tool calls as prose, so a turn that called a tool
+ * is described with `QODER_TOOL_MARKER` followed by a JSON array of
+ * `{name, arguments}`. The model occasionally reproduces that shape verbatim as
+ * its answer instead of calling again, and left alone the client shows the JSON
+ * as content while the tool never runs.
+ *
+ * Only a well-formed array whose every entry names a tool and carries parseable
+ * arguments is accepted. Anything else returns no calls and the original text,
+ * so a model merely talking about the format is never mistaken for a call.
+ */
+export function parseLeakedToolCalls(
+  text: string,
+  allowedNames?: ReadonlySet<string>,
+): { calls: DsmlCall[]; clean: string } {
+  if (text.length === 0) {
+    return { calls: [], clean: text };
+  }
+  // The upstream occasionally echoes the marker in variants — angle brackets,
+  // a missing closing bracket, or wrapped inside a ``` fence. Strip a leading
+  // fence, then locate any marker spelling, mirroring the reference bridge's
+  // `_normalize_leak_marker`.
+  const fence = text.match(/^```[a-z]*\s*\n?/i);
+  const src = fence && fence[0] ? text.slice(fence[0].length) : text;
+  const marker = LEAK_MARKER_ANY_RE.exec(src);
+  if (!marker) {
+    return { calls: [], clean: text };
+  }
+  const head = src.slice(0, marker.index).trim();
+  let rest = src.slice(marker.index + marker[0].length).trim();
+  // The model occasionally leaves raw DSML closing tags after the echo array
+  // (`</｜DSML｜parameter>` etc.), and a ``` fence may close the block. Strip
+  // trailing residue so the JSON parse is not poisoned by "Extra data".
+  rest = stripDsmlCloseTags(rest);
+  rest = rest.replace(/\s*```\s*$/, "").trim();
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(rest);
+  } catch {
+    // A model echoing the call writes the inner quotes unescaped:
+    // `[{"name":"Read","arguments":"{"file_path":"a.ts"}"}]`. That is not
+    // valid JSON at either level, so the array has to be rebuilt before it can
+    // be trusted. Only the single-call shape is salvaged, which is what an echo
+    // almost always is.
+    const salvaged = salvageEchoArray(rest);
+    if (salvaged === null) return { calls: [], clean: text };
+    parsed = salvaged;
+  }
+  if (Array.isArray(parsed) && parsed.length === 0) return { calls: [], clean: text };
+
+  // The model echoes the call either as a JSON array (`[{name,arguments},…]`)
+  // or as a single object (`{"name":…,"arguments":…}`). Normalize the single
+  // object into a one-entry array so both shapes share one validator.
+  const items: unknown[] = Array.isArray(parsed) ? parsed : [parsed];
+  const calls: DsmlCall[] = [];
+  for (const item of items) {
+    if (typeof item !== "object" || item === null) return { calls: [], clean: text };
+    const rec = item as Record<string, unknown>;
+    const name = typeof rec["name"] === "string" ? rec["name"].trim() : "";
+    if (name.length === 0) return { calls: [], clean: text };
+    if (allowedNames && !allowedNames.has(name)) return { calls: [], clean: text };
+    let args = rec["arguments"];
+    if (typeof args === "object" && args !== null) args = JSON.stringify(args);
+    if (typeof args !== "string") return { calls: [], clean: text };
+    // Arguments that do not parse are not a call this can trust.
+    if (args.trim().length > 0) {
+      try {
+        JSON.parse(args);
+      } catch {
+        return { calls: [], clean: text };
+      }
+    }
+    calls.push({ id: `call_${randomUUID().replace(/-/g, "").slice(0, 16)}`, name, arguments: args });
+  }
+  return { calls, clean: head };
+}
+
+// Stream transformation — decode SSE, unwrap COSY envelope, map OpenAI chat chunks to CanonicalEvent
+
+function mapQoderFinishReason(raw: unknown): CanonicalStopReason | undefined {
+  if (raw === "length") return "length";
+  if (raw === "tool_calls") return "tool_use";
+  if (raw === "content_filter") return "content_filter";
+  return undefined;
+}
+
+export async function* qoderBodyToCanonicalEvents(
+  body: ReadableStream<Uint8Array>,
+  signal: AbortSignal,
+  model: string,
+): AsyncIterable<CanonicalEvent> {
+  let seq = 1;
+  yield { type: "response_start", sequence_number: seq++, model } as CanonicalEvent;
+  let finishReason: unknown = undefined;
+  let rawUsage: Record<string, unknown> | undefined = undefined;
+  let hasTerminal = false;
+  /** First-sighting id per wire tool-call index, for continuation chunks. */
+  const indexIds = new Map<number, string>();
+  /** Last seen call id/name, for index-less continuation fragments. */
+  let lastSeenToolId: string | undefined = undefined;
+  let lastSeenToolName: string | undefined = undefined;
+  // DSML recovery state. While `buf` is empty the text passes through
+  // untouched; once a chunk carries DSML the rest is buffered so the markup can
+  // be parsed whole at end of stream. `tail` holds a possible half-tag that
+  // straddles a frame boundary.
+  let buf = "";
+  let tail = "";
+  // Text that flowed through while not in a DSML stream. The INTL leak marker
+  // (`[assistant 请求调用工具] …`) is not DSML, so it was never buffered and
+  // recovered; keeping the plain text lets the end-of-stream recovery see it.
+  let plainBuf = "";
+  // INTL leak-marker hold-back. Text that may grow into the leak block is
+  // withheld from the client (not yielded) until the stream proves it is
+  // either a tool-call echo (recovered at end of stream) or ordinary prose
+  // (released). Mirrors the reference bridge's `hold` logic.
+  let leakBuf = "";
+  let leakFrames = 0;
+  /** Calls recovered from the thinking channel, emitted if content had none. */
+  let reasonCalls: readonly DsmlCall[] = [];
+  /** True once any tool call has been emitted by any channel this turn. */
+  let hasEmittedToolCall = false;
+  // The same recovery for the thinking channel. A model that plans its call
+  // inside `reasoning_content` writes the markup there instead of in `content`,
+  // so recovering only the content channel loses the call *and* leaves the
+  // tags visible in the user's thinking.
+  let reasonBuf = "";
+  let reasonTail = "";
+
+  for await (const sse of decodeSseEvents(body, { signal })) {
+    const sseData = sse.data;
+    let frames: Array<{ event: string | null; data: string }>;
+    try {
+      frames = qoderEnvelopeToFrames(sseData);
+    } catch (e) {
+      throw e;
+    }
+    for (const frame of frames) {
+      const data = frame.data.trim();
+      if (!data) continue;
+      if (data === "[DONE]") {
+        hasTerminal = true;
+        continue;
+      }
+      let json: Record<string, unknown>;
+      try {
+        json = JSON.parse(data) as Record<string, unknown>;
+      } catch {
+        continue;
+      }
+      if (json["usage"] && typeof json["usage"] === "object") rawUsage = json["usage"] as Record<string, unknown>;
+      const choices = (json["choices"] as Array<Record<string, unknown>>) ?? [];
+      for (const choice of choices) {
+        const delta = choice["delta"] as Record<string, unknown> | undefined;
+        if (delta) {
+          if (typeof delta["content"] === "string" && (delta["content"] as string).length > 0) {
+            const piece = tail + (delta["content"] as string);
+            tail = "";
+            if (buf.length === 0) {
+              // Not yet in a DSML stream: hold back only a possible tag start,
+              // and pass everything before it through unchanged.
+              const hold = dsmlTailHold(piece);
+              const body = hold.length > 0 ? piece.slice(0, piece.length - hold.length) : piece;
+              if (body.includes("DSML")) {
+                buf = body;
+                tail = hold;
+                continue;
+              }
+              // INTL leak-marker hold-back: do not let a marker echo reach the
+              // client as text. Prose before a complete marker is emitted now;
+              // the marker and anything after it are held until the stream
+              // decides (a valid echo → tool calls; anything else → released).
+              if (leakBuf.length > 0) {
+                leakBuf += body;
+                leakFrames += 1;
+                if (
+                  leakBuf.length > LEAK_HOLD_MAX_CHARS ||
+                  leakFrames > LEAK_HOLD_MAX_FRAMES ||
+                  !qoderStillLeakCandidate(leakBuf)
+                ) {
+                  // Released as ordinary prose: it was already shown, so it
+                  // must not re-enter `plainBuf` (the end-of-stream recovery
+                  // would re-parse it and emit a duplicate tool call).
+                  if (leakBuf.length > 0) {
+                    yield {
+                      type: "content_delta",
+                      sequence_number: seq++,
+                      content: { kind: "text", text: leakBuf },
+                    } as CanonicalEvent;
+                  }
+                  leakBuf = "";
+                  leakFrames = 0;
+                }
+                tail = hold;
+                continue;
+              }
+              const { emit, hold: leakHold } = qoderLeakSplit(body);
+              if (emit.length > 0) {
+                plainBuf += emit;
+                yield {
+                  type: "content_delta",
+                  sequence_number: seq++,
+                  content: { kind: "text", text: emit },
+                } as CanonicalEvent;
+              }
+              if (leakHold.length > 0) {
+                leakBuf = leakHold;
+                leakFrames = 1;
+                tail = hold;
+                continue;
+              }
+              // No marker at all: `emit` already covered the whole body, so
+              // only yield here when the split held nothing and emitted nothing.
+              if (emit.length === 0 && body.length > 0) {
+                plainBuf += body;
+                yield {
+                  type: "content_delta",
+                  sequence_number: seq++,
+                  content: { kind: "text", text: body },
+                } as CanonicalEvent;
+              }
+              tail = hold;
+              continue;
+            }
+            buf += piece;
+            continue;
+          }
+          const reasoningText = readReasoningText(delta);
+          if (typeof reasoningText === "string" && reasoningText.length > 0) {
+            const piece = reasonTail + reasoningText;
+            reasonTail = "";
+            if (reasonBuf.length === 0) {
+              const hold = dsmlTailHold(piece);
+              const body = hold.length > 0 ? piece.slice(0, piece.length - hold.length) : piece;
+              if (body.includes("DSML")) {
+                reasonBuf = body;
+                reasonTail = hold;
+                continue;
+              }
+              const visible = stripDsmlCloseTags(body);
+              if (visible.length > 0) {
+                yield {
+                  type: "content_delta",
+                  sequence_number: seq++,
+                  content: { kind: "reasoning", payload: null, summary: visible },
+                } as CanonicalEvent;
+              }
+              reasonTail = hold;
+              continue;
+            }
+            reasonBuf += piece;
+            continue;
+          }
+          const toolCalls = delta["tool_calls"] as Array<Record<string, unknown>> | undefined;
+          if (toolCalls) {
+            for (const tc of toolCalls) {
+              const fn = tc["function"] as Record<string, unknown> | undefined;
+              const index = typeof tc["index"] === "number" ? (tc["index"] as number) : undefined;
+              const declaredId = typeof tc["id"] === "string" ? (tc["id"] as string) : undefined;
+              const fragName = typeof fn?.["name"] === "string" ? (fn["name"] as string) : undefined;
+              // OpenAI continuation chunks re-identify their call by wire
+              // `index` alone — the `id` appears only once, in the first chunk.
+              // Some bridges omit `index` too, so a fragment then falls back to
+              // the most recently seen call id (mirroring the generic chat
+              // parser's `lastSeenToolId`). Pinning the first id per index and
+              // reusing it for continuations is what keeps fragments attached
+              // to the right call; synthesizing a fresh `call_<index>` id per
+              // chunk instead made every continuation an unknown nameless call
+              // that encoders dropped, so the client saw a call whose arguments
+              // were always empty.
+              let callId: string;
+              if (declaredId !== undefined) {
+                callId = declaredId;
+                if (index !== undefined) indexIds.set(index, callId);
+                lastSeenToolId = callId;
+                if (fragName !== undefined) lastSeenToolName = fragName;
+              } else if (index !== undefined && indexIds.has(index)) {
+                callId = indexIds.get(index)!;
+              } else if (
+                lastSeenToolId !== undefined &&
+                (fragName === undefined || lastSeenToolName === fragName)
+              ) {
+                callId = lastSeenToolId;
+              } else {
+                callId = `call_${String(index ?? 0)}`;
+              }
+              hasEmittedToolCall = true;
+              yield {
+                type: "tool_call_delta",
+                sequence_number: seq++,
+                call_id: callId,
+                ...(index !== undefined ? { index } : {}),
+                ...(fragName === undefined ? {} : { name: fragName }),
+                arguments_delta: (fn?.["arguments"] as string) ?? "",
+              } as CanonicalEvent;
+            }
+          }
+        }
+        const fr = choice["finish_reason"];
+        if (fr !== null && fr !== undefined) finishReason = fr;
+        // Some providers send usage in choices[0].usage or top-level
+        if (choice["usage"] && typeof choice["usage"] === "object") rawUsage = choice["usage"] as Record<string, unknown>;
+      }
+      // Some Qoder chunks carry finish_reason at top level
+      if (json["finish_reason"] !== undefined) finishReason = json["finish_reason"];
+    }
+  }
+  // End of stream: resolve whatever the DSML buffer collected.
+  if (reasonBuf.length > 0) {
+    const { calls, clean } = parseDsmlToolCalls(reasonBuf);
+    const visible = stripDsmlCloseTags(clean).trim();
+    if (visible.length > 0) {
+      yield {
+        type: "content_delta",
+        sequence_number: seq++,
+        content: { kind: "reasoning", payload: null, summary: visible },
+      } as CanonicalEvent;
+    }
+    // A call recovered here counts exactly like one recovered from the content
+    // channel — the two are deduplicated below, so a model that writes the
+    // block in one channel and its tail in the other still yields one call.
+    if (calls.length > 0) reasonCalls = calls;
+  }
+  if (buf.length > 0) {
+    // Two ways a call can arrive as text: DSML markup, and the marker + JSON
+    // array the upstream itself uses on INTL. The second is tried only when the
+    // first finds nothing, so a DSML stream is never re-read as an echo.
+    let { calls, clean } = parseDsmlToolCalls(buf);
+    if (calls.length === 0) {
+      const leaked = parseLeakedToolCalls(buf);
+      if (leaked.calls.length > 0) {
+        calls = leaked.calls;
+        clean = leaked.clean;
+      }
+    }
+    if (calls.length > 0) {
+      const visible = stripDsmlCloseTags(clean).trim();
+      if (visible.length > 0) {
+        yield {
+          type: "content_delta",
+          sequence_number: seq++,
+          content: { kind: "text", text: visible },
+        } as CanonicalEvent;
+      }
+      for (const call of calls) {
+        hasEmittedToolCall = true;
+        yield {
+          type: "tool_call_delta",
+          sequence_number: seq++,
+          call_id: call.id,
+          name: call.name,
+          arguments_delta: call.arguments,
+        } as CanonicalEvent;
+      }
+      reasonCalls = [];
+      // The turn ended by calling a tool, whatever the upstream reported.
+      finishReason = "tool_calls";
+    } else {
+      // Unparseable markup: emit as prose rather than dropping it, so nothing
+      // the model said is lost.
+      const visible = stripDsmlCloseTags(buf).trim();
+      if (visible.length > 0) {
+        yield {
+          type: "content_delta",
+          sequence_number: seq++,
+          content: { kind: "text", text: visible },
+        } as CanonicalEvent;
+      }
+    }
+  }
+  // Content carried no call of its own: whatever the thinking channel
+  // recovered is the turn's call.
+  for (const call of reasonCalls) {
+    hasEmittedToolCall = true;
+    yield {
+      type: "tool_call_delta",
+      sequence_number: seq++,
+      call_id: call.id,
+      name: call.name,
+      arguments_delta: call.arguments,
+    } as CanonicalEvent;
+  }
+  // The INTL leak marker is plain text, not DSML, so it flowed through to
+  // `plainBuf` instead of the buffered `buf`. Recover it the same way: a
+  // model that answers with `[assistant 请求调用工具] [{"name":…,"arguments":…}]`
+  // intended the tool to run, and left alone the client sees the JSON as
+  // content while nothing executes. Only when no other channel already
+  // claimed the turn.
+  if (!hasEmittedToolCall) {
+    // Held-back marker block first: it was withheld from the client, so a
+    // recovery here never duplicates text already shown. A valid echo becomes
+    // tool calls; anything else is released as ordinary prose.
+    if (leakBuf.length > 0) {
+      const leaked = parseLeakedToolCalls(leakBuf);
+      if (leaked.calls.length > 0) {
+        for (const call of leaked.calls) {
+          hasEmittedToolCall = true;
+          yield {
+            type: "tool_call_delta",
+            sequence_number: seq++,
+            call_id: call.id,
+            name: call.name,
+            arguments_delta: call.arguments,
+          } as CanonicalEvent;
+        }
+        finishReason = "tool_calls";
+      } else if (leaked.clean.length > 0) {
+        yield {
+          type: "content_delta",
+          sequence_number: seq++,
+          content: { kind: "text", text: leaked.clean },
+        } as CanonicalEvent;
+      }
+    }
+    if (plainBuf.length > 0 && !hasEmittedToolCall) {
+      const leaked = parseLeakedToolCalls(plainBuf);
+      if (leaked.calls.length > 0) {
+        for (const call of leaked.calls) {
+          hasEmittedToolCall = true;
+          yield {
+            type: "tool_call_delta",
+            sequence_number: seq++,
+            call_id: call.id,
+            name: call.name,
+            arguments_delta: call.arguments,
+          } as CanonicalEvent;
+        }
+        finishReason = "tool_calls";
+      }
+    }
+  }
+  // A recovered call outranks what the upstream reported. It says `stop`
+  // because the markup never became a real tool call on its side, so leaving it
+  // alone ends the turn "finished" with a call the caller never sees run.
+  if (reasonCalls.length > 0) finishReason = "tool_calls";
+  if (tail.length > 0) {
+    yield {
+      type: "content_delta",
+      sequence_number: seq++,
+      content: { kind: "text", text: tail },
+    } as CanonicalEvent;
+  }
+  // If no terminal arrived, synthesize one (prevents truncation error)
+  const stopReason = mapQoderFinishReason(finishReason);
+  const _providerStop = typeof finishReason === "string" ? finishReason : undefined;
+  void hasTerminal;
+  yield {
+    type: "terminal",
+    sequence_number: seq++,
+    state: "complete",
+    ...(stopReason === undefined ? {} : { stop_reason: stopReason }),
+    ...(_providerStop === undefined ? {} : { provider_stop_reason: _providerStop }),
+    usage: usageFromProvider(rawUsage),
+  } as CanonicalEvent;
+}
+
+// Model catalog — maps QODER_MODEL_CONFIGS (provider) to Cartethyia ModelDefinition
+
+/**
+ * The intl catalog this provider publishes.
+ *
+ * `QODER_MODEL_CONFIGS` is not the source here: it freezes most rows at 180k
+ * while the upstream reports 1M for the same keys. That number is not
+ * cosmetic: it is sent upstream as `model_config.max_input_tokens`, so a stale
+ * low value tells Qoder the conversation window is small and makes it behave
+ * that way. Both the published catalog and the dispatched request come from the
+ * realm's roster, which carries the upstream's own numbers.
+ */
+export const QODER_MODELS: readonly ModelDefinition[] = QODER_INTL_MODELS;
+
+// ProviderAdapter — manual dispatch preserving COSY encryption + envelope logic
+
+interface QoderAdapterOptions {
+  readonly fetch?: typeof fetch;
+  /** Which deployment this adapter dispatches to. Defaults to intl. */
+  readonly realm?: QoderRealm;
+  /** Bundled provider id, so the adapter's own id matches the route's. */
+  readonly providerId?: string;
+}
+
+class QoderAdapter implements ProviderAdapter {
+  readonly provider_id: ProviderId;
+  private readonly realm: QoderRealm;
+  private readonly fetchFn: typeof fetch;
+
+  constructor(options: QoderAdapterOptions = {}) {
+    this.provider_id = (options.providerId ?? QODER_PROVIDER_ID) as ProviderId;
+    this.realm = options.realm ?? "intl";
+    this.fetchFn = options.fetch ?? globalThis.fetch;
+  }
+
+  /**
+   * The static roster for this adapter's realm.
+   *
+   * A single merged table advertised CN-only keys to global accounts and vice
+   * versa, so a request was routed to a deployment that refuses it.
+   */
+  #modelConfigs(): Record<string, QoderModelConfig> {
+    return (this.realm === "cn" ? QODER_CN_MODEL_CONFIGS : QODER_INTL_MODEL_CONFIGS) as Record<
+      string,
+      QoderModelConfig
+    >;
+  }
+
+  async *dispatch(
+    request: CanonicalRequest,
+    candidate: ProviderDispatchTarget,
+    context: ProviderDispatchContext,
+  ): AsyncIterable<CanonicalEvent> {
+    if (candidate.wire_family !== "chat") {
+      throw new GatewayError("capability_unsupported", 400, `qoder supports chat only, got ${candidate.wire_family}`);
+    }
+    const secret = readCredentialSecret(context.credential, "Qoder credential is required");
+
+    /**
+     * A caller-facing virtual name is translated to its roster key here.
+     *
+     * The translation has to happen before the config lookup and before the
+     * request body: the body carries the roster key, and looking up the
+     * virtual id in the config table would fall through to the synthetic
+     * default and silently dispatch under-declared capabilities.
+     */
+    const requestedModelId = candidate.model_id || request.model;
+    if (isQoderVirtualModel(requestedModelId) && !this.#modelConfigs()[qoderDispatchModelId(requestedModelId)]) {
+      throw new GatewayError(
+        "model_not_found",
+        404,
+        `Qoder virtual model ${requestedModelId} resolves to a roster key this realm does not serve`,
+        { virtual_model: requestedModelId, target: qoderDispatchModelId(requestedModelId) },
+        "upstream",
+      );
+    }
+    const modelId = qoderDispatchModelId(requestedModelId);
+    const modelConfig = this.#modelConfigs()[modelId] ?? {
+      id: modelId,
+      display_name: modelId,
+      max_input_tokens: 180_000,
+      is_vl: true,
+      is_reasoning: false,
+    };
+
+    const lifecycle = createUpstreamDeadlineLifecycle(context);
+
+    // Outbound fetch respects SSRF binding when provided
+    const outboundFetch: typeof fetch = (context.outbound_fetch as unknown as typeof fetch) ?? this.fetchFn;
+
+    const fetcher: QoderFetcher = (url, init) =>
+      outboundFetch(url, { ...init, signal: lifecycle.signal } as RequestInit) as Promise<Response>;
+
+    try {
+      const version = getQoderVersion();
+      // Dual mode like Cline: a pasted PAT is exchanged for a job token per
+      // request, while an OAuth device token is used directly with the
+      // identity the login persisted.
+      const auth = isQoderPat(secret)
+        ? await exchangeQoderPat(secret, lifecycle.signal, fetcher, version, this.realm)
+        : qoderOAuthAuth(secret, context.credential.auth_state, context.credential.account_id);
+      const qoderBody = buildQoderRequest(modelId, request, modelConfig, auth, this.realm);
+      // A full URL from the route wins, but the fallback is this realm's
+      // gateway — not the intl host hardcoded into `MODERN_PROFILE`. Dispatching
+      // a CN credential to `*.qoder.sh` is refused outright.
+      const url =
+        candidate.endpoint_path && candidate.endpoint_path.startsWith("http")
+          ? candidate.endpoint_path
+          : `${qoderGatewayCandidates(this.realm)[0] ?? ""}${QODER_CHAT_PATH}`;
+
+      const response = await callQoder(url, qoderBody, modelId, auth, lifecycle.signal, fetcher, version);
+      if (!response.ok) throw await mapUpstreamHttpError(response, "qoder");
+      if (!response.body) throw new GatewayError("platform_unavailable", 502, "Qoder returned empty body", {}, "upstream");
+      // Headers arrived: the pre-stream deadline has served its purpose.
+      // From here the gateway stall/first-chunk watchdog (propagated via
+      // context.abort_signal) governs the body. Keeping this timer armed
+      // would kill healthy long streams at the stale pre-stream deadline.
+      lifecycle.release();
+      yield* qoderBodyToCanonicalEvents(response.body as ReadableStream<Uint8Array>, lifecycle.signal, request.model);
+    } catch (err: unknown) {
+      const abortError = abortGatewayError(lifecycle, err, context.abort_signal);
+      if (abortError) throw abortError;
+      throw err;
+    } finally {
+      lifecycle.release();
+    }
+  }
+}
+
+export function createQoderAdapter(options: QoderAdapterOptions = {}): ProviderAdapter {
+  return new QoderAdapter(options);
+}
+
+/**
+ * Adapter for the China deployment.
+ *
+ * Same wire, different gateway host and roster — see `qoder-realm.ts`.
+ */
+export function createQoderCnAdapter(options: QoderAdapterOptions = {}): ProviderAdapter {
+  return new QoderAdapter({ ...options, realm: "cn", providerId: "qodercn" });
+}
+
+/**
+ * A COSY signer for one already-resolved account identity.
+ *
+ * Discovery needs signed headers but lives in `qoder-catalog.ts`, which cannot
+ * import this module (the adapter imports its rosters — that would be a cycle).
+ * Exporting the signer keeps one signing implementation and lets discovery
+ * stay pure and injectable.
+ */
+export function qoderSignerFor(
+  auth: QoderAuth,
+  version = getQoderVersion(),
+): (url: string, body: string) => Record<string, string> {
+  return (url: string, body: string): Record<string, string> =>
+    qoderBuildCosyHeaders(Buffer.from(body, "latin1"), url, auth, version);
+}
+
+/** Qoder's own base64 alphabet transform, for a request body. */
+export function qoderEncodeBody(plaintext: Uint8Array | string): string {
+  const text = typeof plaintext === "string" ? plaintext : new TextDecoder().decode(plaintext);
+  return Buffer.from(transformQoderBody(text)).toString("latin1");
+}
+
+/**
+ * Resolves the dispatch identity for one Qoder credential.
+ *
+ * Shared by the adapter and by discovery: both need the same `QoderAuth` the
+ * COSY signature is built from, and duplicating the PAT-vs-OAuth branch would
+ * let the two drift.
+ */
+export async function resolveQoderAuth(input: {
+  readonly secret: string;
+  readonly authState: unknown;
+  readonly signal: AbortSignal;
+  readonly fetcher: (url: string, init: RequestInit) => Promise<Response>;
+  /** Which deployment mints the job token; a PAT is realm-bound. */
+  readonly realm?: QoderRealm;
+}): Promise<QoderAuth> {
+  const realm = input.realm ?? "intl";
+  if (isQoderPat(input.secret)) {
+    return await exchangeQoderPat(input.secret, input.signal, input.fetcher, getQoderVersion(), realm);
+  }
+  // Discovery is handed only the secret and the persisted state, so the
+  // account id is read from that state — the same place `qoderOAuthAuth` reads
+  // it — rather than being a separate field callers can pass wrongly.
+  const state = parseQoderOAuthState(input.authState);
+  return qoderOAuthAuth(input.secret, input.authState, state?.userId);
+}