cartethyia 2.7.0 → 2.7.2

package/src/providers/integrations/buddy/workbuddy/shared.ts

@@ -8,12 +8,18 @@ import type { ProviderDispatchContext, ProviderDispatchTarget, ProviderId } from
 import { resolveInboundSessionId } from "../../../operations/session-resolution";
 import { buddyConversationHeaders } from "../buddy-conversation-headers";
 import { buddyCliHeaders, buddyCliTraceHeaders } from "../buddy-cli-headers";
-import { buddyEnterprise, buddyUserId, resolveBuddyIdentity } from "../buddy-identity";
+import { buddyEnterprise, buddyUserId, resolveBuddyDeviceBinding, resolveBuddyIdentity } from "../buddy-identity";
 import {
   buildWorkBuddyUserAgent,
   getWorkBuddyClientVersion,
   getWorkBuddyCliVersion,
 } from "../../../operations/client-versions";
+import {
+  getTuringDeviceTokenService,
+  resolveTuringSdkRoot,
+  type TuringSdkConfig,
+  WORKBUDDY_TURING_CONFIG,
+} from "../turing-device-token";
 
 /**
  * WorkBuddy serves chat from a versioned path on a base URL that carries no
@@ -140,8 +146,17 @@ export async function workbuddyHeaders(
     headers["x-machine-id"] = deriveAccountStableId(accountId, "machine");
     headers["x-session-id"] = deriveAccountStableId(accountId, "session");
   }
-  const deviceToken = readBuddyDeviceToken(context);
-  if (deviceToken !== undefined) headers["x-device-token"] = deviceToken;
+  // Per-account device binding: distinct device identity per account (see
+  // resolveBuddyDeviceBinding). Sent as the desktop's X-Device-Id-List.
+  const binding = resolveBuddyDeviceBinding(context);
+  if (binding !== undefined) {
+    headers["x-device-id-list"] = JSON.stringify({ qimei36: binding });
+  }
+  Object.assign(headers, await buddyDeviceTokenHeaders({
+    realm: domain.endsWith(".cn") ? "cn" : "intl",
+    context,
+    cliIdentity,
+  }));
   return headers;
 }
 
@@ -165,6 +180,44 @@ export function readBuddyDeviceToken(context?: ProviderDispatchContext): string
   return readDeviceTokenFile();
 }
 
+/**
+ * The reference `X-Device-Token` pair, per the official desktop app.
+ *
+ * The desktop client (WorkBuddyAI, channel 400111) always presents one of the
+ * two on chat traffic — a real token from the TuringShield SDK, or an
+ * `X-Device-Token-Error` when the SDK cannot produce one. It never omits both,
+ * and it sends the header on every realm (Intl and CN alike). The SDK is a
+ * proprietary native addon; when it is not configured we fall back to a
+ * captured token (auth_state / `CARTETHYIA_DEVICE_TOKEN_FILE`) and only then
+ * to the official failure state.
+ *
+ * - `CARTETHYIA_TURING_SDK_PATH` → real token via `TuringDeviceTokenService`.
+ * - Legacy token (auth_state/file) → used when the SDK is unavailable.
+ * - CLI identity never carries a device token (the CLI has no device).
+ */
+export async function buddyDeviceTokenHeaders(args: {
+  realm: "intl" | "cn";
+  context: ProviderDispatchContext | undefined;
+  cliIdentity: boolean | undefined;
+  turingConfig?: TuringSdkConfig;
+}): Promise<Record<string, string>> {
+  const { context, cliIdentity, turingConfig } = args;
+  void args.realm; // the desktop client sends the token on both realms
+  if (resolveBuddyIdentity(context, cliIdentity) === "cli") return {};
+  // Native SDK first (real token), when configured.
+  if (resolveTuringSdkRoot() !== null) {
+    const sdkHeaders = await getTuringDeviceTokenService(turingConfig ?? WORKBUDDY_TURING_CONFIG).headersForRequest(false);
+    if (sdkHeaders["x-device-token"] !== undefined) return sdkHeaders;
+    // SDK configured but could not produce a token: mirror its failure state,
+    // like the desktop client does — do not fall back to a stale file token.
+    return sdkHeaders;
+  }
+  // No SDK on this deployment: a captured token is better than nothing.
+  const token = readBuddyDeviceToken(context);
+  if (token !== undefined) return { "x-device-token": token };
+  return { "x-device-token-error": "sdk_not_initialized" };
+}
+
 function readDeviceTokenFile(): string | undefined {
   const now = Date.now();
   if (deviceTokenFileCache !== undefined && now - deviceTokenFileCache.readAt < DEVICE_TOKEN_FILE_TTL_MS) {

package/src/providers/integrations/claude/claude.ts

@@ -49,7 +49,7 @@ import { getClaudeCliVersion, adoptClaudeCliVersion, getClaudeSdkVersion } from
 import { adoptRequiredVersion } from "../../operations/client-version-resolver";
 import { getOrCreateInstallId } from "../shared/install-id";
 import { canonicalToClaudeMessagesPayload } from "../../../protocol/request/messages";
-import { applyParamQuirks } from "../../../transport/translation/quirks";
+import { applyParamQuirks } from "../../../protocol/translation/quirks";
 import { CLAUDE_BILLING_HEADER_PREFIX, endpointUrl } from "../../../protocol/codecs";
 import { sendClaudeMessagesRequest } from "../../../protocol/upstream/send-claude-messages";
 import {

package/src/providers/integrations/cloudflareai/cloudflareai.ts

@@ -25,7 +25,7 @@ import type { CanonicalEvent, CanonicalRequest } from "../../../protocol/canonic
 import { GatewayError } from "../../../protocol/gateway-error";
 import { buildClaudeMessagesRequest, filterClaudeCustomHeaders } from "../shared/claude-messages";
 import { sendClaudeMessagesRequest } from "../../../protocol/upstream/send-claude-messages";
-import { applyParamQuirks } from "../../../transport/translation/quirks";
+import { applyParamQuirks } from "../../../protocol/translation/quirks";
 import { decodeCloudflareAiGatewayCredential } from "../../../security/credential-codec";
 
 export const CLOUDFLAREAI_PROVIDER_ID = "cloudflareai" as const;

package/src/providers/integrations/codex/codex-errors.ts

@@ -7,11 +7,11 @@
 import { GatewayError } from "../../../protocol/gateway-error";
 import {
   classifyUpstreamError,
-  parseRetryAfter,
   extractUpstreamMessage,
   upstreamErrorIdentifier,
   upstreamRequestId,
 } from "../../../transport/failure-policy";
+import { parseRetryAfter } from "../../../protocol/upstream-parsing";
 import { tryParseJsonObject } from "../../../protocol/codecs";
 
 function toNumberOrUndefined(value: string | null): number | undefined {

package/src/providers/integrations/codex/codex.ts

@@ -33,9 +33,9 @@ import { isRecord, joinUrl } from "../../../protocol/codecs";
 import { postUpstreamJson } from "../../../protocol/upstream/post-json";
 import {
   MIN_RETRY_BUDGET_MS,
-  parseUpstreamBackoff,
   sleep as defaultSleep,
 } from "../../../transport/failure-policy";
+import { parseUpstreamBackoff } from "../../../protocol/upstream-parsing";
 
 /**
  * Sleep used by the 429 capacity-wait loop, overridable in tests.

package/src/providers/integrations/factory/factory.ts

@@ -49,7 +49,7 @@ import { createUpstreamDeadlineLifecycle, abortGatewayError } from "../../operat
 import { mapUpstreamHttpError } from "../../../transport/failure-policy";
 import { buildClaudeMessagesRequest, filterClaudeCustomHeaders } from "../shared/claude-messages";
 import { sendClaudeMessagesRequest } from "../../../protocol/upstream/send-claude-messages";
-import { applyParamQuirks } from "../../../transport/translation/quirks";
+import { applyParamQuirks } from "../../../protocol/translation/quirks";
 import { createApiKeyAdapter } from "../../configured-provider";
 import type { ApiKeyProviderSpec } from "../../configured-provider";
 import { decodeFactoryDroidCredential } from "../../../security/credential-codec";

package/src/providers/integrations/github/github.ts

@@ -25,7 +25,7 @@ import { postUpstreamJson } from "../../../protocol/upstream/post-json";
 import { providerBaseUrl } from "../../provider-metadata";
 import { getOrCreateInstallId } from "../shared/install-id";
 import { resolveRedisClient } from "../../../persistence/redis";
-import { applyParamQuirks } from "../../../transport/translation/quirks";
+import { applyParamQuirks } from "../../../protocol/translation/quirks";
 import { resolveInboundSessionId } from "../../operations/session-resolution";
 import {
   GITHUB_REQUEST_HEADERS,

package/src/providers/integrations/grok/grok.ts

@@ -20,7 +20,7 @@ import { providerBaseUrl } from "../../provider-metadata";
 import { boundedUpstreamArray, boundedUpstreamNumber, sanitizeUpstreamLabel } from "../../provider-sanitize";
 import { isRecord } from "../../../protocol/codecs";
 import { modelsDevCatalog } from "../../discovery/models-dev-catalog";
-import type { ReasoningEffortLevel } from "../../../transport/translation/thinking";
+import type { ReasoningEffortLevel } from "../../../protocol/translation/thinking";
 import type { FetchLike } from "../../quota/quota-contracts";
 import { resolveInboundSessionId, resolvePromptCacheKey } from "../../operations/session-resolution";
 import {

package/src/providers/integrations/inception/provider.ts

@@ -0,0 +1,91 @@
+import type { ApiKeyProviderSpec } from "../../configured-provider";
+import { fetchOpenAICompatibleModels } from "../../discovery/openai-model-discovery";
+import { defineModel, type ModelDefinition } from "../../provider-model-definition";
+
+const INCEPTION_PROVIDER_ID = "inception" as const;
+
+/**
+ * Inception Labs (Mercury) — bearer-authenticated OpenAI-compatible chat.
+ *
+ * The upstream is a plain `POST /v1/chat/completions` service (SSE streaming,
+ * tool calling, structured outputs, `reasoning_effort`). Base URL comes from
+ * `BUNDLED_PROVIDER_METADATA`; the chat path is declared below the `/v1`
+ * root, exactly like every other version-rooted OpenAI-compatible provider.
+ */
+export const INCEPTION_SPEC: ApiKeyProviderSpec = {
+  provider_id: INCEPTION_PROVIDER_ID,
+  endpoint_paths_by_wire_family: {},
+};
+
+/**
+ * Offline floor: the Mercury chat model this provider serves, pinned to the
+ * free-tier allowance (100M free tokens at signup).
+ *
+ * The roster intentionally carries only `mercury-3` — the operator's choice.
+ * Mercury Voice is enterprise-gated, Mercury Decide is a native decisions
+ * endpoint, and Mercury Edit 2 is FIM/edit; none of them is a chat model, and
+ * a chat wire would not serve them.
+ *
+ * `freeTier` is the catalog flag the console groups on; `free: true` zeroes
+ * the cost the way every other free-allowance provider models its rows — the
+ * allowance does not bill, so the row must not show a price. Limits are
+ * mercury-3's own chat-completions numbers: 1M context, 131072 max output,
+ * reasoning (instant/low/medium/high), tool calling.
+ */
+export const INCEPTION_MODELS: readonly ModelDefinition[] = [
+  defineModel({
+    id: "mercury-3",
+    wireFamily: "chat",
+    endpoint: "/chat/completions",
+    ctx: 1_000_000,
+    out: 131_072,
+    reasoning: true,
+    toolCall: true,
+    free: true,
+    freeTier: true,
+  }),
+];
+
+/**
+ * Live `/v1/models` listing, pinned to the free tier.
+ *
+ * The listing requires the API key (matches the chat endpoint's bearer), so
+ * the credential is forwarded when present; an unauthenticated fetch fails
+ * cleanly and the static roster stays authoritative.
+ *
+ * Every fetched row is stamped `freeTier` and zero-priced, the same rule the
+ * static roster declares: this provider is pinned to its free allowance, so a
+ * model upstream adds must not land in the billed tail.
+ *
+ * A fetched id that the static roster already knows keeps the roster row
+ * whole, not the listing's fields: upstream publishes `max_output_length` and
+ * no `reasoning`/`tool_call` keys, so the shared OpenAI-compatible reader
+ * would otherwise overwrite mercury-3's advertised 131072 output and reasoning
+ * flag with its 64k/not-reasoning defaults. The roster is the canonical
+ * metadata for the models we know; the listing only adds genuinely new ids.
+ */
+export async function discoverInceptionFreeModels(options: {
+  readonly baseUrl: string;
+  readonly credential?: string;
+  readonly fetcher?: typeof fetch;
+}): Promise<readonly ModelDefinition[] | null> {
+  const listed = await fetchOpenAICompatibleModels({
+    baseUrl: options.baseUrl,
+    providerId: "inception",
+    ...(typeof options.credential === "string" && options.credential.trim().length > 0
+      ? { headers: { authorization: `Bearer ${options.credential}` } }
+      : {}),
+    ...(options.fetcher === undefined ? {} : { fetcher: options.fetcher }),
+  });
+  if (listed === null) return null;
+  const known = new Map(INCEPTION_MODELS.map((model) => [model.modelId, model]));
+  return listed.map((model) => {
+    const roster = known.get(model.modelId);
+    if (roster !== undefined) return roster;
+    return {
+      ...model,
+      freeTier: true,
+      cost: { input: 0, output: 0, pricing_model: "pay-per-use" },
+    };
+  });
+}

package/src/providers/integrations/inferhub.ts

@@ -11,7 +11,7 @@ import type { FetchLike, ProviderQuotaResult } from "../quota/quota-contracts";
 import { probeApiKeyConnectivity } from "../quota/quota-support";
 import type { CanonicalEvent, CanonicalRequest, ContentPart } from "../../protocol/canonical-model";
 import { GatewayError } from "../../protocol/gateway-error";
-import { applyParamQuirks } from "../../transport/translation/quirks";
+import { applyParamQuirks } from "../../protocol/translation/quirks";
 import { buildClaudeMessagesRequest, filterClaudeCustomHeaders } from "./shared/claude-messages";
 import { resolveInboundSessionId } from "../operations/session-resolution";
 import { isRecord } from "../../protocol/codecs";

package/src/providers/integrations/kiro/kiro-request.ts

@@ -21,7 +21,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import type { CanonicalMessage, CanonicalRequest, ContentPart, ToolDefinition } from "../../../protocol/canonical-model";
 import { resolveImageSource, splitDataUrl } from "../../../protocol/codecs";
-import type { ReasoningEffortLevel } from "../../../transport/translation/thinking";
+import type { ReasoningEffortLevel } from "../../../protocol/translation/thinking";
 
 /** Longest tool name the upstream accepts, counted in code points. */
 export const KIRO_TOOL_NAME_MAX_LENGTH = 64;

package/src/providers/integrations/mistral.ts

@@ -4,14 +4,11 @@ import { defineModel } from "../provider-model-definition";
 const MISTRAL_PROVIDER_ID = "mistral" as const;
 
 /**
- * Mistral's own current generalist tiers.
+ * Mistral's catalog for the generic OpenAI-compatible API-key provider.
  *
- * The provider is registered as a generic OpenAI-compatible API-key provider,
- * which carries no catalog of its own: without this list, every model it serves
- * stays absent until a discovery run happens to fetch them. These are the two
- * `latest` aliases Mistral keeps pointed at its current generalist models —
- * `mistral-large-latest` (Large 4) and `mistral-medium-latest` (Medium 3.5),
- * per the Mistral model overview.
+ * The provider is registered as a generic API-key provider, which carries no
+ * catalog of its own: without this list, every model it serves stays absent
+ * until a discovery run happens to fetch them.
  *
  * Limits and pricing come from the base catalog via `providerId`: `defineModel`
  * resolves `mistral:<id>` and falls back to the majority row, so no number is
@@ -19,28 +16,110 @@ const MISTRAL_PROVIDER_ID = "mistral" as const;
  * because the base catalog is keyed by bare id and a bare id maps to many
  * providers' servings.
  *
+ * Which rows are here: the chat models live on a real Mistral account (the
+ * code/codestral family, the ministral small/medium/large sizes, voxtral
+ * small, and the small/medium generalist tiers). A live probe against the
+ * Mistral API verified each of these responds on `/v1/chat/completions`.
+ *
  * Deliberately not included:
  *
- * - The dated rows (`mistral-large-2411`, `mistral-medium-2508`). Each is on
- *   Mistral's retired list with a named successor.
- * - `mistral-small-latest`. Still live, but the operator asked for the two
- *   frontier tiers, and listing a model is a routing claim rather than a
- *   completeness claim.
- * - Both Magistral rows. Mistral deprecated Magistral Medium and Small in
- *   favour of Mistral Medium 3.5 and Mistral Small 4, so listing them
- *   advertises models the provider is actively retiring.
- * - The open-weights rows (`open-mistral-7b`, `open-mixtral-8x7b`), the
- *   embedding row (`mistral-embed`, not a chat model), and the devstral and
- *   codestral families — Mistral publishes those as separate product lines.
+ * - `mistral-large-latest` / dated large rows — tier-gated (Mistral answers
+ *   403 `tier_not_allowed` on many subscription tiers).
+ * - The embed/moderation/OCR/transcribe/TTS/realtime rows — they speak a
+ *   different endpoint, not chat.
+ * - The Labs rows (`labs-leanstral-*`) — need an organization admin flag.
+ * - The open-weights rows (`open-mistral-7b`, `open-mixtral-8x7b`) and the
+ *   devstral family — separate product lines.
  */
 export const MISTRAL_MODELS: readonly ModelDefinition[] = [
+  // Code / coding family
+  defineModel({
+    id: "codestral-2508",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "codestral-latest",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "mistral-code-latest",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "mistral-code-fim-latest",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    toolCall: true,
+  }),
+  // Ministral sizes
+  defineModel({
+    id: "ministral-14b-2512",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "ministral-14b-latest",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    toolCall: true,
+  }),
   defineModel({
-    id: "mistral-large-latest",
+    id: "ministral-8b-2512",
     providerId: MISTRAL_PROVIDER_ID,
     wireFamily: "chat",
     vision: true,
     toolCall: true,
   }),
+  defineModel({
+    id: "ministral-8b-latest",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "ministral-3b-2512",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "ministral-3b-latest",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    toolCall: true,
+  }),
+  // Voxtral small (chat-capable)
+  defineModel({
+    id: "voxtral-small-2507",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "voxtral-small-latest",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    toolCall: true,
+  }),
+  // Medium generalist tiers
   defineModel({
     id: "mistral-medium-latest",
     providerId: MISTRAL_PROVIDER_ID,
@@ -49,4 +128,99 @@ export const MISTRAL_MODELS: readonly ModelDefinition[] = [
     reasoning: true,
     toolCall: true,
   }),
+  defineModel({
+    id: "mistral-medium",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    reasoning: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "mistral-medium-3-5",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    reasoning: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "mistral-medium-3.5",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    reasoning: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "mistral-medium-3",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    reasoning: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "mistral-medium-2604",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    reasoning: true,
+    toolCall: true,
+  }),
+  // Vibe CLI family
+  defineModel({
+    id: "mistral-vibe-cli-latest",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "mistral-vibe-cli-with-tools",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "mistral-vibe-cli-fast",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    toolCall: true,
+  }),
+  // Magistral / small generalist tiers (chat-capable)
+  defineModel({
+    id: "magistral-medium-latest",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    reasoning: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "mistral-small-2603",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    reasoning: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "mistral-small-latest",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    reasoning: true,
+    toolCall: true,
+  }),
+  defineModel({
+    id: "magistral-small-latest",
+    providerId: MISTRAL_PROVIDER_ID,
+    wireFamily: "chat",
+    vision: true,
+    reasoning: true,
+    toolCall: true,
+  }),
 ];

package/src/providers/integrations/ollamacloud-models.ts

@@ -0,0 +1,50 @@
+/**
+ * Ollama Cloud (`ollamacloud`) model catalog.
+ *
+ * The provider is discovery-backed: live `/v1/models` on `https://ollama.com/v1`
+ * is the primary source and publishes every model's real context window. This
+ * static floor keeps the models an operator most likely wants routable before
+ * any account sync — and pins the verified live limits so a cold process never
+ * falls back to the invented 200k/64k defaults.
+ *
+ * Limits below are taken from the live `/v1/models` roster (verified 2026-10):
+ * - `gemma4:31b` -> 262144 ctx, text+image, thinking none/medium
+ * - `gpt-oss:20b` / `gpt-oss:120b` -> 131072 ctx, text, reasoning low/med/high
+ * - `nemotron-3-nano:30b` / `nemotron-3-super` / `nemotron-3-ultra`
+ *   -> 262144 ctx, text, thinking none/medium
+ *
+ * All six serve the chat wire (none is a Responses-native id), and all report
+ * `supported_in_api: true` on the live roster.
+ */
+import { defineModel } from "../provider-model-definition";
+import type { ModelDefinition } from "../provider-model-definition";
+
+export const OLLAMACLOUD_PROVIDER_ID = "ollamacloud" as const;
+
+/** Chat path below the `/v1`-rooted base. */
+const CHAT_ENDPOINT = "/chat/completions";
+
+type CatalogRow = readonly [id: string, ctx: number, vision: boolean, reasoning: boolean];
+
+function ollamaCloudModel([id, ctx, vision, reasoning]: CatalogRow): ModelDefinition {
+  return defineModel({
+    id,
+    providerId: OLLAMACLOUD_PROVIDER_ID,
+    wireFamily: "chat",
+    endpoint: CHAT_ENDPOINT,
+    ctx,
+    vision,
+    reasoning,
+    toolCall: true,
+  });
+}
+
+/** Static Ollama Cloud floor; live discovery adds to it per account. */
+export const OLLAMACLOUD_MODELS: readonly ModelDefinition[] = [
+  ["gemma4:31b", 262_144, true, true] as const,
+  ["gpt-oss:20b", 131_072, false, true] as const,
+  ["gpt-oss:120b", 131_072, false, true] as const,
+  ["nemotron-3-nano:30b", 262_144, false, true] as const,
+  ["nemotron-3-super", 262_144, false, true] as const,
+  ["nemotron-3-ultra", 262_144, false, true] as const,
+].map(ollamaCloudModel);

package/src/providers/integrations/opencode/fingerprint.ts

@@ -1,6 +1,14 @@
 import { getOpenCodeVersion } from "../../operations/client-versions";
 import { createHash, randomBytes } from "node:crypto";
 
+/**
+ * The OpenCode fallback client identity, used only while version discovery has
+ * not resolved yet. The live feed (`opencode/latest/<version>/cli`) wins once
+ * it is available; upstream accepts a range of releases, so the fallback does
+ * not need chasing.
+ */
+export const OPENCODE_CLIENT_VERSION = "2.1.1";
+
 let lastTimestamp = 0;
 let sequenceCounter = 0;
 const SESSION_ID_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
@@ -118,11 +126,19 @@ function createTraceHeaders(): Record<string, string> {
   };
 }
 
-/** Build the observed OpenCode CLI identity headers for an upstream dispatch. */
+/**
+ * Build the observed OpenCode CLI identity headers for an upstream dispatch.
+ *
+ * The v2 lane splits root and child session ids exactly like the reference
+ * gateway: `x-opencode-session` / `x-session-affinity` / `x-session-id` carry
+ * the root session, while `x-opencode-session-id` carries the child (the
+ * client's own session id when it sent one, else the root).
+ */
 export function buildOpenCodeHeaders(
   version = getOpenCodeVersion(),
   affinity?: string,
   projectId?: string,
+  childSessionId?: string,
 ): Record<string, string> {
   let sessionId: string;
   if (isOpenCodeSessionId(affinity)) {
@@ -132,6 +148,7 @@ export function buildOpenCodeHeaders(
   } else {
     sessionId = generateOpenCodeSessionId();
   }
+  const childId = isOpenCodeSessionId(childSessionId) ? childSessionId : sessionId;
   return {
     // The gate accepts both "cli" and "desktop" (measured 2026-10-17), so this
     // is not a refusal either way. It is "cli" because that is what the client
@@ -140,7 +157,7 @@ export function buildOpenCodeHeaders(
     // client identity this adapter does not have, for no measured benefit.
     "x-opencode-client": "cli",
     "x-opencode-session": sessionId,
-    "x-opencode-session-id": sessionId,
+    "x-opencode-session-id": childId,
     "x-session-affinity": sessionId,
     "x-session-id": sessionId,
     // No `x-opencode-request`: the current client no longer sends it, and