cartethyia 2.7.1 → 2.7.2

package/src/providers/operations/provider-catalog-service.ts

@@ -338,7 +338,17 @@ export async function registerByokProviders(
           provider_id: providerId,
           base_url: baseUrl,
           authentication_header_shape: wireProfile.authHeaderShape,
-          buildExtraHeaders: (_context, _request, candidate) => {
+          buildExtraHeaders: (context, _request, candidate) => {
+            // An operator-set route identity wins over both auto modes: Routing
+            // Strategy now serves custom providers too, and its value (including
+            // the empty "None" choice) must be honored verbatim.
+            const routeAgent = context.user_agent;
+            if (routeAgent !== undefined) {
+              return {
+                ...(routeAgent.length > 0 ? { "user-agent": routeAgent } : {}),
+                ...(compatibilityProfile?.extra_headers ?? {}),
+              };
+            }
             // Explicit gateway identity wins over CLI cloaking, and Codex /
             // Claude-Code-shaped traffic can never take this path: this hook
             // only runs for BYOK custom rows, never bundled first-party

package/src/providers/provider-contracts.ts

@@ -136,7 +136,11 @@ export interface ProviderDispatchContext {
   readonly outbound_attachment_fetch?: ValidatedOutboundFetch | undefined;
   /** Validated bidirectional HTTP/2 egress bound to the same selected network pool. */
   readonly outbound_http2?: ValidatedOutboundHttp2Bidi | undefined;
-  /** Built-in API-key route-selected fallback User-Agent; custom providers leave this unset. */
+  /**
+   * Route-selected fallback User-Agent from Routing Strategy; set when the
+   * operator configured one (bundled API-key providers default to the Claude
+   * CLI identity). Empty means the operator chose "None".
+   */
   readonly user_agent?: string | undefined;
   /** Gateway request id, stable across provider retries for one logical request. */
   readonly request_id?: string | undefined;
@@ -188,7 +192,8 @@ export function applyRouteUserAgent(
   if (
     credential.credential_kind === "oauth" ||
     credential.credential_kind === "scoped_access_token" ||
-    userAgent === undefined
+    userAgent === undefined ||
+    userAgent.trim().length === 0
   ) {
     return;
   }

package/src/security/cli-client-fingerprint.ts

@@ -50,13 +50,20 @@ const REMOTE_CLI_TOOL_UA: ReadonlyArray<{
   // filtering; MCP traffic uses `claude-code/<version>` instead.
   { toolId: "claude", pattern: /(^|[^a-z0-9])claude-cli\//i },
   { toolId: "claude", pattern: /(^|[^a-z0-9])claude-code\//i },
+  // Codex CLI (TUI/CLI builds) — the Guardian auto-review agent sends a
+  // `codex-auto-review` model that is only useful when the gateway can
+  // remap it to a serving provider. `codex-tui`, `codex-cli`, and the
+  // desktop agent's `opencode`-ish UAs all carry this prefix.
+  { toolId: "codex", pattern: /(^|[^a-z0-9])codex-(tui|cli)\//i },
 ];
 
 /**
  * Returns the remote CLI tool id recognised from the probe, or `null` when
  * the caller is not a remote-mapping client. Ordinary SDKs, curl, and local
- * mapping tools (Codex, …) stay unlabelled so their model ids resolve
- * through ordinary aliases / allowlists.
+ * mapping tools stay unlabelled so their model ids resolve through ordinary
+ * aliases / allowlists. Codex is labelled because its Guardian auto-review
+ * agent sends the hardcoded `codex-auto-review` model, which must be remapable
+ * to a serving provider for approval reviews to work at all.
  */
 export function detectRemoteCliToolId(probe: CliClientProbe): string | null {
   const userAgent = readUserAgent(probe);

package/src/transport/dispatch/empty-stream.ts

@@ -1,224 +1,224 @@
-/**
- * Empty-stream replay + pre-start failover.
- *
- * When a provider returns HTTP 200 but the response body decodes to zero
- * meaningful events, the request is replayed byte-identical (same headers,
- * same body) up to `maxEmptyReplays` times with exponential backoff. If all
- * replays on one endpoint fail, the helper advances to the next endpoint in
- * the caller-supplied ordered list.
- *
- * The helper is transport-layer: it owns fetch, watchdog, backoff, and
- * endpoint rotation. The caller owns SSE decoding via the `DrainStream`
- * callback and supplies materialized headers + serialized body so replays
- * are byte-identical.
- *
- * Design: the replay count, backoff, and the ordered endpoint list are the
- * caller's contract; this helper owns fetch, watchdog, and rotation so a
- * provider that answers 200 with no events is retried on the next endpoint
- * rather than surfacing an empty body to the client.
- */
-import { GatewayError } from "../../protocol/gateway-error";
-import {
-  fallbackRetryDelayMs,
-  MIN_RETRY_BUDGET_MS,
-  sleep as abortableSleep,
-} from "../failure-policy";
-
-// ─── Public types ──────────────────────────────────────────────────────────
-
-/** What the caller's drain observed. Counts only dispatched data events:
- *  comments/keepalives, `[DONE]`, and whitespace-only data are excluded. */
-export interface StreamTally {
-  readonly dataEvents: number;
-  readonly meaningful: boolean;
-  readonly thoughtOnly: boolean;
-}
-
-/** Drain one response body to a tally. Provider-supplied; uses decodeSseEvents. */
-export type DrainStream = (response: Response, signal: AbortSignal) => Promise<StreamTally>;
-
-/** Bound fetch for one endpoint. Receives materialized headers + serialized body. */
-export type EmptyStreamFetch = (
-  url: string,
-  init: { headers: Record<string, string>; body: string; signal: AbortSignal },
-) => Promise<Response>;
-
-/**
- * Retry-delay policy.
- *
- * Delays come from `fallbackRetryDelayMs` (capped exponential with full
- * jitter), whose base and cap are operator-tunable. There is deliberately no
- * per-caller base: the local formula this replaced was uncapped and
- * unjittered, so a provider returning 200-with-no-events could drive an
- * unbounded wait, and concurrent clients could resynchronize their retries.
- */
-export interface EmptyStreamPolicy {
-  readonly maxEmptyReplays?: number;
-  readonly firstEventTimeoutMs?: number;
-  readonly sleep?: (ms: number, signal: AbortSignal) => Promise<void>;
-}
-
-export interface EmptyStreamResult {
-  readonly response: Response;
-  readonly tally: StreamTally;
-  readonly endpoint: string;
-  readonly replaysUsed: number;
-}
-
-// ─── Defaults ──────────────────────────────────────────────────────────────
-
-const DEFAULT_MAX_REPLAYS = 2;
-const DEFAULT_FIRST_EVENT_TIMEOUT_MS = 200_000; // 200s, matches CARTETHYIA_STREAM_FIRST_CHUNK_TIMEOUT_MS default
-
-
-// ─── Helpers ───────────────────────────────────────────────────────────────
-
-/** Pure predicate: zero data events, or data events with nothing meaningful. */
-export function isEmptyStream(tally: StreamTally): boolean {
-  return tally.dataEvents === 0 || (!tally.meaningful && !tally.thoughtOnly);
-}
-
-
-
-// ─── Main function ─────────────────────────────────────────────────────────
-
-/**
- * Replays the byte-identical request while responses drain empty,
- * failing over across ordered endpoints pre-start.
- *
- * Throws GatewayError (platform_unavailable, 502, upstream) on exhaustion,
- * GatewayError (deadline_exceeded, 504, upstream) when a first event never
- * arrives within the window, and GatewayError (transport_closed, 499) on
- * client abort.
- */
-export async function fetchWithEmptyStreamRecovery(
-  endpoints: readonly string[],
-  request: { headers: Record<string, string>; body: string },
-  deps: {
-    fetch: EmptyStreamFetch;
-    drain: DrainStream;
-    signal: AbortSignal;
-    deadlineMs: number;
-    policy?: EmptyStreamPolicy;
-  },
-): Promise<EmptyStreamResult> {
-  const maxReplays = deps.policy?.maxEmptyReplays ?? DEFAULT_MAX_REPLAYS;
-  const firstEventTimeout = deps.policy?.firstEventTimeoutMs ?? DEFAULT_FIRST_EVENT_TIMEOUT_MS;
-  const sleep = deps.policy?.sleep ?? abortableSleep;
-
-  if (endpoints.length === 0) {
-    throw new GatewayError("platform_unavailable", 502, "No endpoints available", {}, "upstream");
-  }
-
-  for (let endpointIndex = 0; endpointIndex < endpoints.length; endpointIndex++) {
-    const endpoint = endpoints[endpointIndex]!;
-    const isLastEndpoint = endpointIndex === endpoints.length - 1;
-    const replaysAllowed = isLastEndpoint ? maxReplays : maxReplays;
-
-    for (let replay = 0; replay <= replaysAllowed; replay++) {
-      // Check abort before each fetch
-      if (deps.signal.aborted) {
-        throw new GatewayError("transport_closed", 499, "Aborted");
-      }
-
-      // Check deadline floor
-      const now = Date.now();
-      const remaining = deps.deadlineMs - now;
-      if (remaining < MIN_RETRY_BUDGET_MS) {
-        throw new GatewayError(
-          "platform_unavailable",
-          502,
-          "Deadline exhausted before empty-stream replay",
-          {},
-          "upstream",
-        );
-      }
-
-      const fetchTimeout = Math.min(firstEventTimeout, remaining);
-
-      let response: Response;
-      try {
-        response = await fetchWithTimeout(deps.fetch, endpoint, request, deps.signal, fetchTimeout);
-      } catch (error) {
-        if (error instanceof GatewayError) throw error;
-        break; // advance to next endpoint
-      }
-
-      // Drain the response
-      let tally: StreamTally;
-      try {
-        tally = await deps.drain(response, deps.signal);
-      } catch (error) {
-        if (error instanceof GatewayError) throw error;
-        break; // advance to next endpoint
-      }
-
-      // Check if empty
-      if (!isEmptyStream(tally)) {
-        // Success — return the response and tally
-        return {
-          response,
-          tally,
-          endpoint,
-          replaysUsed: replay,
-        };
-      }
-
-      // Empty — replay if we haven't exhausted this endpoint's budget
-      if (replay < replaysAllowed) {
-        const delay = fallbackRetryDelayMs(replay);
-        try {
-          await sleep(delay, deps.signal);
-        } catch (error) {
-          if (error instanceof GatewayError) throw error;
-          throw error;
-        }
-      }
-    }
-  }
-
-  // All endpoints exhausted
-  throw new GatewayError(
-    "platform_unavailable",
-    502,
-    "All endpoints returned empty streams",
-    {},
-    "upstream",
-  );
-}
-
-// ─── Internal helpers ──────────────────────────────────────────────────────
-
-async function fetchWithTimeout(
-  fetch: EmptyStreamFetch,
-  url: string,
-  request: { headers: Record<string, string>; body: string },
-  signal: AbortSignal,
-  timeoutMs: number,
-): Promise<Response> {
-  // Race the fetch against a first-event timeout
-  const timeoutPromise = new Promise<never>((_, reject) => {
-    const timer = setTimeout(() => {
-      // A first-event timeout is the gateway waiting on a silent upstream (e.g.
-      // a provider that holds the request in a queue), not the client leaving.
-      // It must surface as a deadline failure, never as a `transport_closed`
-      // 499 — that code is reserved for genuine client cancellations and would
-      // otherwise hide a real upstream wait behind "cancelled by client".
-      reject(new GatewayError("deadline_exceeded", 504, "First event timeout", {}, "upstream"));
-    }, timeoutMs);
-    signal.addEventListener("abort", () => {
-      clearTimeout(timer);
-      reject(new GatewayError("transport_closed", 499, "Aborted"));
-    }, { once: true });
-  });
-
-  try {
-    return await Promise.race([
-      fetch(url, { headers: request.headers, body: request.body, signal }),
-      timeoutPromise,
-    ]);
-  } catch (error) {
-    if (error instanceof GatewayError) throw error;
-    throw error;
-  }
-}
+/**
+ * Empty-stream replay + pre-start failover.
+ *
+ * When a provider returns HTTP 200 but the response body decodes to zero
+ * meaningful events, the request is replayed byte-identical (same headers,
+ * same body) up to `maxEmptyReplays` times with exponential backoff. If all
+ * replays on one endpoint fail, the helper advances to the next endpoint in
+ * the caller-supplied ordered list.
+ *
+ * The helper is transport-layer: it owns fetch, watchdog, backoff, and
+ * endpoint rotation. The caller owns SSE decoding via the `DrainStream`
+ * callback and supplies materialized headers + serialized body so replays
+ * are byte-identical.
+ *
+ * Design: the replay count, backoff, and the ordered endpoint list are the
+ * caller's contract; this helper owns fetch, watchdog, and rotation so a
+ * provider that answers 200 with no events is retried on the next endpoint
+ * rather than surfacing an empty body to the client.
+ */
+import { GatewayError } from "../../protocol/gateway-error";
+import {
+  fallbackRetryDelayMs,
+  MIN_RETRY_BUDGET_MS,
+  sleep as abortableSleep,
+} from "../failure-policy";
+
+// ─── Public types ──────────────────────────────────────────────────────────
+
+/** What the caller's drain observed. Counts only dispatched data events:
+ *  comments/keepalives, `[DONE]`, and whitespace-only data are excluded. */
+export interface StreamTally {
+  readonly dataEvents: number;
+  readonly meaningful: boolean;
+  readonly thoughtOnly: boolean;
+}
+
+/** Drain one response body to a tally. Provider-supplied; uses decodeSseEvents. */
+export type DrainStream = (response: Response, signal: AbortSignal) => Promise<StreamTally>;
+
+/** Bound fetch for one endpoint. Receives materialized headers + serialized body. */
+export type EmptyStreamFetch = (
+  url: string,
+  init: { headers: Record<string, string>; body: string; signal: AbortSignal },
+) => Promise<Response>;
+
+/**
+ * Retry-delay policy.
+ *
+ * Delays come from `fallbackRetryDelayMs` (capped exponential with full
+ * jitter), whose base and cap are operator-tunable. There is deliberately no
+ * per-caller base: the local formula this replaced was uncapped and
+ * unjittered, so a provider returning 200-with-no-events could drive an
+ * unbounded wait, and concurrent clients could resynchronize their retries.
+ */
+export interface EmptyStreamPolicy {
+  readonly maxEmptyReplays?: number;
+  readonly firstEventTimeoutMs?: number;
+  readonly sleep?: (ms: number, signal: AbortSignal) => Promise<void>;
+}
+
+export interface EmptyStreamResult {
+  readonly response: Response;
+  readonly tally: StreamTally;
+  readonly endpoint: string;
+  readonly replaysUsed: number;
+}
+
+// ─── Defaults ──────────────────────────────────────────────────────────────
+
+const DEFAULT_MAX_REPLAYS = 2;
+const DEFAULT_FIRST_EVENT_TIMEOUT_MS = 200_000; // 200s, matches CARTETHYIA_STREAM_FIRST_CHUNK_TIMEOUT_MS default
+
+
+// ─── Helpers ───────────────────────────────────────────────────────────────
+
+/** Pure predicate: zero data events, or data events with nothing meaningful. */
+export function isEmptyStream(tally: StreamTally): boolean {
+  return tally.dataEvents === 0 || (!tally.meaningful && !tally.thoughtOnly);
+}
+
+
+
+// ─── Main function ─────────────────────────────────────────────────────────
+
+/**
+ * Replays the byte-identical request while responses drain empty,
+ * failing over across ordered endpoints pre-start.
+ *
+ * Throws GatewayError (platform_unavailable, 502, upstream) on exhaustion,
+ * GatewayError (deadline_exceeded, 504, upstream) when a first event never
+ * arrives within the window, and GatewayError (transport_closed, 499) on
+ * client abort.
+ */
+export async function fetchWithEmptyStreamRecovery(
+  endpoints: readonly string[],
+  request: { headers: Record<string, string>; body: string },
+  deps: {
+    fetch: EmptyStreamFetch;
+    drain: DrainStream;
+    signal: AbortSignal;
+    deadlineMs: number;
+    policy?: EmptyStreamPolicy;
+  },
+): Promise<EmptyStreamResult> {
+  const maxReplays = deps.policy?.maxEmptyReplays ?? DEFAULT_MAX_REPLAYS;
+  const firstEventTimeout = deps.policy?.firstEventTimeoutMs ?? DEFAULT_FIRST_EVENT_TIMEOUT_MS;
+  const sleep = deps.policy?.sleep ?? abortableSleep;
+
+  if (endpoints.length === 0) {
+    throw new GatewayError("platform_unavailable", 502, "No endpoints available", {}, "upstream");
+  }
+
+  for (let endpointIndex = 0; endpointIndex < endpoints.length; endpointIndex++) {
+    const endpoint = endpoints[endpointIndex]!;
+    const isLastEndpoint = endpointIndex === endpoints.length - 1;
+    const replaysAllowed = isLastEndpoint ? maxReplays : maxReplays;
+
+    for (let replay = 0; replay <= replaysAllowed; replay++) {
+      // Check abort before each fetch
+      if (deps.signal.aborted) {
+        throw new GatewayError("transport_closed", 499, "Aborted");
+      }
+
+      // Check deadline floor
+      const now = Date.now();
+      const remaining = deps.deadlineMs - now;
+      if (remaining < MIN_RETRY_BUDGET_MS) {
+        throw new GatewayError(
+          "platform_unavailable",
+          502,
+          "Deadline exhausted before empty-stream replay",
+          {},
+          "upstream",
+        );
+      }
+
+      const fetchTimeout = Math.min(firstEventTimeout, remaining);
+
+      let response: Response;
+      try {
+        response = await fetchWithTimeout(deps.fetch, endpoint, request, deps.signal, fetchTimeout);
+      } catch (error) {
+        if (error instanceof GatewayError) throw error;
+        break; // advance to next endpoint
+      }
+
+      // Drain the response
+      let tally: StreamTally;
+      try {
+        tally = await deps.drain(response, deps.signal);
+      } catch (error) {
+        if (error instanceof GatewayError) throw error;
+        break; // advance to next endpoint
+      }
+
+      // Check if empty
+      if (!isEmptyStream(tally)) {
+        // Success — return the response and tally
+        return {
+          response,
+          tally,
+          endpoint,
+          replaysUsed: replay,
+        };
+      }
+
+      // Empty — replay if we haven't exhausted this endpoint's budget
+      if (replay < replaysAllowed) {
+        const delay = fallbackRetryDelayMs(replay);
+        try {
+          await sleep(delay, deps.signal);
+        } catch (error) {
+          if (error instanceof GatewayError) throw error;
+          throw error;
+        }
+      }
+    }
+  }
+
+  // All endpoints exhausted
+  throw new GatewayError(
+    "platform_unavailable",
+    502,
+    "All endpoints returned empty streams",
+    {},
+    "upstream",
+  );
+}
+
+// ─── Internal helpers ──────────────────────────────────────────────────────
+
+async function fetchWithTimeout(
+  fetch: EmptyStreamFetch,
+  url: string,
+  request: { headers: Record<string, string>; body: string },
+  signal: AbortSignal,
+  timeoutMs: number,
+): Promise<Response> {
+  // Race the fetch against a first-event timeout
+  const timeoutPromise = new Promise<never>((_, reject) => {
+    const timer = setTimeout(() => {
+      // A first-event timeout is the gateway waiting on a silent upstream (e.g.
+      // a provider that holds the request in a queue), not the client leaving.
+      // It must surface as a deadline failure, never as a `transport_closed`
+      // 499 — that code is reserved for genuine client cancellations and would
+      // otherwise hide a real upstream wait behind "cancelled by client".
+      reject(new GatewayError("deadline_exceeded", 504, "First event timeout", {}, "upstream"));
+    }, timeoutMs);
+    signal.addEventListener("abort", () => {
+      clearTimeout(timer);
+      reject(new GatewayError("transport_closed", 499, "Aborted"));
+    }, { once: true });
+  });
+
+  try {
+    return await Promise.race([
+      fetch(url, { headers: request.headers, body: request.body, signal }),
+      timeoutPromise,
+    ]);
+  } catch (error) {
+    if (error instanceof GatewayError) throw error;
+    throw error;
+  }
+}

package/src/transport/failure-policy.ts

@@ -2,6 +2,7 @@ import { GatewayError, type GatewayErrorCode, type GatewayErrorOrigin } from "..
 import { isRecord } from "../protocol/codecs";
 import { resolveFallbackRetryBaseMs, resolveFallbackRetryCapMs } from "../config/timeouts";
 import { parseUpstreamBackoff } from "../protocol/upstream-parsing";
+import { resolveAccountQuotaCooldownMs } from "../config/cooldowns";
 
 /**
  * How much of the upstream's error body is kept and surfaced.
@@ -232,6 +233,31 @@ export function classifyUpstreamFailure(error: unknown): UpstreamFailurePolicy {
   // DNS failure. Failing the client request instead of failing over is the wrong
   // outcome for a whole class the table already names as platform-wide.
   const statusCode = error.status;
+  // Qoder answers an exhausted quota by closing the stream with an upstream 499
+  // (nginx client-close style). That is a refusal from the upstream — the
+  // gateway's own aborts are `transport_closed`, produced locally, and never
+  // carry a qoder providerId — so a 499 scoped to qoder is quota, not a
+  // malformed request. Without this it fell through to `invalid_request`
+  // (non-retryable, no cooldown) and the account was re-dialled on every
+  // request inside the exhausted window until a late 429 finally classified it.
+  if (
+    error.origin === "upstream" &&
+    statusCode === 499 &&
+    (providerId === "qoder" || providerId === "qodercn")
+  ) {
+    const cooldownMs = resolveAccountQuotaCooldownMs();
+    return {
+      retryable: true,
+      mutatesAccount: true,
+      category: "quota_exceeded",
+      scope: "account",
+      origin: error.origin,
+      ...(providerCode ? { providerCode } : {}),
+      ...(providerId ? { providerId } : {}),
+      cooldownMs,
+      statusCode,
+    };
+  }
   const retryableByStatus =
     statusCode === 401 ||
     statusCode === 403 ||
@@ -459,6 +485,13 @@ const CONTEXT_LENGTH_CODES: ReadonlySet<string> = new Set([
   "model_context_window_exceeded",
   // InferHub's spelling for the same condition.
   "context_too_long",
+  // Trae answers an overflow on its streaming surface with the bare numeric
+  // code `4026` and the prose "We're sorry, your context length has exceeded
+  // the maximum limit." — no HTTP status, no symbolic code (verified live
+  // 2026-10: `event:error data:{"code":4026,"message":"..."}`). Without it
+  // the frame fell to the 502 `platform_unavailable` fallback and the client
+  // never saw the 413 it compacts on.
+  "4026",
 ]);
 
 /**

package/src/transport/routing/route-catalog.ts

@@ -35,7 +35,19 @@ import { providerHasAdapterUserAgent, providerUsesBespokeWire } from "../../prov
 
 const CLAUDE_MODEL_FAMILIES = new Set(["opus", "sonnet", "haiku", "fable", "mythos"]);
 
+/** Codex's built-in (non-routeable) model spellings worth matching. */
+const CODEX_REVIEW_MODELS = new Set(["codex-auto-review"]);
+
 export function cliMappingSourceKeys(toolId: string, sourceModel: string): readonly string[] {
+  if (toolId === "codex") {
+    const normalized = sourceModel.trim().toLowerCase();
+    if (CODEX_REVIEW_MODELS.has(normalized)) {
+      // Guardian's auto-review model is one fixed spelling; surface the full
+      // spelling plus the bare family so a slot mapped to either one hits.
+      return [...new Set([sourceModel, "codex-auto-review"])];
+    }
+    return [sourceModel];
+  }
   if (toolId !== "claude") return [sourceModel];
   const normalized = sourceModel.trim().toLowerCase();
   const family =
@@ -199,23 +211,33 @@ export function capabilityProfileCacheSize(): number {
   return capabilityProfileCache.size;
 }
 
-/** Resolves route identity only for bundled adapters without a native User-Agent builder. */
+/** Resolves route identity: bundled adapters without a native User-Agent builder, plus custom providers. */
 export function resolveRouteUserAgent(
   providerId: string,
   tenantUserAgent: string | undefined,
   globalUserAgent: string | undefined,
 ): string | undefined {
-  if (!isBundledProviderId(providerId) || providerHasAdapterUserAgent(providerId)) return undefined;
-  // A provider whose operator set no identity of their own gets the Claude Code
-  // CLI identity, resolved live so the stamped version tracks discovery. This
-  // used to be a frozen `codex_cli_rs` literal, which named a different vendor's
-  // client on requests that mostly reached neither.
-  const selected = resolveTenantOverride(
-    tenantUserAgent,
-    globalUserAgent,
-    buildClaudeCliUserAgent(),
-  );
-  return selected.trim() === "" ? undefined : selected;
+  if (isBundledProviderId(providerId)) {
+    // A bundled adapter that frames its own identity headers never consumes a
+    // route User-Agent (Command Code, Qoder, buddy, ...), so it never gets one
+    // — the control is hidden for it too.
+    if (providerHasAdapterUserAgent(providerId)) return undefined;
+    // Bundled API-key providers: an operator who set no identity of their own
+    // gets the Claude Code CLI identity, resolved live so the stamped version
+    // tracks discovery. This used to be a frozen `codex_cli_rs` literal, which
+    // named a different vendor's client on requests that mostly reached neither.
+    const selected = resolveTenantOverride(
+      tenantUserAgent,
+      globalUserAgent,
+      buildClaudeCliUserAgent(),
+    );
+    return selected.trim() === "" ? undefined : selected;
+  }
+  // Custom (BYOK) providers: only an explicit operator choice rides on the
+  // route; the adapter owns the default otherwise (see `registerByokProviders`).
+  // An explicit empty choice ("None") is preserved so the adapter can honor it.
+  const selected = resolveTenantOverride(tenantUserAgent, globalUserAgent, undefined);
+  return selected === undefined ? undefined : selected.trim();
 }
 
 /** One persisted model row ready for candidate construction. */