cartethyia 2.7.2 → 2.7.4

package/src/protocol/upstream/send-claude-messages.ts

@@ -55,7 +55,7 @@ export async function* sendClaudeMessagesRequest(
       throw new GatewayError(
         "platform_unavailable",
         502,
-        "Claude response has no stream body",
+        "Claude response has no stream body (request {requestId}). The upstream came back empty-handed — retry 🌙",
         {},
         "upstream",
       );
@@ -70,7 +70,7 @@ export async function* sendClaudeMessagesRequest(
     throw new GatewayError(
       "platform_unavailable",
       502,
-      "Claude response is not valid JSON",
+      "Claude response is not valid JSON (request {requestId}). The upstream came back empty-handed — retry 🌙",
       {},
       "upstream",
     );
@@ -79,7 +79,7 @@ export async function* sendClaudeMessagesRequest(
     throw new GatewayError(
       "platform_unavailable",
       502,
-      "Claude response must be an object",
+      "Claude response must be an object (request {requestId}). The upstream came back empty-handed — retry 🌙",
       {},
       "upstream",
     );

package/src/providers/adapters/base-adapter.ts

@@ -25,7 +25,7 @@ export abstract class BaseProviderAdapter implements ProviderAdapter {
     context: ProviderDispatchContext,
   ): AsyncIterable<CanonicalEvent> {
     if (request.model.includes("?")) {
-      throw new GatewayError("invalid_request", 400, "model must not contain query string");
+      throw new GatewayError("invalid_request", 400, "model must not contain query string (request {requestId}). Check the shape of what you sent — then resend 🪞");
     }
     const headers = await this.prepareHeaders(context, request, target);
     const payload = await this.preparePayload(request, target, context);

package/src/providers/adapters/compatible-adapter.ts

@@ -351,7 +351,7 @@ export class OpenAICompatibleAdapter extends BaseProviderAdapter {
         throw new GatewayError(
           "platform_unavailable",
           502,
-          wireFamily === "responses" ? "Responses returned empty stream" : "Chat returned empty stream",
+          `${wireFamily === "responses" ? "Responses returned empty stream" : "Chat returned empty stream"} (request {requestId}). The upstream came back empty-handed — retry 🌙`,
           {},
           "upstream",
         );
@@ -379,7 +379,7 @@ export class OpenAICompatibleAdapter extends BaseProviderAdapter {
         throw new GatewayError(
           "transport_unavailable",
           502,
-          `Upstream returned a non-JSON response: ${summary}`.slice(0, 300),
+          `Upstream returned a non-JSON response: ${summary} (request {requestId}). The connection ghosted us — come back in a moment 👻`.slice(0, 320),
           { upstreamStatus: res.status, contentType },
           "upstream",
         );

package/src/providers/authentication/oauth-refresh-service.ts

@@ -28,7 +28,7 @@ import { providerAccounts, providerOauthStates } from "../../persistence/schema"
 import { decryptCredentialToString, encryptCredential } from "../../security/crypto";
 import { invalidateCredentialCache } from "../operations/provider-credential-service";
 import { resolveAccountDisabledRecoveryMs } from "../../config/cooldowns";
-import { record } from "./oauth-flow-store";
+import { asJsonbRecord } from "../../shared/coerce";
 import {
   loadAccountWithFreshness,
   type AccountWithFreshnessRow,
@@ -224,7 +224,7 @@ async function persistRefreshed(
  * never reach into the database.
  */
 function buildRefreshContext(row: AccountRow, includeAccessToken: boolean): OAuthRefreshContext {
-  const authState = record(row.authState);
+  const authState = asJsonbRecord(row.authState);
   return {
     account_id: row.id,
     ...(authState === undefined ? {} : { auth_state: authState }),

package/src/providers/configured-provider.ts

@@ -11,7 +11,7 @@ export function ensurePayloadModel(
 ): string {
   const value = payload["model"];
   const model = typeof value === "string" && value.trim() ? value.trim() : candidate.model_id.trim();
-  if (!model) throw new GatewayError("invalid_request", 400, `${providerName} model is required`);
+  if (!model) throw new GatewayError("invalid_request", 400, `${providerName} model is required (request {requestId}). Check the shape of what you sent — then resend 🪞`);
   payload["model"] = model;
   return model;
 }

package/src/providers/discovery/probe-phases.ts

@@ -109,7 +109,7 @@ export function grok407ProbeFailure(args: {
   return new GatewayError(
     "quota_exceeded",
     429,
-    detail,
+    `${detail} (request {requestId}). You've maxed this window — pace yourself ⏳`,
     {
       ...priorDetails,
       providerCode: "subscription:free-usage-exhausted",
@@ -289,7 +289,7 @@ export async function resolveProbeTarget(args: {
           throw new GatewayError(
             "model_not_found",
             404,
-            `No ${requestedServiceKind} model ${modelId} is registered for provider ${providerId}`,
+            `No ${requestedServiceKind} model ${modelId} is registered for provider ${providerId} (request {requestId}). Try another model — this one's off the menu 📚`,
           );
         }
         const ctx = wireContextFrom(providerWireRow);

package/src/providers/discovery/probing-service.ts

@@ -304,7 +304,7 @@ export class ProviderProbingService {
             throw new GatewayError(
               "capability_unsupported",
               400,
-              `Provider ${providerId} has no web search transport`,
+              `Provider ${providerId} has no web search transport (request {requestId}). Know your tools — this one just isn't in the box 🧰`,
             );
           }
           const searchProbeQuery = request.prompt?.trim() || "Cartethyia gateway probe";
@@ -325,14 +325,14 @@ export class ProviderProbingService {
             snippet: hit.snippet,
           }));
           if (!response.results || response.results.length === 0) {
-            dispatchError = new GatewayError("platform_unavailable", 502, "web search returned no results");
+            dispatchError = new GatewayError("platform_unavailable", 502, "web search returned no results (request {requestId}). The upstream came back empty-handed — retry 🌙");
           }
         } else if (serviceKind === "systemone") {
           if (typeof adapter.systemone !== "function") {
             throw new GatewayError(
               "capability_unsupported",
               400,
-              `Provider ${providerId} has no System One transport`,
+              `Provider ${providerId} has no System One transport (request {requestId}). Know your tools — this one just isn't in the box 🧰`,
             );
           }
           const response = await adapter.systemone(
@@ -360,14 +360,14 @@ export class ProviderProbingService {
             dispatchError = new GatewayError(
               response.status >= 500 ? "platform_unavailable" : "invalid_request",
               response.status,
-              `System One upstream error: ${raw.slice(0, 240)}`,
+              `System One upstream error (request {requestId}): ${raw.slice(0, 240)}`,
             );
           } else {
             let parsed: unknown;
             try {
               parsed = raw ? JSON.parse(raw) : null;
             } catch {
-              dispatchError = new GatewayError("platform_unavailable", 502, "System One returned invalid JSON");
+              dispatchError = new GatewayError("platform_unavailable", 502, "System One returned invalid JSON (request {requestId}). The upstream came back empty-handed — retry 🌙");
             }
             if (parsed !== null && parsed !== undefined) {
               const answers =
@@ -381,7 +381,7 @@ export class ProviderProbingService {
                 dispatchError = new GatewayError(
                   "platform_unavailable",
                   502,
-                  "System One returned no answers",
+                  "System One returned no answers (request {requestId}). The upstream came back empty-handed — retry 🌙",
                 );
               }
             }
@@ -709,7 +709,7 @@ export class ProviderProbingService {
           throw new GatewayError(
             "transport_unavailable",
             502,
-            `Model discovery failed for ${providerId}: ${error instanceof Error ? error.message : "unknown error"}`,
+            `Model discovery failed for ${providerId}: ${error instanceof Error ? error.message : "unknown error"} (request {requestId}). The connection ghosted us — come back in a moment 👻`,
             {},
             "upstream",
           );
@@ -718,7 +718,7 @@ export class ProviderProbingService {
           throw new GatewayError(
             "transport_unavailable",
             502,
-            `Model discovery failed for ${providerId}: endpoint returned no usable models`,
+            `Model discovery failed for ${providerId}: endpoint returned no usable models (request {requestId}). The upstream came back empty-handed — retry 🌙`,
             {},
             "upstream",
           );
@@ -764,7 +764,7 @@ export class ProviderProbingService {
             throw new GatewayError(
               "transport_unavailable",
               502,
-              `Model discovery failed for ${providerId}: ${error instanceof Error ? error.message : "unknown error"}`,
+              `Model discovery failed for ${providerId}: ${error instanceof Error ? error.message : "unknown error"} (request {requestId}). The connection ghosted us — come back in a moment 👻`,
               {},
               "upstream",
             );
@@ -799,7 +799,7 @@ export class ProviderProbingService {
         throw new GatewayError(
           "invalid_request",
           400,
-          `Add an account for ${providerId} first — model listing needs a credential.`,
+          `Add an account for ${providerId} first — model listing needs a credential (request {requestId}). Wrong key, right door — check the credential 🔑`,
           {},
           "cartethyia",
         );
@@ -811,7 +811,7 @@ export class ProviderProbingService {
         throw new GatewayError(
           "invalid_request",
           400,
-          `Add an account for ${providerId} before fetching its models.`,
+          `Add an account for ${providerId} before fetching its models (request {requestId}). Wrong key, right door — check the credential 🔑`,
           {},
           "cartethyia",
         );
@@ -821,7 +821,7 @@ export class ProviderProbingService {
       throw new GatewayError(
         "capability_unsupported",
         400,
-        `${providerId} publishes no model-listing endpoint. Its catalog ships with Cartethyia; new models appear with an update.`,
+        `${providerId} publishes no model-listing endpoint (request {requestId}). Its catalog ships with Cartethyia; new models appear with an update. Know your tools — this one just isn't in the box 🧰`,
         {},
         "cartethyia",
       );

package/src/providers/integrations/agentrouter/agentrouter.ts

@@ -11,9 +11,8 @@
 // `x-stainless-*` family, `x-claude-code-session-id`, and `anthropic-version`
 // for operator-supplied headers, so they are layered onto the built headers
 // at this call site instead.
-import { GatewayError } from "../../../protocol/gateway-error";
 import type { CanonicalEvent, CanonicalRequest } from "../../../protocol/canonical-model";
-import { readCredentialSecret, type ProviderDispatchTarget, type ProviderAdapter, type ProviderDispatchContext } from "../../provider-contracts";
+import { readCredentialSecret, assertWireFamily, type ProviderDispatchTarget, type ProviderAdapter, type ProviderDispatchContext } from "../../provider-contracts";
 import { providerBaseUrl } from "../../provider-metadata";
 import { buildClaudeMessagesRequest } from "../shared/claude-messages";
 import { sendClaudeMessagesRequest } from "../../../protocol/upstream/send-claude-messages";
@@ -87,7 +86,7 @@ class AgentRouterAdapter implements ProviderAdapter {
     context: ProviderDispatchContext,
   ): AsyncIterable<CanonicalEvent> {
     if (candidate.wire_family !== "messages") {
-      throw new GatewayError("capability_unsupported", 400, `agentrouter supports messages only, got ${candidate.wire_family}`);
+      assertWireFamily(candidate, "messages", "agentrouter");
     }
     const apiKey = readCredentialSecret(context.credential, "AgentRouter API key is required");
 

package/src/providers/integrations/alibabacp/alibabacp.ts

@@ -61,7 +61,7 @@ function alibabaSpec(envelope: AlibabaCodingPlanEnvelope): ApiKeyProviderSpec {
 function alibabaEnvelope(context: ProviderDispatchContext): AlibabaCodingPlanEnvelope {
   const secret = context.credential.secret;
   if (secret === undefined || secret.length === 0) {
-    throw new GatewayError("invalid_request", 400, "alibabacp: credential is missing a secret value");
+    throw new GatewayError("invalid_request", 400, "alibabacp: credential is missing a secret value (request {requestId}). Wrong key, right door — check the credential 🔑");
   }
   let envelope: AlibabaCodingPlanEnvelope;
   try {
@@ -70,7 +70,7 @@ function alibabaEnvelope(context: ProviderDispatchContext): AlibabaCodingPlanEnv
     throw new GatewayError(
       "invalid_request",
       400,
-      `alibabacp: ${error instanceof Error ? error.message : "stored credential is not an Alibaba envelope"}`,
+      `alibabacp: ${error instanceof Error ? error.message : "stored credential is not an Alibaba envelope"} (request {requestId}). Wrong key, right door — check the credential 🔑`,
     );
   }
   return envelope;

package/src/providers/integrations/anthropic.ts

@@ -18,6 +18,7 @@ import { GatewayError } from "../../protocol/gateway-error";
 import { buildClaudeMessagesRequest, filterClaudeCustomHeaders } from "./shared/claude-messages";
 import { sendClaudeMessagesRequest } from "../../protocol/upstream/send-claude-messages";
 import { applyParamQuirks } from "../../protocol/translation/quirks";
+import { assertCredentialKind, assertWireFamily } from "../provider-contracts";
 import type { ProviderDispatchTarget, ProviderAdapter, ProviderDispatchContext, ProviderId } from "../provider-contracts";
 import { providerBaseUrl } from "../provider-metadata";
 
@@ -58,18 +59,10 @@ export class AnthropicApiKeyAdapter implements ProviderAdapter {
     context: ProviderDispatchContext,
   ): AsyncIterable<CanonicalEvent> {
     if (candidate.wire_family !== "messages") {
-      throw new GatewayError(
-        "capability_unsupported",
-        400,
-        `${this.provider_id} supports messages only`,
-      );
+      assertWireFamily(candidate, "messages", this.provider_id);
     }
     if (context.credential.credential_kind !== "api_key") {
-      throw new GatewayError(
-        "invalid_request",
-        400,
-        `${this.provider_id}: x-api-key credential required (got credential_kind=${context.credential.credential_kind})`,
-      );
+      assertCredentialKind(context.credential, "api_key", this.provider_id);
     }
     if (
       context.credential.secret === undefined ||
@@ -78,7 +71,7 @@ export class AnthropicApiKeyAdapter implements ProviderAdapter {
       throw new GatewayError(
         "invalid_request",
         400,
-        `${this.provider_id}: API key is missing a secret value`,
+        `${this.provider_id}: API key is missing a secret value (request {requestId}). Wrong key, right door — check the credential 🔑`,
       );
     }
     const apiKey = new TextDecoder().decode(context.credential.secret);

package/src/providers/integrations/antigravity/antigravity.ts

@@ -46,6 +46,7 @@ import {
   loadAntigravityProject,
   normalizeAntigravityToolSchemas,
 } from "./antigravity-protocol";
+import { assertCredentialKind, assertWireFamily } from "../../provider-contracts";
 import type { ImageGenerationOutcome, ProviderDispatchTarget, ProviderAdapter, ProviderDispatchContext, WebSearchOutcome, WebSearchResult } from "../../provider-contracts";
 import { providerBaseUrl } from "../../provider-metadata";
 import { abortGatewayError, createUpstreamDeadlineLifecycle } from "../../operations/upstream-deadline";
@@ -84,34 +85,31 @@ const antigravityModel = (
   });
 
 export const ANTIGRAVITY_MODELS: readonly ModelDefinition[] = [
-  // Claude via Antigravity (Anthropic-branded SKUs, Gemini wire)
+  // Claude via Antigravity (Anthropic-branded SKUs, Gemini wire). The 4.6
+  // rows are pinned at 64000 because Antigravity was observed rejecting
+  // anything higher on `daily-cloudcode-pa`; `out` is published metadata, not
+  // a request field (the envelope's `maxOutputTokens` comes from
+  // `ANTIGRAVITY_MODEL_WIRE_PROFILES`).
   antigravityModel("claude-sonnet-4-6", 250_000, 64_000, true),
   antigravityModel("claude-opus-4-6", 250_000, 64_000, true),
-  // The 5.5 generation. Anthropic's own model pages publish 1M context and
-  // 128k output for both, which is the same figure the Claude integration
-  // carries; Antigravity has no base-catalog rows of its own, so the numbers
-  // are stated here rather than resolved from a source that does not exist.
-  //
-  // `out` is published metadata, not a request field: the `maxOutputTokens` the
-  // envelope carries comes from `ANTIGRAVITY_MODEL_WIRE_PROFILES`, and an id
-  // absent from that table passes the caller's own value through. The 4.6 rows
-  // are pinned at 64000 because Antigravity was observed rejecting anything
-  // higher on `daily-cloudcode-pa`. The 5.5 cap is UNVERIFIED — no 5.5 request
-  // has been captured against that host — so if it turns out to carry the same
-  // 64000 ceiling, it needs its own profile entry; a catalog row cannot express
-  // it.
   antigravityModel("claude-sonnet-5-5", 1_000_000, 128_000, true),
   antigravityModel("claude-opus-5-5", 1_000_000, 128_000, true),
-  // Gemini
-  antigravityModel("gemini-2.5-flash", 1_048_576, 65_536, true),
-  antigravityModel("gemini-3-flash", 1_048_576, 65_536, true),
+  // Gemini text SKUs, as the Antigravity roster publishes them.
+  antigravityModel("gemini-2.5-flash", 1_000_000, 66_000, true),
+  antigravityModel("gemini-2.5-flash-thinking", 1_000_000, 66_000, true),
+  antigravityModel("gemini-3-flash", 1_000_000, 66_000, true),
+  antigravityModel("gemini-3.1-flash-lite", 1_000_000, 66_000, true),
+  antigravityModel("gemini-2.5-flash-lite", 1_000_000, 66_000, true),
+  antigravityModel("gemini-3.5-flash-lite", 1_000_000, 66_000, true),
+  antigravityModel("gemini-3.8-flash", 1_000_000, 66_000, true),
+  antigravityModel("gemini-4-argon", 1_000_000, 65_536, true),
+  antigravityModel("gemini-4-carbon", 1_000_000, 65_536, true),
+  // Tab (laptop-class) preview SKU.
+  antigravityModel("tab_flash_lite_preview", 16_000, 4_000, true),
+  // Gemini image generation. `gemini-3-pro-image` uses the same catalog
+  // limits/capabilities as the existing `gemini-3.1-flash-image` row.
   antigravityModel("gemini-3.1-flash-image", 200_000, 64_000, false, true),
-  antigravityModel("gemini-3.1-pro", 1_048_576, 65_535, true),
-  antigravityModel("gemini-3.6-flash", 1_048_576, 65_536, true),
-  antigravityModel("gemini-3.7-flash", 1_048_576, 65_536, true),
-  antigravityModel("gemini-3.8-flash", 1_048_576, 65_536, true),
-  // GPT-OSS
-  antigravityModel("gpt-oss-120b", 131_072, 32_768, true),
+  antigravityModel("gemini-3-pro-image", 200_000, 64_000, false, true),
 ];
 
 function normalizeAntigravityGrounding(data: unknown, maxResults: number): readonly WebSearchResult[] {
@@ -191,18 +189,10 @@ class AntigravityAdapter implements ProviderAdapter {
       candidate.wire_family !== "responses" &&
       candidate.wire_family !== "messages"
     ) {
-      throw new GatewayError(
-        "capability_unsupported",
-        400,
-        `antigravity supports chat/responses/messages, got ${candidate.wire_family}`,
-      );
+      assertWireFamily(candidate, ["chat", "responses", "messages"], "antigravity");
     }
     if (context.credential.credential_kind !== "oauth") {
-      throw new GatewayError(
-        "invalid_request",
-        400,
-        `antigravity: Google OAuth credential required (got credential_kind=${context.credential.credential_kind})`,
-      );
+      assertCredentialKind(context.credential, "oauth", "antigravity");
     }
     const accessToken = context.credential.secret
       ? new TextDecoder().decode(context.credential.secret).trim()
@@ -211,7 +201,7 @@ class AntigravityAdapter implements ProviderAdapter {
       throw new GatewayError(
         "authentication_failed",
         401,
-        "antigravity: OAuth access token is required",
+        "antigravity: OAuth access token is required (request {requestId}). Wrong key, right door — check the credential 🔑",
       );
     }
 
@@ -363,7 +353,7 @@ class AntigravityAdapter implements ProviderAdapter {
         throw new GatewayError(
           "platform_unavailable",
           502,
-          "antigravity returned empty stream",
+          "antigravity returned empty stream (request {requestId}). The upstream came back empty-handed — retry 🌙",
           {},
           "upstream",
         );
@@ -511,7 +501,7 @@ class AntigravityAdapter implements ProviderAdapter {
     context: ProviderDispatchContext,
   ): Promise<WebSearchOutcome> {
     const query = typeof body.query === "string" ? body.query.trim() : "";
-    if (!query) throw new GatewayError("invalid_request", 400, "search query is required");
+    if (!query) throw new GatewayError("invalid_request", 400, "search query is required (request {requestId}). Check the shape of what you sent — then resend 🪞");
     const rawMax = body.max_results;
     const maxResults =
       typeof rawMax === "number" && Number.isFinite(rawMax)
@@ -534,7 +524,7 @@ class AntigravityAdapter implements ProviderAdapter {
     }
     const results = normalizeAntigravityGrounding(grounded, maxResults);
     if (results.length === 0)
-      throw new GatewayError("platform_unavailable", 502, "Antigravity search returned no grounded results");
+      throw new GatewayError("platform_unavailable", 502, "Antigravity search returned no grounded results (request {requestId}). The upstream came back empty-handed — retry 🌙");
     return { results, total_results: results.length };
   }
 
@@ -544,21 +534,17 @@ class AntigravityAdapter implements ProviderAdapter {
     context: ProviderDispatchContext,
   ): Promise<ImageGenerationOutcome> {
     if (context.credential.credential_kind !== "oauth") {
-      throw new GatewayError(
-        "invalid_request",
-        400,
-        `antigravity: Google OAuth credential required (got credential_kind=${context.credential.credential_kind})`,
-      );
+      assertCredentialKind(context.credential, "oauth", "antigravity");
     }
     const accessToken = context.credential.secret
       ? new TextDecoder().decode(context.credential.secret).trim()
       : "";
     if (!accessToken) {
-      throw new GatewayError("authentication_failed", 401, "antigravity: OAuth access token is required");
+      throw new GatewayError("authentication_failed", 401, "antigravity: OAuth access token is required (request {requestId}). Wrong key, right door — check the credential 🔑");
     }
     const prompt = imagePrompt(body);
     const model = candidate.model_id.length > 0 ? candidate.model_id : typeof body.model === "string" ? body.model : "";
-    if (model.length === 0) throw new GatewayError("invalid_request", 400, "model is required");
+    if (model.length === 0) throw new GatewayError("invalid_request", 400, "model is required (request {requestId}). Check the shape of what you sent — then resend 🪞");
     const outboundFetch: typeof fetch = (context.outbound_fetch as unknown as typeof fetch) ?? this.fetchFn;
     const projectId = await loadAntigravityProject(accessToken, {
       baseUrl: this.baseUrl,
@@ -627,7 +613,7 @@ class AntigravityAdapter implements ProviderAdapter {
       throw new GatewayError(
         "platform_unavailable",
         502,
-        `Antigravity image generation unreachable: ${error instanceof Error ? error.message : String(error)}`,
+        `Antigravity image generation unreachable (request {requestId}): ${error instanceof Error ? error.message : String(error)}. The connection ghosted us — come back in a moment 👻`,
         {},
         "upstream",
       );
@@ -649,12 +635,12 @@ class AntigravityAdapter implements ProviderAdapter {
       try {
         parsed = JSON.parse(event.data);
       } catch {
-        throw new GatewayError("platform_unavailable", 502, "Antigravity image stream returned malformed JSON", {}, "upstream");
+        throw new GatewayError("platform_unavailable", 502, "Antigravity image stream returned malformed JSON (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
       }
       images.push(...geminiInlineImages(parsed));
     }
     if (images.length === 0) {
-      throw new GatewayError("platform_unavailable", 502, "Antigravity image generation returned no image", {}, "upstream");
+      throw new GatewayError("platform_unavailable", 502, "Antigravity image generation returned no image (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
     }
     return { created: imageCreatedSeconds(), data: images };
   }

package/src/providers/integrations/buddy/buddy-catalog-shared.ts

@@ -273,7 +273,7 @@ export function makeBuddyModel(
   endpoint?: string,
   realm: "intl" | "cn" = "intl",
 ): ModelDefinition {
-  if (!entry[0]) throw new GatewayError("invalid_request", 400, "invalid model");
+  if (!entry[0]) throw new GatewayError("invalid_request", 400, "invalid model (request {requestId}). Check the shape of what you sent — then resend 🪞");
   const image = BUDDY_IMAGE_MODEL_ID_SET.has(entry[0]);
   const efforts = (realm === "cn" ? BUDDY_CN_EFFORTS : BUDDY_INTL_EFFORTS)[entry[0].toLowerCase()];
   // Refused on free is only a question for the intl realm. cbcn serves every

package/src/providers/integrations/buddy/buddy-chat-shared.ts

@@ -21,7 +21,7 @@ import { createHash } from "node:crypto";
 import { completeRequiredSchema } from "../../../protocol/codecs";
 import type { CanonicalRequest } from "../../../protocol/canonical-model";
 import { isRecord } from "../../../protocol/codecs";
-import { applyDeepSeekReasoning, applyOpenAIReasoning, backfillDeepSeekReasoningContent, clampedEffortOutputFloor } from "../../../protocol/reasoning";
+import { applyDeepSeekReasoning, applyOpenAIReasoning, backfillDeepSeekReasoningContent, clampedEffortOutputFloor, ensureChatReasoningReplayPresence } from "../../../protocol/reasoning";
 import { BUDDY_CN_EFFORTS, BUDDY_INTL_EFFORTS, BUDDY_SHARED_RAW } from "./buddy-catalog-shared";
 // Imported for the CN roster only: a CN-only id has no row in the shared
 // table, and without one `raiseOutputForRaisedEffort` silently no-ops, so a
@@ -30,6 +30,7 @@ import { BUDDY_CN_EFFORTS, BUDDY_INTL_EFFORTS, BUDDY_SHARED_RAW } from "./buddy-
 // cn-provider (which imports this module) resolves before any call.
 import { CODEBUDDY_CN_RAW } from "./codebuddy/cn-catalog";
 import { buddyAccountUid } from "./buddy-oauth-shared";
+import { SYSTEM_PROMPT_WRAPPER_PREFIX, SYSTEM_PROMPT_WRAPPER_SUFFIX } from "../../../console/system-prompt/contracts";
 import type { ProviderDispatchContext } from "../../provider-contracts";
 
 const BUDDY_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
@@ -409,6 +410,21 @@ export function scrubBuddyChannelIdentity(messages: Array<Record<string, unknown
   }
 }
 
+/**
+ * OpenAI-compatible adapters that need the DeepSeek reasoning-replay backfill
+ * on outbound chat payloads. The buddy family runs it inside
+ * `buddyPrePayloadCommon`; these adapters register here so the same rule
+ * reaches every reseller that serves a thinking model.
+ */
+export const clineReasoningReplayPrepares: readonly ((
+  payload: Record<string, unknown>,
+) => void)[] = [
+  (payload) => {
+    backfillDeepSeekReasoningContent(payload);
+    ensureChatReasoningReplayPresence(payload);
+  },
+];
+
 /**
  * Payload prefix shared by the buddy pre-payload hooks: force `stream=true`,
  * apply the provider's DeepSeek thinking contract, opt `reasoning_summary` in
@@ -1152,12 +1168,24 @@ export function finalizeBuddyMessages(
 export function applyBuddySystemPrompt(
   messages: Array<Record<string, unknown>>,
   systemPrompt: string,
+  extraSystemText?: string,
 ): void {
+  // Tenant injection (Inject System Prompt) rides AFTER the fixed prompt,
+  // inside the same system turn, framed by the gateway's marker prefix/suffix:
+  // the upstream validates the identity prompt as the channel opener, so the
+  // fixed text must stay first and byte-identical; the wrapped tail carries
+  // the tenant's directive without touching the identity. An override-mode
+  // tenant prompt degrades to this wrapped append (the caller decides via
+  // `isWrappedInjectionProvider` before passing the text).
+  const effectivePrompt =
+    extraSystemText === undefined || extraSystemText.length === 0
+      ? systemPrompt
+      : `${systemPrompt}\n\n${SYSTEM_PROMPT_WRAPPER_PREFIX}\n${extraSystemText}\n${SYSTEM_PROMPT_WRAPPER_SUFFIX}`;
   const source = messages.filter(
     (message) => message["role"] !== "system" && message["role"] !== "developer",
   );
   messages.length = 0;
-  messages.push({ role: "system", content: systemPrompt });
+  messages.push({ role: "system", content: effectivePrompt });
   for (const message of source) {
     if (message["role"] === "user" && typeof message["content"] === "string") {
       messages.push({

package/src/providers/integrations/buddy/buddy-discovery-shared.ts

@@ -100,12 +100,43 @@ export async function fetchBuddyDirectoryModels(args: {
   readonly fetcher?: typeof fetch | undefined;
 }): Promise<readonly ModelDefinition[] | null> {
   const fetcher = args.fetcher ?? globalThis.fetch;
-  const primary = await fetchBuddyDirectoryOnce(args, fetcher, BUDDY_CONFIG_PATH);
-  if (primary !== null) return primary;
-  // Both references rank `/v3/config` above the personal-models path, but this
-  // repo has only ever called the latter, so the fallback keeps today's
-  // behaviour intact for a host that answers one and not the other.
-  return await fetchBuddyDirectoryOnce(args, fetcher, args.modelsPath);
+  // Fetch both catalog scopes and merge them. `/v3/config` is ranked higher and
+  // is the primary source (matches the reference gateways), but the personal
+  // models path carries models the v3 response does not always publish — so a
+  // single-source read can silently miss models that are callable. Merging with
+  // dedupe by model id gives the union, mirroring the upstream codebuddy2api
+  // catalog aggregation. Each failure falls through to the other source, so a
+  // host that answers only one behaves exactly as it does today.
+  const v3 = await fetchBuddyDirectoryOnce(args, fetcher, BUDDY_CONFIG_PATH);
+  const personal = await fetchBuddyDirectoryOnce(args, fetcher, args.modelsPath);
+  if (v3 !== null && personal !== null) return mergeBuddyDirectories(v3, personal);
+  return v3 ?? personal;
+}
+
+/**
+ * Merges two buddy directory reads into one roster, preserving each source's
+ * declaration order and de-duplicating by model id. `primary` wins when both
+ * sources declare the same id; models present only in `supplemental` are
+ * appended. Both lists are already filtered (disabled/CLI-roster/not-chat),
+ * so the merge only has to combine them.
+ */
+function mergeBuddyDirectories(
+  primary: readonly ModelDefinition[],
+  supplemental: readonly ModelDefinition[],
+): readonly ModelDefinition[] {
+  const seen = new Set<string>();
+  const merged: ModelDefinition[] = [];
+  for (const model of primary) {
+    if (seen.has(model.modelId)) continue;
+    seen.add(model.modelId);
+    merged.push(model);
+  }
+  for (const model of supplemental) {
+    if (seen.has(model.modelId)) continue;
+    seen.add(model.modelId);
+    merged.push(model);
+  }
+  return merged;
 }
 
 /** Reads one directory path; `null` on any transport, status, or shape miss. */

package/src/providers/integrations/buddy/buddy-identity.ts

@@ -108,10 +108,17 @@ export function buddyEnterprise(context?: ProviderDispatchContext): string | und
  *
  * Resolution order:
  * 1. `auth_state.qimei36` — explicit operator-set binding (imported or edited).
- * 2. Determinstic derivation from the internal account id (sha256 → 32 hex).
+ * 2. Derived deterministically from the internal account id (sha256 → 32 hex).
  *    This keeps the binding stable across restarts without a database write,
  *    and gives each freshly-added account its own id automatically.
  *
+ * IMPORTANT — the derived fallback is **not portable across instances**:
+ * export/import mints a NEW account id, so the derived binding changes and the
+ * upstream channel check (11128) rejects the re-imported account. The export
+ * path therefore materializes the raw result of this resolver into
+ * `auth_state.qimei36` whenever an account relies on the derivation, so a
+ * re-import carries the exact same device identity.
+ *
  * Returns `undefined` only when no account id is available (unauthenticated).
  */
 export function resolveBuddyDeviceBinding(context?: ProviderDispatchContext): string | undefined {
@@ -121,3 +128,17 @@ export function resolveBuddyDeviceBinding(context?: ProviderDispatchContext): st
   if (accountId === undefined || accountId.length === 0) return undefined;
   return createHash("sha256").update(`wb2a:qimei36:${accountId}`).digest("hex").slice(0, 32);
 }
+
+/** Materializes the portable binding for an account into a stored auth-state
+ * map, when the account does not already pin one explicitly. Used by the
+ * export path so a re-import keeps the exact qimei36 device identity. */
+export function materializeBuddyDeviceBinding(
+  accountId: string,
+  authState: Readonly<Record<string, unknown>> | undefined,
+): Record<string, unknown> | undefined {
+  const existing = authState?.["qimei36"];
+  if (typeof existing === "string" && existing.trim().length > 0) return undefined;
+  if (accountId.length === 0) return undefined;
+  const derived = createHash("sha256").update(`wb2a:qimei36:${accountId}`).digest("hex").slice(0, 32);
+  return { ...(authState ?? {}), qimei36: derived };
+}