cartethyia 2.7.3 → 2.7.5

package/src/providers/integrations/buddy/buddy-identity.ts

@@ -1,6 +1,8 @@
 import type { ProviderDispatchContext } from "../../provider-contracts";
 import { createHash } from "node:crypto";
 import { decodeJwtPayload } from "../../authentication/oauth-flow-store";
+import { buddyAccountUid } from "./buddy-oauth-shared";
+import type { CanonicalRequest } from "../../../protocol/canonical-model";
 
 /**
  * Which upstream client a buddy provider presents itself as.
@@ -41,8 +43,17 @@ export function resolveBuddyIdentity(
  * The reference CLI sends the literal `anonymous` when it has no uid rather
  * than omitting the header, so an unauthenticated dispatch still looks like a
  * client rather than like a caller that forgot a header.
+ *
+ * When the credential carries a JWT, the `sub` claim is the upstream uid and
+ * wins over the gateway's internal account id — the two can differ after an
+ * import, and the channel check keys on the upstream identity. Opaque API keys
+ * carry no identity, so the internal account id is the fallback.
  */
 export function buddyUserId(context?: ProviderDispatchContext): string {
+  const secret = context?.credential?.secret;
+  const token = secret ? new TextDecoder().decode(secret).trim() : "";
+  const uid = buddyAccountUid(token);
+  if (uid !== undefined) return uid;
   const accountId = context?.credential.account_id;
   return accountId !== undefined && accountId.length > 0 ? accountId : "anonymous";
 }
@@ -108,10 +119,17 @@ export function buddyEnterprise(context?: ProviderDispatchContext): string | und
  *
  * Resolution order:
  * 1. `auth_state.qimei36` — explicit operator-set binding (imported or edited).
- * 2. Determinstic derivation from the internal account id (sha256 → 32 hex).
+ * 2. Derived deterministically from the internal account id (sha256 → 32 hex).
  *    This keeps the binding stable across restarts without a database write,
  *    and gives each freshly-added account its own id automatically.
  *
+ * IMPORTANT — the derived fallback is **not portable across instances**:
+ * export/import mints a NEW account id, so the derived binding changes and the
+ * upstream channel check (11128) rejects the re-imported account. The export
+ * path therefore materializes the raw result of this resolver into
+ * `auth_state.qimei36` whenever an account relies on the derivation, so a
+ * re-import carries the exact same device identity.
+ *
  * Returns `undefined` only when no account id is available (unauthenticated).
  */
 export function resolveBuddyDeviceBinding(context?: ProviderDispatchContext): string | undefined {
@@ -121,3 +139,92 @@ export function resolveBuddyDeviceBinding(context?: ProviderDispatchContext): st
   if (accountId === undefined || accountId.length === 0) return undefined;
   return createHash("sha256").update(`wb2a:qimei36:${accountId}`).digest("hex").slice(0, 32);
 }
+
+/** Materializes the portable binding for an account into a stored auth-state
+ * map, when the account does not already pin one explicitly. Used by the
+ * export path so a re-import keeps the exact qimei36 device identity. */
+export function materializeBuddyDeviceBinding(
+  accountId: string,
+  authState: Readonly<Record<string, unknown>> | undefined,
+): Record<string, unknown> | undefined {
+  const existing = authState?.["qimei36"];
+  if (typeof existing === "string" && existing.trim().length > 0) return undefined;
+  if (accountId.length === 0) return undefined;
+  const derived = createHash("sha256").update(`wb2a:qimei36:${accountId}`).digest("hex").slice(0, 32);
+  return { ...(authState ?? {}), qimei36: derived };
+}
+
+/**
+ * The OAuth identity header family the reference ships on every cloud API call
+ * (`runIdentityHeaders`): `X-User-Id` plus the base64 `X-Userinfo` envelope and
+ * the auth-method / id-source markers.
+ *
+ * The JWT `sub` is the uid; the base64 envelope mirrors the reference exactly:
+ * `{ uin, owner_uin?, id_source?, token_source? }` — one leg per identity
+ * field that exists, so a personal account sends `{uin}` while an enterprise
+ * account adds `owner_uin`. `X-Auth-Method` / `X-Id-Source` are only sent when
+ * the operator pinned them in `auth_state` (there is no reliable source to
+ * invent them from). An opaque API key carries no uid and yields nothing.
+ */
+export function buddyOAuthIdentityHeaders(
+  context?: ProviderDispatchContext,
+): Record<string, string> {
+  const secret = context?.credential?.secret;
+  const token = secret ? new TextDecoder().decode(secret).trim() : "";
+  const uid = buddyAccountUid(token) ?? context?.credential.account_id ?? "";
+  if (uid.length === 0) return {};
+  const enterpriseId = buddyEnterprise(context);
+  const state = context?.credential.auth_state;
+  const idSource =
+    typeof state?.["idSource"] === "string" && (state["idSource"] as string).trim().length > 0
+      ? (state["idSource"] as string).trim()
+      : undefined;
+  const method =
+    typeof state?.["authMethod"] === "string" && (state["authMethod"] as string).trim().length > 0
+      ? (state["authMethod"] as string).trim()
+      : undefined;
+  const headers: Record<string, string> = { "X-User-Id": uid };
+  if (method !== undefined) headers["X-Auth-Method"] = method;
+  if (idSource !== undefined) headers["X-Id-Source"] = idSource;
+  if (enterpriseId !== undefined || idSource !== undefined || method !== undefined) {
+    const info: Record<string, string> = { uin: uid };
+    if (enterpriseId !== undefined) info["owner_uin"] = enterpriseId;
+    if (idSource !== undefined) info["id_source"] = idSource;
+    if (method !== undefined) info["token_source"] = method;
+    headers["X-Userinfo"] = Buffer.from(JSON.stringify(info), "utf-8").toString("base64");
+  }
+  return headers;
+}
+
+/**
+ * Whether this dispatch is in the reference's private-data mode. The CLI only
+ * sends `X-Private-Data: true` while the session is private; otherwise the
+ * header is deleted, never sent as `false`. The gateway has no session-level
+ * private flag, so the operator pins one per account in `auth_state.privateData`.
+ */
+export function buddyPrivateData(context?: ProviderDispatchContext): boolean {
+  return context?.credential.auth_state?.["privateData"] === true;
+}
+
+/**
+ * The effective agent purpose for one dispatch, matching the reference's
+ * `getEffectiveAgentPurpose` behavior as closely as the gateway can:
+ *
+ * - `PERSONAL_AGENT_ROLE` set → `person_agent` (same env the CLI reads);
+ * - otherwise an inbound `x-agent-purpose` header is preserved (the caller
+ *   already stated a purpose — same shape the reference passes through);
+ * - otherwise the header is omitted. The reference does not invent `conversation`.
+ */
+export function buddyAgentPurpose(
+  context?: ProviderDispatchContext,
+  request?: CanonicalRequest,
+): string | undefined {
+  if (process.env.PERSONAL_AGENT_ROLE && process.env.PERSONAL_AGENT_ROLE.trim().length > 0) {
+    return "person_agent";
+  }
+  const inbound = context?.request_headers?.["x-agent-purpose"]?.trim();
+  if (inbound !== undefined && inbound.length > 0) return inbound;
+  const fromRequest = request?.metadata?.["agent_purpose"];
+  if (typeof fromRequest === "string" && fromRequest.trim().length > 0) return fromRequest.trim();
+  return undefined;
+}

package/src/providers/integrations/buddy/buddy-media.ts

@@ -108,7 +108,7 @@ export async function buddyGenerateImage(
   context: ProviderDispatchContext,
 ): Promise<ImageGenerationOutcome> {
   const model = modelOf(body, candidate);
-  if (model.length === 0) throw new GatewayError("invalid_request", 400, "model is required");
+  if (model.length === 0) throw new GatewayError("invalid_request", 400, "model is required (request {requestId}). Check the shape of what you sent — then resend 🪞");
   const prompt = imagePrompt(body);
   if (config.imageGenerationPath !== undefined) {
     const requestBody: Record<string, unknown> = { model, prompt };
@@ -134,28 +134,28 @@ export async function buddyGenerateImage(
       release();
     }
     if (!isRecord(responseBody)) {
-      throw new GatewayError("platform_unavailable", 502, "CodeBuddy image generation returned an invalid response", {}, "upstream");
+      throw new GatewayError("platform_unavailable", 502, "CodeBuddy image generation returned an invalid response (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
     }
     const providerError = buddyErrorOf(responseBody);
     if (providerError !== undefined) {
-      throw new GatewayError("platform_unavailable", 502, providerError, {}, "upstream");
+      throw new GatewayError("platform_unavailable", 502, `${providerError} (request {requestId}). The upstream came back empty-handed — retry 🌙`, {}, "upstream");
     }
     if (responseBody.code !== undefined && responseBody.code !== 0 && responseBody.code !== "0") {
       const message =
         typeof responseBody.msg === "string" && responseBody.msg.trim().length > 0
           ? responseBody.msg.trim()
           : `CodeBuddy image generation failed with code ${String(responseBody.code)}`;
-      throw new GatewayError("platform_unavailable", 502, message, {}, "upstream");
+      throw new GatewayError("platform_unavailable", 502, `${message} (request {requestId}). The upstream came back empty-handed — retry 🌙`, {}, "upstream");
     }
     if (!isRecord(responseBody.data)) {
-      throw new GatewayError("platform_unavailable", 502, "CodeBuddy image generation returned no image data", {}, "upstream");
+      throw new GatewayError("platform_unavailable", 502, "CodeBuddy image generation returned no image data (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
     }
     const result = responseBody.data;
     if (!Array.isArray(result.data) || result.data.some((image) => !isRecord(image))) {
-      throw new GatewayError("platform_unavailable", 502, "CodeBuddy image generation returned malformed image data", {}, "upstream");
+      throw new GatewayError("platform_unavailable", 502, "CodeBuddy image generation returned malformed image data (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
     }
     if (result.data.length === 0) {
-      throw new GatewayError("platform_unavailable", 502, "CodeBuddy image generation returned no images", {}, "upstream");
+      throw new GatewayError("platform_unavailable", 502, "CodeBuddy image generation returned no images (request {requestId}). The upstream came back empty-handed — retry 🌙", {}, "upstream");
     }
     return {
       ...(typeof result.created === "number" ? { created: result.created } : {}),
@@ -217,7 +217,7 @@ export async function buddyGenerateImage(
   if (!contentType.includes("text/event-stream")) {
     const parsed: unknown = await response.json().catch(() => null);
     const message = buddyErrorOf(parsed) ?? "CodeBuddy image generation returned a non-stream body";
-    throw new GatewayError("platform_unavailable", 502, message, {}, "upstream");
+    throw new GatewayError("platform_unavailable", 502, `${message} (request {requestId}). The upstream came back empty-handed — retry 🌙`, {}, "upstream");
   }
   let content = "";
   for await (const event of decodeSseEvents(response.body, { signal: context.abort_signal })) {
@@ -232,7 +232,7 @@ export async function buddyGenerateImage(
     if (!isRecord(parsed)) continue;
     if (isRecord(parsed.error)) {
       const message = isRecord(parsed.error) && typeof parsed.error.message === "string" ? parsed.error.message : "CodeBuddy image generation failed";
-      throw new GatewayError("platform_unavailable", 502, message, {}, "upstream");
+      throw new GatewayError("platform_unavailable", 502, `${message} (request {requestId}). The upstream came back empty-handed — retry 🌙`, {}, "upstream");
     }
     const choices = parsed.choices;
     if (!Array.isArray(choices) || !isRecord(choices[0])) continue;
@@ -244,7 +244,7 @@ export async function buddyGenerateImage(
     throw new GatewayError(
       "platform_unavailable",
       502,
-      "CodeBuddy image generation returned no image in the chat stream",
+      "CodeBuddy image generation returned no image in the chat stream (request {requestId}). The upstream came back empty-handed — retry 🌙",
       {},
       "upstream",
     );
@@ -318,7 +318,7 @@ export async function buddyGenerateVideo(
   context: ProviderDispatchContext,
 ): Promise<Record<string, unknown>> {
   const model = modelOf(body, candidate);
-  if (model.length === 0) throw new GatewayError("invalid_request", 400, "model is required");
+  if (model.length === 0) throw new GatewayError("invalid_request", 400, "model is required (request {requestId}). Check the shape of what you sent — then resend 🪞");
   const prompt = imagePrompt(body);
   const submitBody: Record<string, unknown> = { model, prompt };
   if (typeof body.n === "number" && Number.isFinite(body.n)) submitBody["n"] = Math.max(1, Math.floor(body.n));
@@ -354,14 +354,14 @@ export async function buddyGenerateVideo(
     if (url !== undefined) return { data: [{ url }] };
     // Otherwise cb refused (HTTP 200 error envelope) — surface its own reason.
     const message = buddyErrorOf(submitted) ?? "CodeBuddy video submit returned no task id";
-    throw new GatewayError("platform_unavailable", 502, message, {}, "upstream");
+    throw new GatewayError("platform_unavailable", 502, `${message} (request {requestId}). The upstream came back empty-handed — retry 🌙`, {}, "upstream");
   }
   // Poll the sibling task endpoint until the clip is ready.
   const taskPath = `${submitUrl.replace(/\/+$/, "")}/${taskId}`;
   const deadline = Date.now() + VIDEO_POLL_TIMEOUT_MS;
   for (;;) {
     if (context.abort_signal?.aborted) {
-      throw new GatewayError("transport_closed", 499, "video generation aborted");
+      throw new GatewayError("transport_closed", 499, "video generation aborted (request {requestId}). Send it again whenever ready 🙃");
     }
     const lifecycle = createUpstreamDeadlineLifecycle(context);
     let statusRes: Response;
@@ -374,7 +374,7 @@ export async function buddyGenerateVideo(
     } catch (error: unknown) {
       const abortError = abortGatewayError(lifecycle, error, context.abort_signal);
       if (abortError) throw abortError;
-      throw new GatewayError("platform_unavailable", 502, `CodeBuddy video status unreachable: ${error instanceof Error ? error.message : String(error)}`, {}, "upstream");
+      throw new GatewayError("platform_unavailable", 502, `CodeBuddy video status unreachable (request {requestId}): ${error instanceof Error ? error.message : String(error)}. The connection ghosted us — come back in a moment 👻`, {}, "upstream");
     } finally {
       lifecycle.release();
     }
@@ -386,10 +386,10 @@ export async function buddyGenerateVideo(
     if (url !== undefined) return { data: [{ url }], task_id: taskId };
     const status = videoStatusOf(payload);
     if (status !== undefined && !VIDEO_PENDING.has(status)) {
-      throw new GatewayError("platform_unavailable", 502, `CodeBuddy video task ended in state "${status}" with no clip`, {}, "upstream");
+      throw new GatewayError("platform_unavailable", 502, `CodeBuddy video task ended in state "${status}" with no clip (request {requestId}). The upstream came back empty-handed — retry 🌙`, {}, "upstream");
     }
     if (Date.now() > deadline) {
-      throw new GatewayError("platform_unavailable", 504, `CodeBuddy video task ${taskId} did not finish within ${VIDEO_POLL_TIMEOUT_MS}ms`, {}, "upstream");
+      throw new GatewayError("platform_unavailable", 504, `CodeBuddy video task ${taskId} did not finish within ${VIDEO_POLL_TIMEOUT_MS}ms (request {requestId}). Some things just take longer 🐢`, {}, "upstream");
     }
     await new Promise((resolve) => setTimeout(resolve, VIDEO_POLL_INTERVAL_MS));
   }

package/src/providers/integrations/buddy/buddy-oauth-shared.ts

@@ -120,7 +120,7 @@ export function buddyAccountUid(accessToken: string): string | undefined {
  * Falls back to `undefined` when the token carries no usable identity, letting
  * the console keep the operator-supplied label.
  */
-export function buddyAccountLabel(accessToken: string): string | undefined {
+function buddyAccountLabel(accessToken: string): string | undefined {
   const claims = decodeJwtPayload(accessToken);
   if (!claims) return undefined;
   const email = nonEmptyTrimmedString(claims.email) ?? nonEmptyTrimmedString(claims.preferred_username);

package/src/providers/integrations/buddy/codebuddy/cn-provider.ts

@@ -48,8 +48,7 @@ function isAgentPromptText(text: string): boolean {
   );
 }
 
-const CODEBUDDY_CN_NEUTRAL_PROMPT =
-  "You are a helpful AI assistant that helps with software engineering tasks.";
+const CODEBUDDY_CN_NEUTRAL_PROMPT = "You are a helpful assistant.";
 
 function flattenContent(content: unknown): string {
   if (typeof content === "string") return content;

package/src/providers/integrations/buddy/codebuddy/provider.ts

@@ -51,22 +51,11 @@ export const CODEBUDDY_BASE_URL = providerBaseUrl("cb");
  *
  * The wire contract is that the request *opens* with a `system` turn (code
  * `11128`); the gateway replaces any caller `system`/`developer` turn with this
- * fixed prompt. The text is the CodeBuddy CLI's own leading prompt — the same
- * one the reference client (and the donor gateway's `prepend` prompt mode)
- * sends — so a proxied request is byte-faithful to an official client rather
- * than a neutral stand-in.
- *
- * Keeping the official identity is forward-compatible: the upstream is not
- * observed to validate this text today, but a proxy that claims the real
- * client's identity cannot be caught out if it starts to. A previous neutral
- * persona ("You are a pragmatic and direct software engineering assistant…")
- * worked, but diverged from every request the official CLI emits.
+ * fixed prompt. Deliberately neutral: a simple helpful-assistant persona with
+ * no client/CLI branding, kept minimal so the text reads naturally to any
+ * model and does not advertise a channel identity upstream.
  */
-export const CODEBUDDY_SYSTEM_PROMPT =
-  "You are CodeBuddy Code.\n\n" +
-  "You are an interactive CLI tool that helps users with software engineering tasks. " +
-  "Use the instructions below and the tools available to you to assist the user. " +
-  "Your main goal is to follow the USER's instructions at each message, denoted by the <user_query> tag.";
+export const CODEBUDDY_SYSTEM_PROMPT = "You are a helpful assistant.";
 
 function codeBuddyIntlPrePayload(
   payload: Record<string, unknown>,
@@ -81,7 +70,7 @@ function codeBuddyIntlPrePayload(
     typeof rawModel === "string" && rawModel.length > 0
       ? rawModel
       : candidate.model_id;
-  if (!source) throw new GatewayError("invalid_request", 400, "CodeBuddy model is required");
+  if (!source) throw new GatewayError("invalid_request", 400, "CodeBuddy model is required (request {requestId}). Check the shape of what you sent — then resend 🪞");
   const messages = payload["messages"];
   if (Array.isArray(messages)) {
     applyBuddySystemPrompt(

package/src/providers/integrations/buddy/codebuddy/shared.ts

@@ -3,7 +3,15 @@ import type { CanonicalRequest } from "../../../../protocol/canonical-model";
 import type { ProviderDispatchContext, ProviderDispatchTarget, ProviderId } from "../../../provider-contracts";
 import { resolveInboundSessionId } from "../../../operations/session-resolution";
 import { buddyConversationHeaders } from "../buddy-conversation-headers";
-import { buddyEnterprise, buddyUserId, resolveBuddyDeviceBinding, resolveBuddyIdentity } from "../buddy-identity";
+import {
+  buddyAgentPurpose,
+  buddyEnterprise,
+  buddyOAuthIdentityHeaders,
+  buddyPrivateData,
+  buddyUserId,
+  resolveBuddyDeviceBinding,
+  resolveBuddyIdentity,
+} from "../buddy-identity";
 import { buildCodeBuddyUserAgent, getCodeBuddyCnVersion, getCodeBuddyVersion } from "../../../operations/client-versions";
 import { buddyDeviceTokenHeaders } from "../workbuddy/shared";
 import { CODEBUDDY_TURING_CONFIG } from "../turing-device-token";
@@ -40,6 +48,13 @@ export async function codebuddyHeaders(
     ...(conversationId === undefined ? {} : { conversationId }),
   });
   if (resolveBuddyIdentity(context, cliIdentity) === "cli") {
+    const purpose = buddyAgentPurpose(context, request);
+    // Root/parent conversation context is forwarded only when the caller
+    // actually supplied it — the reference emits these conditionally for
+    // subagent/root chains and never invents them.
+    const inbound = context?.request_headers;
+    const rootRequestId = inbound?.["x-root-request-id"]?.trim();
+    const parentConversationId = inbound?.["x-parent-conversation-id"]?.trim();
     return {
       // The CLI sends `Accept: application/json` and no device token. It keeps
       // the request-shape markers (`X-Requested-With`, `X-CodeBuddy-Request`)
@@ -55,19 +70,24 @@ export async function codebuddyHeaders(
       "X-Domain": codebuddyDomain(variant),
       "x-requested-with": "XMLHttpRequest",
       "x-codebuddy-request": "1",
-      // The conversation purpose the reference client states. Not required —
-      // verified against the live API that a request succeeds without it — but
-      // it is part of the client's real request, and matching the client is the
-      // defence against a channel check tightening later.
-      "X-Agent-Purpose": "conversation",
+      ...(purpose === undefined ? {} : { "X-Agent-Purpose": purpose }),
       ...conversation,
+      ...(rootRequestId === undefined ? {} : { "X-Root-Request-ID": rootRequestId }),
+      ...(parentConversationId === undefined
+        ? {}
+        : { "X-Parent-Conversation-ID": parentConversationId }),
       ...buddyCliTraceHeaders(conversation),
+      // The CLI's OAuth identity family: X-User-Id from the JWT sub plus the
+      // base64 X-Userinfo envelope when identity fields exist.
+      ...buddyOAuthIdentityHeaders(context),
       ...buddyCliHeaders({
         userId: buddyUserId(context),
         enterpriseId: buddyEnterprise(context),
+        privateData: buddyPrivateData(context),
       }),
     };
   }
+  const purpose = buddyAgentPurpose(context, request);
   return {
     accept: "text/event-stream",
     "User-Agent": ua,
@@ -81,9 +101,10 @@ export async function codebuddyHeaders(
     "X-Domain": codebuddyDomain(variant),
     "x-requested-with": "XMLHttpRequest",
     "x-codebuddy-request": "1",
-    // Same value the CLI branch sends, for the same reason: part of the
-    // client's real request, harmless when the channel check does not read it.
-    "X-Agent-Purpose": "conversation",
+    // The effective agent purpose, matching the reference's dynamic value.
+    // The reference does not invent `conversation`; it sends the purpose only
+    // when one exists.
+    ...(purpose === undefined ? {} : { "X-Agent-Purpose": purpose }),
     // Same family WorkBuddy sends: the upstream's channel check reads the
     // turn-level aggregation key, and a chat request without it is refused for a
     // missing conversation id.

package/src/providers/integrations/buddy/workbuddy/provider.ts

@@ -56,15 +56,11 @@ export const WORKBUDDY_BASE_URL = providerBaseUrl("workbuddy");
  * channel"`. So this prompt is a wire contract, not merely a product choice —
  * see the sibling in `codebuddy.ts`.
  *
- * The text is WorkBuddy's own leading prompt, matching what the official client
- * (and the donor gateway's `prepend` prompt mode) sends, so a proxied request
- * carries the real client's identity instead of a neutral stand-in. A previous
- * neutral persona was accepted but diverged from every request the official
- * desktop client emits.
+ * The text is deliberately neutral: a simple helpful-assistant persona with no
+ * client/CLI branding, kept minimal so it reads naturally to any model and
+ * does not advertise a channel identity upstream.
  */
-export const WORKBUDDY_SYSTEM_PROMPT =
-  "You are WorkBuddy, a powerful AI assistant.\n\n" +
-  "Your main goal is to follow the USER's instructions at each message, denoted by the <user_query> tag.";
+export const WORKBUDDY_SYSTEM_PROMPT = "You are a helpful assistant.";
 
 /**
  * Reconstructs generic function declarations when a later tool-history turn
@@ -134,7 +130,7 @@ export function workbuddyPrePayload(
   const rawModel = payload["model"];
   const source =
     typeof rawModel === "string" && rawModel.length > 0 ? rawModel : candidate.model_id;
-  if (!source) throw new GatewayError("invalid_request", 400, "WorkBuddy model is required");
+  if (!source) throw new GatewayError("invalid_request", 400, "WorkBuddy model is required (request {requestId}). Check the shape of what you sent — then resend 🪞");
   const messages = payload["messages"];
   if (Array.isArray(messages)) {
     const normalizedMessages = messages as Array<Record<string, unknown>>;
@@ -156,7 +152,7 @@ export function workbuddyPrePayload(
 // declared reasoning-effort scale.
 const WORKBUDDY_RAW: readonly BuddyRawEntry[] = BUDDY_SHARED_RAW;
 
-export function makeWorkBuddyModels(providerId: "workbuddy" | "workbuddycn"): readonly ModelDefinition[] {
+function makeWorkBuddyModels(providerId: "workbuddy" | "workbuddycn"): readonly ModelDefinition[] {
   return [
     ...WORKBUDDY_RAW.filter(
       (entry) => !BUDDY_IMAGE_MODEL_ID_SET.has(entry[0]) && !BUDDY_VIDEO_MODEL_ID_SET.has(entry[0]),

package/src/providers/integrations/buddy/workbuddy/shared.ts

@@ -8,7 +8,15 @@ import type { ProviderDispatchContext, ProviderDispatchTarget, ProviderId } from
 import { resolveInboundSessionId } from "../../../operations/session-resolution";
 import { buddyConversationHeaders } from "../buddy-conversation-headers";
 import { buddyCliHeaders, buddyCliTraceHeaders } from "../buddy-cli-headers";
-import { buddyEnterprise, buddyUserId, resolveBuddyDeviceBinding, resolveBuddyIdentity } from "../buddy-identity";
+import {
+  buddyAgentPurpose,
+  buddyEnterprise,
+  buddyOAuthIdentityHeaders,
+  buddyPrivateData,
+  buddyUserId,
+  resolveBuddyDeviceBinding,
+  resolveBuddyIdentity,
+} from "../buddy-identity";
 import {
   buildWorkBuddyUserAgent,
   getWorkBuddyClientVersion,
@@ -86,7 +94,11 @@ export async function workbuddyHeaders(
     messageIdStyle: identity === "desktop" ? "uuid" : "hex",
   });
   const accountId = context?.credential.account_id;
+  const purpose = buddyAgentPurpose(context, request);
   if (identity === "cli") {
+    const inbound = context?.request_headers;
+    const rootRequestId = inbound?.["x-root-request-id"]?.trim();
+    const parentConversationId = inbound?.["x-parent-conversation-id"]?.trim();
     // The reference CLI: issued by the OpenAI Node SDK, so no browser
     // *transport* header (origin/referer/accept-language) and no device token,
     // and the machine/session device pair does not exist — only `X-User-Id`,
@@ -99,17 +111,23 @@ export async function workbuddyHeaders(
       "x-requested-with": "XMLHttpRequest",
       "x-codebuddy-request": "1",
       "x-domain": domain,
-      "x-agent-purpose": "conversation",
+      ...(purpose === undefined ? {} : { "x-agent-purpose": purpose }),
       "x-ide-name": "CLI",
       "x-ide-type": "CLI",
       "x-ide-version": getWorkBuddyCliVersion(),
       "x-product": "SaaS",
       "x-no-enterprise-id": "1",
       ...conversation,
+      ...(rootRequestId === undefined ? {} : { "x-root-request-id": rootRequestId }),
+      ...(parentConversationId === undefined
+        ? {}
+        : { "x-parent-conversation-id": parentConversationId }),
       ...buddyCliTraceHeaders(conversation),
+      ...buddyOAuthIdentityHeaders(context),
       ...buddyCliHeaders({
         userId: buddyUserId(context),
         enterpriseId: buddyEnterprise(context),
+        privateData: buddyPrivateData(context),
       }),
     };
   }
@@ -122,7 +140,7 @@ export async function workbuddyHeaders(
     "x-requested-with": "XMLHttpRequest",
     "x-codebuddy-request": "1",
     "x-domain": domain,
-    "x-agent-purpose": "conversation",
+    ...(purpose === undefined ? {} : { "x-agent-purpose": purpose }),
     "x-ide-name": "WorkBuddy",
     "x-ide-type": "WorkBuddy",
     "x-ide-version": clientVersion,

package/src/providers/integrations/claude/claude-betas.ts

@@ -67,7 +67,7 @@ export const ANTHROPIC_BETA_CAPABILITIES: Readonly<Record<string, readonly strin
 const BETA_TOKEN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 
 function invalidBeta(message: string, value: unknown): GatewayError {
-  return new GatewayError("invalid_request", 400, message, { field: "anthropic-beta", value });
+  return new GatewayError("invalid_request", 400, `${message} (request {requestId}). Check the shape of what you sent — then resend 🪞`, { field: "anthropic-beta", value });
 }
 
 /**